Learn Tailscale - Performance & Troubleshooting

#Introduction

No network is perfect, and your tailnet will eventually have problems: slow connections after a laptop wakes from sleep, pings always going through a relay, or hostnames not resolving. The difference between a professional and a beginner is the speed and calm with which they handle these issues.

Episode 18 equips you with a troubleshooting toolbox: tailscale ping, tailscale netcheck, and tailscale derp for connection diagnostics, plus patterns for the most common problems seen in the field.

#Connection Diagnostics

#tailscale ping

The first command for verifying a connection between nodes:

tailscale ping node-server
tailscale ping --c 5 node-server

Pay attention to the path part of the output: via direct for a direct connection, via DERP(region) for a relay. tailscale ping node-server is the fastest indicator of whether the problem is in the connection or in the app.

#tailscale netcheck

To understand NAT quality and direct-connection chances:

tailscale netcheck

The output of tailscale netcheck shows the NAT type, whether you're behind port restriction, and latency to various DERP regions. This answers the question "why is my connection always going through a relay".

#tailscale derp

To see relay region details:

tailscale derp

tailscale derp shows a list of regions along with their latency from your node. If the region in use is having problems, this info helps pick an alternative.

#Understanding Direct vs Relay Latency

• Direct: latency close to the normal internet path between the two nodes.
• Relay (DERP): latency increases because traffic detours through a relay server.

tailscale ping --c 3 aws-1
tailscale ping --c 3 server-home

If everything is via DERP, run tailscale netcheck to find what's blocking the direct connection.

#Common Troubleshooting

#Connections Problematic After Sleep

The most classic issue: after a laptop wakes from sleep, pings fail or are slow. The cause is stale endpoint information about other nodes. The quick fix: restart the tailnet connection.

sudo tailscale down
sudo tailscale up

The sudo tailscale up command after down re-registers endpoints and usually restores the connection within seconds.

#Always-Active DERP Fallback

If the connection always goes through DERP when it should be direct, check:

• NAT type — symmetric NAT genuinely prevents hole punching.
• A firewall blocking UDP on the WireGuard port.
• A strict network at your location (hotel, office).

Run tailscale netcheck to confirm, then consider the nearest DERP region if a relay is truly unavoidable.

#DNS Not Resolving

If .ts.net hostnames don't resolve, check whether MagicDNS is active:

tailscale dns
tailscale set --accept-dns=true

tailscale set --accept-dns=true re-enables DNS from the tailnet. If it still fails, check nslookup nas-home and make sure the system resolver uses Tailscale DNS.

#Debug Commands and Bugreport

For deeper issues, Tailscale provides diagnostic tools:

sudo tailscale debug prefs
sudo tailscale debug daemon-goroutines
sudo tailscale bugreport

tailscale bugreport collects the node's logs and configuration into a single package you can send to support. tailscale debug prefs and debug daemon-goroutines give an internal view of the daemon for self-service investigation.

#Diagnostic Workflow

#A Proven Sequence

1. tailscale status        -> node online/offline?
2. tailscale ping <node>   -> direct or relay?
3. tailscale netcheck      -> NAT and DERP health
4. tailscale derp          -> regions and latency
5. tailscale dns           -> MagicDNS active?
6. tailscale debug/bugreport -> deep investigation

Follow this sequence every time there's a connection issue. The majority of problems are solved at steps 1 through 5.

#Closing

Episode 18 keeps you calm when the network misbehaves: a complete diagnostic toolkit, an understanding of direct versus relay, and troubleshooting patterns for the most common scenarios.

Key takeaways:

• tailscale ping verifies connections and shows the path.
• tailscale netcheck reveals NAT quality.
• tailscale derp shows relay region status.
• Connections after sleep are restored with down then up.
• DNS not resolving is usually fixed with set --accept-dns=true.
• tailscale bugreport provides support with full logs.

In the next episode, episode 19, we'll cover latest stable features (1.96 - 1.102) — Tailscale Peer Relays, Tailscale Services, Aperture by Tailscale, the windowed macOS UI, group sync for Entra ID and Google Workspace, OAuth device provisioning, and client evolution with auto-update and the fast release model.