[christop]

I tried using this or a similar repo to set up a Tailscale exit node on Fly.io before.

The downside is that my traffic never went direct; it was always relayed via a Tailscale DERP node, as Fly.io machines were only accessible via anycast, and so a direct connection from Tailscale on my machine to the exit node on Fly.io couldn't be established.

So performance wasn't as great (and I felt bad about using up Tailscale's DERP bandwidth, as a free user).

[caeril]

> it was always relayed via a Tailscale DERP node

Fly.io or not, this was an issue I always ran into with Tailscale.

They talk a big game about NAT punching, and using various UDP shenanigans to get around P2P connection formation issues, but at the end of the day, most of my connections were via DERP, even with fairly trivial firewall configurations.

[abwizz]

i really like 'DERP mode'

[MuffinFlavored]

how to circumvent this? chisel? UDP hole punching?

[christop]

Tailscale works hard to do all this stuff automatically.

Possibly you'd have more luck on a network where your client can allow incoming UDP connections on the Tailscale port, and so the exit node would be able to establish a direct connection.

But for a Tailscale peer I have running on AWS ECS, I can open the UDP port there, so a direct connection always happens regardless of what sort of network my Tailscale clients are on. I don't know if there's any Fly equivalent to get a direct connection to a UDP port.

[patte]

Yes, fly.io allows you to expose a UDP port. See the fly.toml [1] in the repo. Make sure the tailscale port is pinned [2] to the exposed port (41641 in that case).

I just tested it again and the connections are made directly (after the first 2,3 packages go via DERP):

    tailscale ping fly-ams         
    pong from fly-ams (100.96.123.32) via DERP(ams) in 15ms
    pong from fly-ams (100.96.123.32) via [2604:1380:4601:d605:0:6c3b:eed5:1]:41641 in 12ms

    tailscale status
    100.96.123.32   fly-ams              patte@       linux   active; offers exit node; direct [2604:1380:4601:d605:0:6c3b:eed5:1]:41641
    100.101.54.36   fly-hkg              patte@       linux   active; offers exit node; direct [2605:4c40:95:4eed:0:40f0:67b1:1]:41641

[1]: https://github.com/patte/fly-tailscale-exit/blob/main/fly.to... [2]: https://github.com/patte/fly-tailscale-exit/blob/main/start....

[fulafel]

On AWS you could also enable IPv6.