Udp very slow? any solution? (using tailscale on other device)

Installing and Using OpenWrt
1

i have a really weird problem with openwrt UDP traffic for some reason.
using tailscale that primarily uses UDP connections for direct connections, i get a openspeedtest to my tailscale exit node of 0.6 mbit (openspeedtest tests speeds between devices, not speed towards the internet):face_with_thermometer:
When i set a firewall rule to drop all UDP traffic for the tailscale exit node device IP, effectively making it impossible for tailscale to create direct connections and it uses relay servers, i get results between 16 and 25mbit.
Anyone have a clue to what i can try to solve this?

I tried the above on two devices. one with windows one with home assistant OS. same problem, so seems something router related. Probably can't be my ISP, as i use a wireguard connection to Mullvad- a vpn provider. and yes i already tried disabling the vpn connection completely and did not make a difference. But i'm not super knowledged on all of the networking stuff.

Of course i do not have any firewall rules that block udp traffic in any way.

Help would be appriciated!

2

Please connect to your OpenWrt device using ssh and copy the output of the following commands and post it here using the "Preformatted text </> " button:
grafik
Remember to redact passwords, MAC addresses and any public IP addresses you may have:

ubus call system board
cat /etc/config/network
cat /etc/config/dhcp
cat /etc/config/firewall
3

ubus call system board

{
        "kernel": "5.15.162",
        "hostname": "MainRouter",
        "system": "ARMv8 Processor rev 4",
        "model": "Dynalink DL-WRX36",
        "board_name": "dynalink,dl-wrx36",
        "rootfs_type": "squashfs",
        "release": {
                "distribution": "OpenWrt",
                "version": "23.05.4",
                "revision": "r24012-d8dd03c46f",
                "target": "ipq807x/generic",
                "description": "OpenWrt 23.05.4 r24012-d8dd03c46f"
        }
}

cat /etc/config/network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'xxx::/48'
        option packet_steering '1'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'lan1'
        list ports 'lan2'
        list ports 'lan3'
        list ports 'lan4'
        option ipv6 '0'
        option igmp_snooping '1'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr '192.168.1.1'
        option netmask '255.255.255.0'
        option ip6assign '60'
        option delegate '0'

config interface 'wan'
        option device 'wan'
        option proto 'dhcp'
        option metric '1'
        option dns_metric '10'
        option delegate '0'
        option type 'bridge'

config interface 'wan6'
        option device 'wan'
        option proto 'dhcpv6'
        option reqaddress 'try'
        option reqprefix 'auto'

config interface 'vpnwireguard'
        option proto 'wireguard'
        option private_key 'xxx'
        option metric '0'
        option delegate '0'
        option mtu '1280'
        list addresses 'xxx/32'
        list addresses 'fc00:bbbb:bbbb:xxx/128'
        list dns 'xxx'

config interface 'ovpn'
        option proto 'none'
        option device 'tun0'
        option delegate '0'
        option auto '0'

config device 'guest_dev'
        option name 'br-guest'

config interface 'xxx'
        option proto 'static'
        option ipaddr '192.168.2.1'
        option netmask '255.255.255.0'
        list dns '8.8.8.8'

config wireguard_xxx
        option description 'xxx.conf'
        option public_key 'xxx'
        list allowed_ips '0.0.0.0/0'
        list allowed_ips '::0/0'
        option endpoint_host 'xxx'
        option endpoint_port '51820'
        option route_allowed_ips '1'
        option persistent_keepalive '25'

cat /etc/config/dhcp

config dnsmasq
        option domainneeded '1'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option cachesize '1000'
        option dnsforwardmax '350'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option localservice '1'
        option ednspacket_max '1232'

config dhcp 'lan'
        option interface 'lan'
        option start '100'
        option limit '150'
        option leasetime '12h'
        option dhcpv4 'server'
        option dhcpv6 'server'
        option ra 'server'
        list ra_flags 'managed-config'
        list ra_flags 'other-config'
        option ra_slaac '0'
        option dns_service '0'

config dhcp 'wan'
        option interface 'wan'
        option ignore '1'

config odhcpd 'odhcpd'
        option maindhcp '0'
        option leasefile '/tmp/hosts/odhcpd'
        option leasetrigger '/usr/sbin/odhcpd-update'
        option loglevel '4'

config host
        option name 'Samsung'
        option ip '192.168.1.154'
        option mac 'xxx'

config host
        option name 'HarmonyHub'
        option ip '192.168.1.160'
        option mac 'xxx'

config host
        option name 'hubv3-4011035646'
        option ip '192.168.1.179'
        option mac 'xxx'

config host
        option name 'Samsung'
        option ip '192.168.1.151'
        option mac 'xxx'

config host
        option name 'everything-presence-st-fa2d68'
        option ip '192.168.1.229'
        option mac 'xxx'

config host
        option name 'everything-presence-st-700718'
        option ip '192.168.1.208'
        option mac 'xxx'

config host
        option name 'everything-presence-st-7e8058'
        option ip '192.168.1.171'
        option mac 'xxx'

config host
        option name 'Meshpoint2'
        option ip '192.168.1.106'
        option mac 'xxx'

config host
        option name 'Meshpoint3'
        option ip '192.168.1.219'
        option mac 'xxx'

config host
        option ip '192.168.1.243'
        option mac 'xxx'

config host
        option name 'Saurons-Eye'
        option ip '192.168.1.184'
        option mac 'xxx'

config host
        option name 'WYZE_CAKP2JFUS-D03F2718B832'
        option ip '192.168.1.216'
        option mac 'xxx'

config host
        option name 'WYZE_CAKP2JFUS-D03F27015093'
        option ip '192.168.1.152'
        option mac 'xxx'

config host
        option name 'WYZE_CAKP2JFUS-7C78B2846F6E'
        option ip '192.168.1.205'
        option mac 'xxx'

config host
        option name 'WYZE_CAKP2JFUS-7C78B28345FB'
        option ip '192.168.1.133'
        option mac 'xxx'

config host
        option name 'HL_CAM3P-D03F27A2F149'
        option ip '192.168.1.226'
        option mac 'xxx'

config host
        option name 'HL_CAM3P-D03F27992CD7'
        option ip '192.168.1.120'
        option mac 'xxx'

config host
        option name 'HL_PAN3-D03F27B97DA4'
        option ip '192.168.1.198'
        option mac 'xxx'

config host
        option ip '192.168.1.114'
        option mac 'xxx'

config host
        option ip '192.168.1.209'
        option mac 'xxx'

config host
        option ip '192.168.1.242'
        option mac 'xxx'

config host
        option ip '192.168.1.218'
        option mac 'xxx'

config host
        option ip '192.168.1.109'
        option mac 'xxx'

config host
        option name 'yi-hack'
        option ip '192.168.1.181'
        option mac 'xxx'

config host
        option ip '192.168.1.116'
        option mac 'xxx'

config dhcp 'xxx'
        option interface 'xxx'
        option start '100'
        option limit '150'
        option leasetime '12h'

config host
        option name 'NOMI-IPC-GK2C-5C0WR'
        option ip '192.168.1.170'
        option mac 'xxx'

config host
        option ip '192.168.1.234'
        option mac 'xxx'

config host
        option name 'C225'
        option ip '192.168.1.166'
        option mac 'xxx'

config host
        option ip '192.168.1.185'
        option mac 'xxx'

config host
        option name 'C225'
        option ip '192.168.1.102'
        option mac 'xxx'

config host
        option ip '192.168.1.172'
        option mac 'xxx'

config host
        option name 'BroadLink-Remote-25-f9-d7'
        option ip '192.168.1.180'
        option mac 'xxx'

config host
        option name 'X6'
        option ip '192.168.1.186'
        option mac 'xxx'

config host
        option name 'OpenWrt'
        option ip '192.168.1.183'
        option mac 'xxx'

