Tailscale Direct to router - relay on all LAN devices

Technical Support for Routers
1

Topology : 1 LAN network behind a Flint 2 MT6000 router (running 4.7.4).

Tests : From phone (using 5G), and the official Tailscale App

Issue : When testing connection from my phone, I easily get a direct connection to the Flint 2.
For all devices behind the router, I end up showing relayed (through one of the public DERP servers). This seems to be the case whether the client is Linux or Windows based.

Things I've tried :
I enabled "Allow Remote Access LAN". While this allowed me to access internal IPs, it didn't solve the Direct Connection issue when using Tailscale IPs.

In System -> Security, I opened port 41641 UDP. This made no difference.

Next I logged in via LuCI and downloaded a Universal Plug & Play plugin.
Within it I enabled the NAT-PMP and UPnP services. Although the default Allow High Ports option included port 41641, I added an additional rule at the top to ensure it was permitted.
I got a direct connection for a few seconds to a Windows client behind the router.
Tried a linux client behind the router, relayed. Deleted the new UPnP rule it had automatically created and tried again. Was not able to Direct connect to any of the devices behind the router :frowning:

From this point onwards I attempted a few more changes - restarting the UPnP service, disabling Tailscale on the router itself etc, but I didn't get anywhere.

I can still connect to devices behind the router - but they are always relayed.
The router itself shows direct connection every time, and I have no problems accessing the web interface via my cell, as expected.

Is there a setting I have missed that will allow me to establish a Direct Connection between outside networks, and devices behind the router? The idea of trying Tailscale is not to have opened ports. But I wish to be able to stream from my media server when travelling...

TIA

2

This may be related to the number of NAT layers of this network.

The GL router itself has a layer of NAT, which is inevitable.
The primary network may have 2 NAT layers, which just reaches the limit that the direct connection cannot be established I assume, so that the subnet client devices under the router can only establish links with relay.
(The specific link establishment rules are related to Tailscale)

You can try installing the plugin upnp on your router to see if there is any improvement.

4

Ah, okay. I could see that.
upnp plugin seems to be helping right now. Although I may just make some alternative configuration changes and see how those change things as well.

Yesterday, with upnp enabled, I was able to establish direct connections.
Thanks for the help.

1 Like