TAILMON TAILMON v1.3.0 -Aug 24, 2025- WireGuard-based Tailscale Installer, Configurator and Monitor (Available in AMTM!)

[Joel_w]

Sorry @Joel_w I really can't follow what you're asking. You talk about NAT (full cone or symmetric), "direct connection", port forwarding, UPnP. None of this has anything to do with TAILMON (Tailscale). Tailscale is a VPN.

Tailscale tries to create a direct connection between two units on the Tailnet, but NAT and firewalls can make that difficult or impossible. If it fails the connection is sent via a third server, a DERP. That’s slow so I’m trying to avoid that.

I guess my question doesn’t have much to do with Tailmon but it was the way I installed Tailscale on the router.

 

[ColinTaylor]

Tailscale tries to create a direct connection between two units on the Tailnet, but NAT and firewalls can make that difficult or impossible. If it fails the connection is sent via a third server, a DERP. That’s slow so I’m trying to avoid that.

I guess my question doesn’t have much to do with Tailmon but it was the way I installed Tailscale on the router.

Does your router (with Tailscale installed on it) have a publicly accessible IP address? Or is it behind another, upstream router or have CGNAT?

What are your internet download and upload speeds normally? When you say using DERP is slow, how slow relative to your clients' normal speeds?

 

[Joel_w]

Does your router (with Tailscale installed on it) have a publicly accessible IP address? Or is it behind another, upstream router or have CGNAT?

What are your internet download and upload speeds normally? When you say using DERP is slow, how slow relative to your clients' normal speeds?

I’m not behind CGNAT so yes a publicly accessible IP address. And I do get direct connections to the other devices connected behind the same router, just not to the router itself. I’ve tried it with the ping function in the Tailscale app and with Iperf3 to both the internal IP address and the Tailscale address, same result.

I have a 1Gbit symmetrical connection, and usually get around 850 Mbit down and over 900 up. If I run Iperf3 to one of the devices that gets a direct connection the speed is around 120-150 Mbit which is perfectly fine for everything I want to do (I was testing over 5G so that might have limited the speed). But on the DERP connection to the router I sometimes get under 10 Mbit and sometimes around 25 Mbit, never more. And pings over 100 ms.

 

[ColinTaylor]

I’m not behind CGNAT so yes a publicly accessible IP address. And I do get direct connections to the other devices connected behind the same router, just not to the router itself. I’ve tried it with the ping function in the Tailscale app and with Iperf3 to both the internal IP address and the Tailscale address, same result.

I have a 1Gbit symmetrical connection, and usually get around 850 Mbit down and over 900 up. If I run Iperf3 to one of the devices that gets a direct connection the speed is around 120-150 Mbit which is perfectly fine for everything I want to do (I was testing over 5G so that might have limited the speed). But on the DERP connection to the router I sometimes get under 10 Mbit and sometimes around 25 Mbit, never more. And pings over 100 ms.

Does tailscale status on the router show that your clients have a direct connection or that they're using DERP?

You're currently using Userspace Mode. That will CPU limit your speeds, although not by the amount you report. I suggest you switch to Kernel Mode and see if that's any better.

 

[Joel_w]

Does tailscale status on the router show that your clients have a direct connection or that they're using DERP?

You're currently using Userspace Mode. That will CPU limit your speeds, although not by the amount you report. I suggest you switch to Kernel Mode and see if that's any better.

Yes, the status says relay.

I’ll try the kernel mode if I can get this working, but 100 Mbit+ is really more than I need. I’d be happy with maybe 30 Mbit+ if I could get that stable with decent latency.

 

[buis]

Hi. I installed Tailmon yesterday but no matter what I try I can't seem to get a direct connection to the router itself from outside the network. By switching to a full cone NAT instead of symmetric I seem to get a direct connection to my other devices on my network but never to the router. To troubleshoot I've tried to forward port 41641 to 192.168.0.1, and also temporarily enable UPnP, but it makes no difference when it comes to the router.

Maybe I'm wrong but I'm thinking I need a direct connection to the router since it gives access to the rest of the internal devices that don't run Tailscale, right? Now when I try to reach them I get slow speeds and ping so they must be relayed.

And by the way, is just enabling a full cone NAT the most secure way to get a direct connection on Asus Merlin? UPnP should be much worse, and I'm thinking forwarding a port would be too, right?

I had the same then go to admin Console and access below you can do the setting all access

 

[Joel_w]

Does tailscale status on the router show that your clients have a direct connection or that they're using DERP?

You're currently using Userspace Mode. That will CPU limit your speeds, although not by the amount you report. I suggest you switch to Kernel Mode and see if that's any better.

Hey! Changing to kernel mode seems to have fixed my problem! Now I get a direct connection even to the router, and the speed is up to over 350 Mbit/s. I can also reach my non Tailscale device on my local network at full speed from outside. Feels like a bug somewhere (probably not in Tailmon though). Thanks for helping me diagnose, @ColinTaylor . I was curious to see what speeds I could get and then it happened to fix my actual problem.

