starred/headscale
1
0
Fork 0
mirror of https://github.com/juanfont/headscale.git synced 2026-01-11 20:00:28 +01:00
Code Issues 98 Packages Projects Releases 10 Wiki Activity

What specific services does 'embedded DERP (and STUN) server' provide #467

New Issue
Closed
opened 2025-12-29 01:29:54 +01:00 by adam · 4 comments
adam commented 2025-12-29 01:29:54 +01:00
Owner
Copy Link

Originally created by @threerog on GitHub (Apr 7, 2023).

embedded DERP (and STUN) server #388

In addition to assisting client connections, this derp service
Can data relay transmission services be provided when the client cannot connect directly
Do you still need to build your own derp service for data relay

Originally created by @threerog on GitHub (Apr 7, 2023). embedded DERP (and STUN) server #388 In addition to assisting client connections, this derp service Can data relay transmission services be provided when the client cannot connect directly Do you still need to build your own derp service for data relay
adam added the bug label 2025-12-29 01:29:54 +01:00
adam closed this issue 2025-12-29 01:29:55 +01:00
adam commented 2025-12-29 01:29:56 +01:00
Author
Owner
Copy Link

@nblock commented on GitHub (Apr 10, 2023):

A DERP server can be used to relay traffic when a direct connection between nodes is not possible. Tailscale provides some DERP servers for their users and Headscale can also provide a single DERP instance for you.

You don't need to run your own DERP server, but you probably should to not put additional burden on Tailscale DERP servers.

@nblock commented on GitHub (Apr 10, 2023): A DERP server can be used to relay traffic when a direct connection between nodes is not possible. [Tailscale provides some DERP servers for their users](https://tailscale.com/kb/1232/derp-servers/) and Headscale can also provide a single DERP instance for you. You don't need to run your own DERP server, but you probably should to not put additional burden on Tailscale DERP servers.
adam commented 2025-12-29 01:29:56 +01:00
Author
Owner
Copy Link

@threerog commented on GitHub (Apr 12, 2023):

A DERP server can be used to relay traffic when a direct connection between nodes is not possible. Tailscale provides some DERP servers for their users and Headscale can also provide a single DERP instance for you.

You don't need to run your own DERP server, but you probably should to not put additional burden on Tailscale DERP servers.

Yes, my goal is not to use the official Derp service of Tailscale, but to use my own server to relay traffic. So I need to ensure that after blocking the official derp service of tailscale, can headscale provide relay services to ensure 100% success of the connection

@threerog commented on GitHub (Apr 12, 2023): > A DERP server can be used to relay traffic when a direct connection between nodes is not possible. [Tailscale provides some DERP servers for their users](https://tailscale.com/kb/1232/derp-servers/) and Headscale can also provide a single DERP instance for you. > > You don't need to run your own DERP server, but you probably should to not put additional burden on Tailscale DERP servers. Yes, my goal is not to use the official Derp service of Tailscale, but to use my own server to relay traffic. So I need to ensure that after blocking the official derp service of tailscale, can headscale provide relay services to ensure 100% success of the connection
adam commented 2025-12-29 01:29:56 +01:00
Author
Owner
Copy Link

@nblock commented on GitHub (Apr 12, 2023):

Yes, my goal is not to use the official Derp service of Tailscale, but to use my own server to relay traffic. So I need to ensure that after blocking the official derp service of tailscale, can headscale provide relay services to ensure 100% success of the connection

The following configuration snippet should be sufficient to only use the builtin headscale DERP server:


derp:                                                                                                                                                               
  server:                                                                                                                                                           
    # If enabled, runs the embedded DERP server and merges it into the rest of the DERP config                                                                      
    # The Headscale server_url defined above MUST be using https, DERP requires TLS to be in place                                                                  
    enabled: true                                                                                                                                                   
                                                                                                                                                                    
    # Region ID to use for the embedded DERP server.                                                                                                                
    # The local DERP prevails if the region ID collides with other region ID coming from                                                                            
    # the regular DERP config.                                                                                                                                      
    region_id: 999                                                                                                                                                  
                                                                                                                                                                    
    # Region code and name are displayed in the Tailscale UI to identify a DERP region                                                                              
    region_code: "headscale"                                                                                                                                        
    region_name: "Headscale Embedded DERP"                                                                                                                          
                                                                                                                                                                    
    # Listens over UDP at the configured address for STUN connections - to help with NAT traversal.                                                                 
    # When the embedded DERP server is enabled stun_listen_addr MUST be defined.                                                                                    
    #                                                                                                                                                               
    # For more details on how this works, check this great article: https://tailscale.com/blog/how-tailscale-works/                                                 
    stun_listen_addr: "0.0.0.0:3478"                                                                                                                                
                                                                                                                                                                    
  # List of externally available DERP maps encoded in JSON                                                                                                          
  urls: []

Verify with: tailscale debug derp-map - it should only list your selfhosted DERP server.

@nblock commented on GitHub (Apr 12, 2023): > Yes, my goal is not to use the official Derp service of Tailscale, but to use my own server to relay traffic. So I need to ensure that after blocking the official derp service of tailscale, can headscale provide relay services to ensure 100% success of the connection The following configuration snippet should be sufficient to only use the builtin headscale DERP server: ```yaml derp: server: # If enabled, runs the embedded DERP server and merges it into the rest of the DERP config # The Headscale server_url defined above MUST be using https, DERP requires TLS to be in place enabled: true # Region ID to use for the embedded DERP server. # The local DERP prevails if the region ID collides with other region ID coming from # the regular DERP config. region_id: 999 # Region code and name are displayed in the Tailscale UI to identify a DERP region region_code: "headscale" region_name: "Headscale Embedded DERP" # Listens over UDP at the configured address for STUN connections - to help with NAT traversal. # When the embedded DERP server is enabled stun_listen_addr MUST be defined. # # For more details on how this works, check this great article: https://tailscale.com/blog/how-tailscale-works/ stun_listen_addr: "0.0.0.0:3478" # List of externally available DERP maps encoded in JSON urls: [] ```` Verify with: `tailscale debug derp-map` - it should only list your selfhosted DERP server.
adam commented 2025-12-29 01:29:56 +01:00
Author
Owner
Copy Link

@kradalby commented on GitHub (Apr 13, 2023):

This question is more suitable for Discord than Github, I will close this, please continue the conversation there.

Do you still need to build your own derp service for data relay

In principal, you would not need to add more than the one DERP server that comes with headscale, however, you would introduce a single point of failure into your setup, so having more than one might be sensible.

@kradalby commented on GitHub (Apr 13, 2023): This question is more suitable for Discord than Github, I will close this, please continue the conversation there. > Do you still need to build your own derp service for data relay In principal, you would _not_ need to add more than the one DERP server that comes with headscale, however, you would introduce a single point of failure into your setup, so having more than one might be sensible.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
CLI
DERP
DNS
Nix
OIDC
SSH
bug
database
documentation
duplicate
enhancement
faq
good first issue
grants
help wanted
might-come
needs design doc
needs investigation
no-stale-bot
out of scope
performance
policy 📝
pull-request
Mirrored from GitHub Pull Request
 question
regression
routes
stale
tags
tailscale-feature-gap
well described ❤️
wontfix
No Label bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/headscale#467
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?