DERP
Tailscale的中继服务器机制，当直连不可用时用于保证连通性，节点分布全球多个数据中心，端对端加密确保中继节点无法解密内容
Core Facts
Tailscale uses a combination of STUN-like protocols to detect public network addresses and UDP hole punching for NAT traversal, employing a strategy of attempting direct connection first and falling back to relay.
When UDP is completely blocked by a firewall, Tailscale ensures connectivity through DERP (Designated Encrypted Relay for Packets) relay servers, and end-to-end encryption prevents the relay servers from decrypting data content.
Timeline (last 90 days)
Tailscale tries to make devices connect directly, falling back to relays (DERP) only when NAT traversal fails.
Tailscale first attempts to establish a direct UDP connection (via NAT traversal) and automatically falls back to DERP relay servers when a direct connection fails.
When Tailscale is forced to fall back to TCP DERP relay, throughput drops to nearly unusable levels.
DERP relay is based on TCP transport (typically running on port 443) and can penetrate almost all firewalls.
Tailscale handles NAT traversal through DERP (Designated Encrypted Relay for Packets) servers, enabling devices on different networks to seamlessly form a unified network.
UDP hole punching works well for full-cone and restricted-cone NATs, but is nearly ineffective against symmetric NATs, hence the need for DERP relay.
DERP relay servers can only see the ciphertext encrypted by WireGuard and cannot decrypt the actual transmitted content.
Tailscale uses STUN and ICE-like protocols for NAT traversal, and when direct connection is not possible, it forwards traffic through DERP relay servers while maintaining end-to-end encryption.
Tailscale网络中约92%的连接能建立直接P2P连接，约8%需要依赖DERP中继
All Facts (11)
Tailscale uses a combination of STUN-like protocols to detect public network addresses and UDP hole punching for NAT traversal, employing a strategy of attempting direct connection first and falling back to relay.
75%VerifiedWhen UDP is completely blocked by a firewall, Tailscale ensures connectivity through DERP (Designated Encrypted Relay for Packets) relay servers, and end-to-end encryption prevents the relay servers from decrypting data content.
65%UnverifiedDERP relay servers can only see the ciphertext encrypted by WireGuard and cannot decrypt the actual transmitted content.
60%UnverifiedTailscale uses STUN and ICE-like protocols for NAT traversal, and when direct connection is not possible, it forwards traffic through DERP relay servers while maintaining end-to-end encryption.
60%UnverifiedTailscale tries to make devices connect directly, falling back to relays (DERP) only when NAT traversal fails.
50%UnverifiedTailscale first attempts to establish a direct UDP connection (via NAT traversal) and automatically falls back to DERP relay servers when a direct connection fails.
50%UnverifiedDERP relay is based on TCP transport (typically running on port 443) and can penetrate almost all firewalls.
50%UnverifiedWhen Tailscale is forced to fall back to TCP DERP relay, throughput drops to nearly unusable levels.
50%UnverifiedTailscale handles NAT traversal through DERP (Designated Encrypted Relay for Packets) servers, enabling devices on different networks to seamlessly form a unified network.
50%UnverifiedUDP hole punching works well for full-cone and restricted-cone NATs, but is nearly ineffective against symmetric NATs, hence the need for DERP relay.
50%UnverifiedTailscale网络中约92%的连接能建立直接P2P连接，约8%需要依赖DERP中继
50%