It might be interesting for someone else that kernel mode more than doubles the speed on a RT-AX86U with a fast connection. Still testing over 5G so it might not be super precise but at least I'm sitting at the exact same place as I did yesterday.

And thanks for your advice, @buis but I checked and it was already set to all access by default.

 

[jksmurf]

It might be interesting for someone else that kernel mode more than doubles the speed on a RT-AX86U with a fast connection.

Thank you for the feedback, good to know. I’ve always used kernel mode (after a few initial trials on userspace) but TBH never tested for speed difference.

Having said that I can’t see the mode affecting direct vs DERP. Maybe it was one of those things where just at the same time as you changed to kernel the connection went direct . In any case, good result, happy for you.

 

[Viktor Jaep]

Feels like a bug somewhere (probably not in Tailmon though).

Puh-lease!!

It's most likely the difference in performance between userspace and kernel mode. It probably just make a much bigger difference on your router. Glad you've got it resolved!

 

[jksmurf]

Puh-lease!!

It's most likely the difference in performance between userspace and kernel mode

Yeah-Nah… Direct vs DERP I reckon, which is not userspace vs kernel dependent, as I understand it.

 

[Viktor Jaep]

Yeah-Nah… Direct vs DERP I reckon, which is not userspace vs kernel dependent, as I understand it.

Well, DERP + Userspace would be the worst-case scenario for performance would be my thinking? Regardless, glad it's resolved! Really appreciate your help jumping in!

 

[jksmurf]

Hi Viktor,

Another oddity. When I was playing around (remotely) with GNP and amending GNP settings and deleting interfaces etc. Tailmon restarted (per the email it sent me) and then didn't re-connect despite the staying alive selection (aka the Bee Gees...).

I then SSH'd in and started it and saw this (yikes):

# Health check:
#     - adding loopback allow rule for "fd7a:115c:a1e0::1d01:3e0e": running [/usr/sbin/ip6tables -t filter -I ts-input 1 -i lo -s fd7a:115c:a1e0::1d01:3e0e -j ACCEPT]: exit status 1: ip6tables: Resource temporarily unavailable.

I chose said C, R (Restart) and saw this, A second go fixed it, but just a data point. I used WG as a backup to fix it.

 

[Viktor Jaep]

Hi Viktor,

Another oddity. When I was playing around (remotely) with GNP and amending GNP settings and deleting interfaces etc. Tailmon restarted (per the email it sent me) and then didn't re-connect despite the staying alive selection (aka the Bee Gees...).

I then SSH'd in and started it and saw this (yikes):

# Health check:
#     - adding loopback allow rule for "fd7a:115c:a1e0::1d01:3e0e": running [/usr/sbin/ip6tables -t filter -I ts-input 1 -i lo -s fd7a:115c:a1e0::1d01:3e0e -j ACCEPT]: exit status 1: ip6tables: Resource temporarily unavailable.

I chose said C, R (Restart) and saw this, A second go fixed it, but just a data point. I used WG as a backup to fix it.

View attachment 68223

Messing with GNP probably messes with iptables, which Tailscale seems to be relying on as well. When you have multiple applications modifying iptables, someone can definitely lose the battle. For instance, KILLMON always loses out to Skynet whenever there ever are major changes to the iptables, so I have that on my list to fix here soon. I'm afraid this isn't anything TAILMON can help with as it's built-in functionality of Tailscale to keep track of it's iptables entries. Glad you were able to recover, and thanks for the report!

 

[Viktor Jaep]

So as a sidenote, I lost visibility of my test router after a few days running under kernel mode (as a test). Tailscale was still running, but it basically refused to see the Internet or resolve hostnames. Looking into it further, it seems under kernel mode, it modifies the /etc/resolve.conf and changed its DNS value to 100.100.100.100. Apparently some kind of internal magicdns functionality. I switched it back to userspace mode, and it changed this value back to my regular DNS IPs, and resolution worked again. Go figure.

 

[jksmurf]

So as a sidenote, I lost visibility of my test router after a few days running under kernel mode (as a test). Tailscale was still running, but it basically refused to see the Internet or resolve hostnames. Looking into it further, it seems under kernel mode, it modifies the /etc/resolve.conf and changed its DNS value to 100.100.100.100. Apparently some kind of internal magicdns functionality. I switched it back to userspace mode, and it changed this value back to my regular DNS IPs, and resolution worked again. Go figure.

Hmm I’m really not qualified to make anything of that, I will say apart from the recent observation above kernel mode has been great for me.

 

[Viktor Jaep]

Hmm I’m really not qualified to make anything of that, I will say apart from the recent observation above kernel mode has been great for me.

Yeah, and it's a nat'ted test router too that's seen entirely too much abuse. Just found it interesting how Tailscale's DNS may have been a cause of this issue.

 

[rung]

So as a sidenote, I lost visibility of my test router after a few days running under kernel mode (as a test). Tailscale was still running, but it basically refused to see the Internet or resolve hostnames. Looking into it further, it seems under kernel mode, it modifies the /etc/resolve.conf and changed its DNS value to 100.100.100.100. Apparently some kind of internal magicdns functionality. I switched it back to userspace mode, and it changed this value back to my regular DNS IPs, and resolution worked again. Go figure.

