Custom DERP not working on macOS

[ssaavedra]

What is the issue?

I initially encountered this with a "complex" set up involving two machines, but this can be replicated with less steps and just one laptop.

I'm currently suffering from an internet outage and I'm trying to use a macOS laptop as an internet gateway to my network. I'm tethering my phone through the laptop, and the laptop is "Sharing internet" through the Ethernet adapter.

I have a separate machine (Proxmox) with a bunch of VMs that have bridge connectivity to the Ethernet port in the laptop. I can ping from both sides and if I spin up a web server, it shows on the other. However, Tailscale is deciding it's not able to connect directly to one another, and going through DERP, making two round trips through the 5G connection when it should be local.

Since debugging that seemed hard(er), I tried running my own DERP server. I tried running the DERP server from the Proxmox host, but my laptop seemed to not connect. So I tried the same with the laptop and just realized that even if I run a DERP from my laptop, I cannot access it from itself (while nodes in the proxmox machine actually can).

If I disable internet sharing and every other connection, the DERP seems to be able to connect to local tailscale.

Steps to reproduce

1. tailscale cert
2. Move certs to /root/.cache/tailscale/derper-certs/.crt/.key
3. go install
4. Add to the tailscale policy a zone with a single server with IPv4 to one of your interfaces' IPv4. I added the one shared in the Ethernet link.
5. sudo go/bin/derper -hostname -certmode manual
6. tailscale debug derp

Result:

{
 "Info": [
  "Region 901 == \"chr\""
 ],
 "Warnings": [
  "Error making request to the captive portal check \"http://<node name>/generate_204?t=1758747085\"; is port 80 blocked?"
 ],
 "Errors": [
  "Error connecting to node \"<node name>\" @ \"192.168.42.1:443\" over IPv4: dial tcp4 192.168.42.1:443: connect: connection refused",
  "Error connecting to node \"<node name>\" @ \"Charm:443\" over IPv6: dial tcp6: lookup Charm: no such host"
 ]
}

Are there any recent changes that introduced the issue?

Not known

OS

macOS

OS version

Sonoma 15.6.1

Tailscale version

1.88.2

Other software

Internet Sharing enabled

Bug report

No response

[ssaavedra]

As a workaround, I was able to use DERP on the laptop by defining a region with two devices: one with the laptop's IPv4 of the Internet sharing for the machines in the Ethernet link (192.168.42.1) plus another host with the same hostname but with its IPv4 of the WIFi connection.

The laptop connects to the wifi IP address (the other fails, according to tailscale debug derp 901) and the other machines connect to the "router IP". The server is not meshed, it's just a single derper instance listening on :443.