In my opinion, this is Tailscale's largest issue.

It is slow. It cannot achieve speeds of greater than 1Gbps on clients systems (Windows & Mac), where you'd normally see it being used. On Linux, it struggles to achieve 10Gbps even when using a synthetic large packet benchmark [1]. With an IMIX benchmark, it would not be competitive whatsoever.

This problem is fixable. WireGuard achieves higher performance (Kernel vs Userspace implementation) and IPsec implementations can achieve 100Gbps/400Gbps (DPDK/XDP). Zero-copy networking.

From this blog post, I can say Tailscale still seems to not have the appetite for that, which is a shame.

[1] https://tailscale.com/blog/more-throughput

▲

boomer_joe an hour ago | parent [-]

Yes. Just fucking stop doing userspace wireguard on linux https://github.com/tailscale/tailscale/issues/426 - issue has been open for 6 years (and is locked now, lol), btw.

And if any tailscale employees are reading this - https://github.com/tailscale/tailscale/issues/15724 please fix this too. Regular users not using some sort of enterprise saas DNS (whatever their thing is?) deserve DNS privacy too.

	▲	apenwarr a few seconds ago \| parent \| next [-]
		(Tailscale cofounder) That’s a good callout on DoH support, thanks. That said, note that if you run your own DNS server on your tailnet, the regular UDP DNS is automatically private because it’s carried over Tailscale. That’s the most common setup for non-SaaS DNS servers.
	▲	iscoelho 35 minutes ago \| parent \| prev [-]
		Tailscale's netstack is barely even WireGuard and they aren't compatible whatsoever. It's all marketing at this point. So it's not that simple: it's impossible for Tailscale to use any existing kernel or accelerated WireGuard implementation. They could derive inspiration, but a kernel module for Linux won't fix Windows & Mac. With that said, I feel they have enough funding to maintain a few platforms (: