tailscale slow speed

techpro2004

So I have 2 networks a few miles apart. network a has a 1gb fios wan network b has a 2gb fios wan. I have tailscale setup to bridge the networks. On each network I have a identical dell t560 running apache2 on xubuntu. I am running a tool called librespeed in apache2. When I run a speedtest from a to b i get 462 down 234 up. when I run from b to a, I get 639 down 406 up. speedtest.net shows 881.56/689.32 on network a and 2325.77/1242.77 on b. why am I not getting full bandwidth on tailscale. I have nat-pmp enabled on both routers. I am running pfsense 26.03.1 on both routers. thanks, network a router is a dell i3020 network b is a dell tower desktop. both have x550-t2 nics.

luckman212

Tailscale is not designed to be a full wire-speed point-to-point (P-t-P) tunnel like traditional IPSEC. It is primarily a highly convenient and flexible mesh network, allowing one to access systems that might otherwise be inaccessible due to firewalls outside your control.

For a high speed P-t-P tunnel, try IPSEC with AES128-GCM. The VPN Scaling page in Netgate's docs might be helpful as it suggests some optimal cipher settings when aiming for high performance.

techpro2004

tried ipsec also slow. I find I get the best performance with openvpn with dco. but still only getting 620/670 thanks

luckman212

You need to see what the real bandwidth is between these 2 networks so you have a realistic goal. Speedtest results are not reliable. Open port 5201 and run iperf3 -s on pfSense A, and then run iperf3 -P4 -w 256k -c 90.80.70.60 from pfSense B (change the IP to the wan IP of firewall A)

Use pkg install iperf3 if you don't have it installed

giuliafw70

One extra thing to check is whether Tailscale is actually direct between the two sites and not falling back to DERP/relay. tailscale status or tailscale netcheck should make that obvious. If it is direct, I’d do luckman212’s iperf test both on plain WAN and through each tunnel, while watching CPU/interrupt usage on the pfSense boxes. If OpenVPN DCO, IPsec and Tailscale all stop in the same rough range, the bottleneck is probably the firewall path or NIC/driver/offload tuning rather than the VPN choice alone.