Nice. Now you convinced me to never try to kernel mode. Lol. Userspace mode has been so reliable for me!

 

[ColinTaylor]

So as a sidenote, I lost visibility of my test router after a few days running under kernel mode (as a test). Tailscale was still running, but it basically refused to see the Internet or resolve hostnames. Looking into it further, it seems under kernel mode, it modifies the /etc/resolve.conf and changed its DNS value to 100.100.100.100. Apparently some kind of internal magicdns functionality. I switched it back to userspace mode, and it changed this value back to my regular DNS IPs, and resolution worked again. Go figure.

I avoid the issue of Tailscale overriding the resolv.conf file by setting the following parameter:

tailscale set --accept-dns=false

Why is resolv.conf being overwritten? · Tailscale Docs

Learn why tailscaled overwrites /etc/resolv.conf

tailscale.com

 

[jksmurf]

I avoid the issue of Tailscale overriding the resolv.conf file by setting the following parameter:

tailscale set --accept-dns=false

Why is resolv.conf being overwritten? · Tailscale Docs

Learn why tailscaled overwrites /etc/resolv.conf

tailscale.com

Hmm... maybe this is why I keep getting an error and can't access the remote client.

Soooo.... where do you put that argument please? I keep getting an endless loop if I add it to args under custom?

Current Operating Mode: Custom

  Current values in Tailscale Service (/opt/etc/init.d/S06tailscaled):
  (1) ARGS="--state=/opt/var/tailscaled.state --statedir=/opt/var/lib/tailscale --accept-dns=false"
  (2) PREARGS="nohup"
  (3) PRECMD="modprobe tun"

  Current custom values being used for Tailscale Connection commandline:
  (4) CMD="--advertise-routes=192.168.9.0/24,192.168.53.15/32"

 ---------------------------------------------------------------------------------------

Please enter item to modify (1-4)? (e=Exit):


  TAILMON - v1.3.0                              Operations Menu                   Wed Oct  8 10:50:22 CST 2025
  (R)e-(S)tart / S(T)op Tailscale Service                (C)onfiguration Menu / Main Setup Menu | RL
  Tailscale Connection (U)p / (D)own                     (L)og Viewer / Trim Log Size (rows): 2000
  Custom (O)peration Mode Settings                       (K)eep Tailscale Service Alive: Yes
  (A)MTM Email Notifications: Failure                    Ti(M)er Check Loop Interval: 60sec
 --------------------------------------------------------------------------------------------------------------

Tailscale Service v1.88.3
 Checking tailscaled...              dead.

Tailscale Connection Status:
failed to connect to local tailscaled; it doesn't appear to be running

Tailscale Service Options (Custom Mode)
PRECMD: modprobe tun
ARGS: --state=/opt/var/tailscaled.state --statedir=/opt/var/lib/tailscale --accept-dns=false
PREARGS: nohup

Tailscale Connection Commandline
--advertise-routes=192.168.9.0/24,192.168.53.15/32

Messages:

Executing: tailscale down

error fetching current status: Failed to connect to local Tailscale daemon for /localapi/v0/status; not running? Error: dial unix /var/run/tailscale/tailscaled.sock: connect: no such file or directory
Messages:

 Checking tailscaled...              dead.

Messages:

 Starting tailscaled...              done.

Messages:

Executing: tailscale up --advertise-routes=192.168.9.0/24,192.168.53.15/32

failed to connect to local tailscaled; it doesn't appear to be running
ERROR: Tailscale Connection did not start correctly

  Continuing in 3/5... [s=Setup] [e=Exit] [Selection?  ]

.... and then, when I took away that argument and selected userspace, the new DNS remained and got this?

# Health check:
#     - Tailscale failed to fetch the DNS configuration of your device: getting OS base config is not supported
#     - getting OS base config is not supported

Tailscale Service Options (Userspace Mode)
ARGS: --tun=userspace-networking --state=/opt/var/tailscaled.state --statedir=/opt/var/lib/tailscale
PREARGS: nohup

Tailscale Connection Commandline
--advertise-routes=192.168.9.0/24

  11s / 18% [e=Exit] [Selection?  ]

and on my remote system I got this:

# Health check:
#     - flushing filter/ts-input: running [/usr/sbin/iptables -t filter -F ts-input]: exit status 1: iptables: Invalid argument. Run `dmesg' for more information.

Tailscale Service Options (Kernel Mode)                                                                                                                                  
PRECMD: modprobe tun
ARGS: --state=/opt/var/tailscaled.state --statedir=/opt/var/lib/tailscale
PREARGS: nohup

Tailscale Connection Commandline                                                                                                                                          
--advertise-routes=192.168.47.0/24

  46s / 76% [e=Exit] [Selection?  ]

 

[ColinTaylor]

Hmm... maybe this is why I keep getting an error and can't access the remote client.

Soooo.... where do you put that argument please? I keep getting an endless loop if I add it to args under custom?

I don't use TAILMON but it looks like you would add it to your custom command line (4):

CMD="--advertise-routes=192.168.9.0/24,192.168.53.15/32 --accept-dns=false"