dl.tailscale.com reachability issues in China Mainland

[curtisrecords]

What is the issue?

All servers are installed through tailscale.com/install.sh. Due to the existence of regional firewalls in our country, and each province (which can be understood as each state in the United States) has different whitelist/blacklist firewall policies. The implementation of this firewall generally involves blocking domain names/IP addresses or injecting RST into replies/links, which is quite complex.

Recently, I have observed that dl.tailscale.com has been blocked by some provincial firewalls, but the dl.tailscale.com domain name has not been contaminated, resulting in some servers being unable to update Tailscale properly via apt. Below is a screenshot, with a red lightning symbol indicating that this province cannot access dl.tailscale.com.

So my question is whether Tailscale officials will allow us to set up reverse proxy servers based on dl.tailscale.com/pkgs.tailscale.com as source sites in other regions to ensure normal updates of Tailscale versions on servers?

Steps to reproduce

sudo apt update && sudo apt upgrade -y

Are there any recent changes that introduced the issue?

none

OS

Linux

OS version

Ubuntu 22.04

Tailscale version

No response

Other software

No response

Bug report

No response

[curtisrecords]

Or whether it is possible to perform DNS resolution by region, placing the DNS resolver addresses for the Asian region in Singapore/Japan?

[DentonGentry]

We can add regions in the CDN, but we already have nodes in Singapore, Hong Kong, and Sydney. It looks like we don't have a node in Japan, we could add one.

[curtisrecords]

We can add regions in the CDN, but we already have nodes in Singapore, Hong Kong, and Sydney. It looks like we don't have a node in Japan, we could add one.

I just checked the IP address of the domain name resolution, and it seems to be the anycast IP address of flyio.
Our firewall has not yet blocked the domain name dl.tailscale.com. What is being blocked is the anycast IP address.
If we add PoPs after the IP address, such as in Japan or India, our firewall will essentially still block that one anycast IP address. It should not work.
So technically speaking, DNS partitioned resolution should be better.

[curtisrecords]

Hong Kong and Taiwan are not within the scope of the aforementioned impact. The impact is limited to mainland China only.

[curtisrecords]

December 24, 2023 update

I've developed a Worker, primarily designed to serve as a reverse proxy for the tailscale pkgs domain.
It also appropriately follows 302 redirects to fetch resources, effectively resolving the issue through a chain of reverse proxies, and it's incredibly stable.
Therefore, I'm closing this issue. If anyone requires the Worker's code, I'm more than happy to open-source it.

I greatly appreciate the work of the Tailscale team and their free plan💙