Tailscale is a very convenient networking tool that can connect devices in different network environments, even in different countries and regions, into the same virtual LAN. However, the official DERP servers are all abroad. If direct connections cannot be established, the relay latency will be very high. We can deploy one or more DERP servers domestically (or as close to the usage area as possible) to reduce relay latency and improve access speed.

If you are self-hosting Headscale, setting up your own DERP server is mandatory.

Headscale comes with a built-in DERP server, but I do not recommend using it (if the relay traffic is too heavy, it may affect the normal transmission of control information).

Prerequisites

You need to prepare a server with a public IP address and open ports TCP 80, TCP 443, and UDP 3478 in the firewall. You also need to prepare a domain name and point it to the server.

Note: If you plan to use a server in mainland China, the domain name also needs to complete ICP filing.

Install Golang

Before proceeding, you need to install Golang on the server. For detailed steps, refer to the instructions on go.dev; this article will not elaborate further.

Compile and Install

Run the following commands in order:

git clone https://github.com/tailscale/tailscale.git
cd tailscale
go build cmd/derper
sudo mv derper /usr/sbin/derper

Install System Service

Write the following content into /etc/systemd/system/derper.service:

[Unit]
Description=Derper
Wants=network-pre.target
After=network-pre.target NetworkManager.service systemd-resolved.service

[Service]
ExecStart=/usr/sbin/derper --hostname 将这里换成你提前准备的域名 -a :443 -http-port 80 -certmode letsencrypt --certdir /var/lib/derper/certs
Restart=on-failure

[Install]
WantedBy=multi-user.target

Then run the following commands to create the data folder, enable and start the service:

mkdir -p /var/lib/derper
sudo systemctl daemon-reload
sudo systemctl enable derper
sudo systemctl start derper

Configure Tailscale

1. Modify ACL

Go to the Tailscale admin console, select the Access controls tab, and edit the content:

{
  // ...
  "grants": [
    // ...
  ],
  // ...

  // 追加以下信息
  "derpMap": {
    "Regions": {
      "900": {
        "RegionID": "900",
        "RegionCode": "my_derper",
        "RegionName": "My Derper",
        "Nodes": [
          {
            "Name": "My Derper",
            "RegionID": "900",
            "HostName": "将这里换成你提前准备的域名"
          }
        ]
      },

      // 禁用官方 DERP 服务器，如果不需要可以不写
      "1": null,
      "2": null,
      "3": null,
      "4": null,
      "5": null,
      "6": null,
      "7": null,
      "8": null,
      "9": null,
      "10": null,
      "11": null,
      "12": null,
      "13": null,
      "14": null,
      "15": null,
      "16": null,
      "17": null,
      "18": null,
      "19": null,
      // "20": null, # 避免自建的derper挂掉后tailscale无法使用，保留20（Hong Kong）作为备选
      "21": null,
      "22": null,
      "23": null,
      "24": null,
      "25": null,
      "26": null,
      "27": null,
      "28": null
    }
  }
}

2. Verify

On a Tailscale-connected client, run tailscale netcheck and check if the output includes your self-hosted DERP server:

Report:
    * Time: 2025-07-30T15:17:57.176736Z
    * UDP: true
    * IPv4: yes, 127.0.0.1:114514
    * IPv6: no, but OS has support
    * MappingVariesByDestIP: true
    * PortMapping: 
    * CaptivePortal: false
    * Nearest DERP: My Derper
    * DERP latency:
        - my_derper: 162ms   (My Derper)

Set Up Client Verification

By default, a self-hosted DERP server can be used by any Tailscale user (including Headscale instances) who knows the server IP. You can enable client verification to restrict usage to your own network.

1. Install Tailscale on Server

You need to install Tailscale on the server and join your network. For detailed steps, refer to the official website; this article will not elaborate.

2. Modify Configuration

Append the -verify-clients parameter to the previous Systemd service configuration file. The modified file should look like this:

[Unit]
Description=Derper
Wants=network-pre.target
After=network-pre.target NetworkManager.service systemd-resolved.service

[Service]
ExecStart=/usr/sbin/derper --hostname 将这里换成你提前准备的域名 -a :443 -http-port 80 -certmode letsencrypt --certdir /var/lib/derper/certs -verify-clients
Restart=on-failure

[Install]
WantedBy=multi-user.target

Then restart the service:

sudo systemctl daemon-reload
sudo systemctl restart derper