config host
        option name 'HarmonyHub'
        option ip '192.168.1.134'
        option mac 'xxx'

config host
        option name 'C120'
        option ip '192.168.1.187'
        option mac 'xxx'

config host
        option ip '192.168.1.182'
        option mac 'xxx'

config host
        option ip '192.168.1.145'
        option mac 'xxx'

config host
        option name 'C125'
        option ip '192.168.1.210'
        option mac 'xxx'

config host
        option ip '192.168.1.158'
        option mac 'xxx'

config host
        option ip '192.168.1.156'
        option mac 'xxx'

config host
        option ip '192.168.1.199'
        option mac 'xxx'

config host
        option ip '192.168.1.248'
        option mac 'xxx'

config host
        option name 'Presence-Sensor-FP2-E374'
        option ip '192.168.1.189'
        option mac 'xxx'

config host
        option name 'Presence-Sensor-FP2-DC2E'
        option ip '192.168.1.221'
        option mac 'xxx'

config host
        option name 'espressif'
        option ip '192.168.1.190'
        option mac 'xxx'

config host
        option ip '192.168.1.127'
        option mac 'xxx'

config host
        option name 'Camera1'
        option ip '192.168.1.249'
        option mac 'xxx'

config host
        option ip '192.168.1.129'
        option mac 'xxx'

config host
        option name 'yukabridge'
        option ip '192.168.1.168'
        option mac 'xxx'

config host
        option name 'roborock-vacuum-a97'
        option ip '192.168.1.110'
        option mac 'xxx'

config host
        option name 'Tab-16'
        option ip '192.168.1.214'
        option mac 'xxx'

config host
        option ip '192.168.1.107'
        option mac 'xxx'

config host
        option ip '192.168.1.233'
        option mac 'xxx'

config host
        option ip '192.168.1.204'
        option mac 'xxx'
4

cat /etc/config/firewall

config defaults
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'
        option flow_offloading '1'

config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'lan'

config zone
        option name 'wan'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option mtu_fix '1'
        option masq '1'
        list network 'wan'
        list network 'wan6'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'
        option enabled '0'

config zone
        option name 'surfshark'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        list network 'surfshark'

config rule
        option name 'exceptions'
        option src 'lan'
        list src_ip '192.168.1.179'
        list src_ip '192.168.1.151'
        option dest 'wan'
        option target 'ACCEPT'
        option enabled '0'

config rule
        option name 'Block Cams from Interwebz'
        option src 'lan'
        option dest 'wireguardvpn'
        option target 'REJECT'
        list src_ip '192.168.1.133'
        list src_ip '192.168.1.152'
        list src_ip '192.168.1.205'
        list src_ip '192.168.1.216'
        list src_ip '192.168.1.209'
        list src_ip '192.168.1.114'
        list src_ip '192.168.1.242'
        list src_ip '192.168.1.121'
        list src_ip '192.168.1.109'
        list src_ip '192.168.1.218'
        list src_ip '192.168.1.116'
        list src_ip '192.168.1.181'
        list src_ip '192.168.1.170'
        list src_ip '192.168.1.234'
        list src_ip '192.168.1.166'
        list src_ip '192.168.1.185'
        list src_ip '192.168.1.102'
        list src_ip '192.168.1.172'
        list src_ip '192.168.1.187'
        list src_ip '192.168.1.210'
        list src_ip '192.168.1.145'
        list src_ip '192.168.1.182'
        list src_ip '192.168.1.158'
        list src_ip '192.168.1.199'
        list src_ip '192.168.1.248'
        list src_ip '192.168.1.129'
        list proto 'all'

config zone
        option name 'ovpntest'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        option family 'ipv4'
        list network 'surfsharkovpn'

config include 'pbr'
        option fw4_compatible '1'
        option type 'script'
        option path '/usr/share/pbr/pbr.firewall.include'

