Tailscale自建Derp中转服务器

Tailscale 与 DERP 简介

Tailscale 是什么?

Tailscale 是一个基于 Wireguard 的带有多种网络工具的 P2P 组网工具。得益于其 P2P 的特性,Tailscale 还可以进行内网穿透,打破 NAT 的限制直达另一台主机。

https://tailscale.com

DERP 是什么?

DERP 是一个 Tailscale 自行开发的中继服务。当所处网络环境难以穿透(如校园网、移动大内网、4G、5G 等)时,所有流量都会经由 DERP 中转至目标地址。

在默认情况下,Tailscale 官方已经提供了环大陆的官方 DERP 服务,但是由于中国大陆的网络连通性等问题,官方并未提供大陆的 DERP 节点。为了确保大陆的打通成功率,我们需要自建一个 DERP 服务,来帮助我们 “打洞”。

安装Docker

自建Dreper服务需要Docker,如果没有,输入下方命令安装

1
2
curl -fsSL https://get.docker.com -o get-docker.sh &&
sh get-docker.sh

安装Dreper服务

将下方命令中的域名补全,在服务器中执行

1
2
3
4
5
docker run --restart always \
--name derper -p 12345:12345 -p 3478:3478/udp \
-e DERP_ADDR=:12345 \
-e DERP_DOMAIN= dreper.abc.com \
-d yangchuansheng/derper:latest

完成后讲域名解析到本机IP并反代本机的12345端口,完成后访问域名显示如下内容则DERP服务安装成功

DERP

This is a Tailscale DERP server.

配置TailScale

登录TailScale点击如下页面

2.webp

修改

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
// Example/default ACLs for unrestricted connections.
{
// Declare static groups of users. Use autogroups for all users or users with a specific role.
// "groups": {
// "group:example": ["alice@example.com", "bob@example.com"],
// },

// Define the tags which can be applied to devices and by which users.
// "tagOwners": {
// "tag:example": ["autogroup:admin"],
// },

// Define grants that govern access for users, groups, autogroups, tags,
// Tailscale IP addresses, and subnet ranges.
"grants": [
// Allow all connections.
// Comment this section out if you want to define specific restrictions.
{"src": ["*"], "dst": ["*"], "ip": ["*"]},

// Allow users in "group:example" to access "tag:example", but only from
// devices that are running macOS and have enabled Tailscale client auto-updating.
// {"src": ["group:example"], "dst": ["tag:example"], "ip": ["*"], "srcPosture":["posture:autoUpdateMac"]},
],

// Define postures that will be applied to all rules without any specific
// srcPosture definition.
// "defaultSrcPosture": [
// "posture:anyMac",
// ],

// Define device posture rules requiring devices to meet
// certain criteria to access parts of your system.
// "postures": {
// // Require devices running macOS, a stable Tailscale
// // version and auto update enabled for Tailscale.
// "posture:autoUpdateMac": [
// "node:os == 'macos'",
// "node:tsReleaseTrack == 'stable'",
// "node:tsAutoUpdate",
// ],
// // Require devices running macOS and a stable
// // Tailscale version.
// "posture:anyMac": [
// "node:os == 'macos'",
// "node:tsReleaseTrack == 'stable'",
// ],
// },
// Define users and devices that can use Tailscale SSH.
"ssh": [
// Allow all users to SSH into their own devices in check mode.
// Comment this section out if you want to define specific restrictions.
{
"action": "check",
"src": ["autogroup:member"],
"dst": ["autogroup:self"],
"users": ["autogroup:nonroot", "root"],
},
],

// Test access rules every time they're saved.
// "tests": [
// {
// "src": "alice@example.com",
// "accept": ["tag:example"],
// "deny": ["100.101.102.103:443"],
// },
// ],
"derpMap": {
"OmitDefaultRegions": true,// OmitDefaultRegions 用来忽略官方的中继节点
"Regions": {
"901": {
"RegionID": 901, // 900以上
"RegionCode": "Aliyun-JP", // 区域代码,会在 `tailscale netcheck` 显示
"RegionName": "日本东京阿里云", // 区域名称,会在 `tailscale netcheck` 显示
"Nodes": [
{
"Name": "aliyun-jp-1", // 随意填写
"RegionID": 901, // 对应上方ID
"HostName": "dreper.abc.com", // 填写你的DERP服务域名
"DERPPort": 443, // 你的DERP服务端口
},
],
},
// 更多DERP节点
},
},
}

检查是否生效

输入命令tailscale netcheck,若为docker,输入在/app目录下输入./tailscale netcheck 出现自己设置的服务器则说明成功

1
2
3
4
5
6
7
8
9
10
11
12
13
 tailscale netcheck

Report:
* Time: 2025-08-02T01:57:26.02427011Z
* UDP: true
* IPv4: yes, xxx.xxx.xxx.xxx:28463
* IPv6: no, but OS has support
* MappingVariesByDestIP:
* PortMapping:
* CaptivePortal: false
* Nearest DERP: 日本东京阿里云
* DERP latency:
- Aliyun-JP: 461.6ms (日本东京阿里云)

使用 ping 测试连通性

找到一个在用 tailscale 的客户端
进入终端
输入 tailscale ping 你的另一个主机地址
检验是否联通 (例如出现 via DER (xxx)) 即为成功

参考

https://blog.ixacg.com/posts/2025/04/19/8a865267db07.html

https://cqjn.cc/archives/1719844788120


Tailscale自建Derp中转服务器
https://blog.quickso.cn/2025/08/02/Tailscale自建Derp中转服务器/
作者
木子欢儿
发布于
2025年8月2日
许可协议