config redirect
        option dest 'lan'
        option target 'DNAT'
        option name 'ntp'
        list proto 'udp'
        option src 'lan'
        option src_dport '123'
        option dest_port '123'
        list src_mac 'xxx'
        list src_mac 'xxx'
        list src_mac 'xxx'
        list src_mac 'xxx'
        list src_mac 'xxx'

config zone
        option name 'Guestwlan'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        list network 'xxx'

config rule
        option name 'guestDHCP'
        list proto 'udp'
        option src 'Guestwlan'
        option dest_port '67'
        option target 'ACCEPT'

config rule
        option name 'GuestDNS'
        option src 'Guestwlan'
        option dest_port '53'
        option target 'ACCEPT'

config forwarding
        option src 'Guestwlan'
        option dest 'wireguardvpn'

config rule

config rule
        option name 'Block Android Panels from internet'
        option src 'lan'
        list src_ip '192.168.1.107'
        option dest 'wireguardvpn'
        option target 'REJECT'
        option enabled '0'

config rule
        option name 'temp'
        list proto 'udp'
        option src 'lan'
        option dest 'wireguardvpn'
        option target 'DROP'
        list src_ip '192.168.1.184'
        option enabled '0'

config forwarding
        option src 'lan'
        option dest 'wireguardvpn'

Thanks for wanting to assist, here is all the data, removed mac addresses, external addresses and name of the wireguard interface with something generic, because it was named surfshark but im not using that anymore.

5

Delete empty "config rule"
Try with flow offloading disabled?
Select "drop invalid packets", helps if your provider combats torrents and vpns.

6

this unfortunately did not help, tried all your three suggestions...

7

What do you get from iperf3 across tunnel using server close to exit node: https://iperf3serverlist.net/

8

Screenshot_20241009_203941_PingTools
Screenshot_20241009_203941_PingTools1080×2400 122 KB

no idea how to interpret the above. i connected to a close server with iperf on android while the phone is connected to the tailscale exit node using cellular, so traffic cannot flow outside of the exit node.

9

OK, that is too slow for your router which should on itself go above 500Mbps with wireguard.
Can you run some speed test directly (downloading 1GB file) from exit node or nearby speedtest.net server without VPN.

10

Yeah. The thing is that the router can do this without problem. Wireguard on the router works great and super fast. Disabling wireguard on the router does not help, if i use the exit node on either machines (windows and home assistant OS) connected to the router.

Is that what you wanted to know?

11

Could be wrong MTU settings somewhere? Kind of defaults accommodate encryption additions.

12

where do i set that and what value?
Note that only tailscale with UDP direct connections is affected. If i use zerotier, which also creates a wireguard connection between devices, the connection is fast. If i drop UDP traffic for the exit node device in openwrt firewall settings, its also pretty fast, using relay servers with TCP.

13

Some providers fight torrents by slowing udp streams, you can try some extra encapsulations, but they add some bytes per packet and reduce theoretical bw even more.

14

Maybe run tracepath through the tunnel? (opkg update ; opkg install tracepath or iputils-tracepath not sure)
Also have a look here which shows different ways of deducing the path MTU:

15

Is this also affecting me when i permanently use a wireguard vpn provider?

@moeller0
Can you guide me a little bit more? Is that a package for openwrt? How should i run it to report back?

16

tracepath or iputils-tracepath is indeed an openwrt package that you could run on your router... but you need to make sure you are steering it through the tunnel otherwise it will only tell you about your internet access link's path MTU...

17

Yes, however I bet wireguard will automatically adjust the MTU though its tunnel...

Maybe not, otherwise why would projects like:

appear?

18

Ugh...how do i use that then?
Or is there a way to do this test on a android phone that can easily connect to the exit node?

19

I have to admit I never used wireguard nor any of these scripts...

(For the little remote access needs I have OpenVpn works just fine and was much easier to configure, so i punted on getting wireguard working as well.)

20

MTU is for a tunnel interface i see. but with wireguard disabled, the issue remains. so it cant be a MTU issue then....?