Connection always via DERP (never direct) on two different ISPs/routers — CGNAT? Affects 4K Jellyfin streaming
Hi everyone,
I've spent days trying to figure out why my devices never establish a direct connection to each other — only relay via DERP(dfw) — and the most noticeable impact is that watching 4K movies from my self-hosted Jellyfin over Tailscale constantly buffers/stutters (the relay's throughput can't keep up).
Context:
- Ubuntu Server homelab, several devices on the tailnet (Android TV, iPhone, iPad, Windows PC).
- I tested with TWO different network setups: first behind a cheap consumer router, then connected directly to the ISP's modem (Telmex/Mexico). In BOTH cases, the result is identical.
tailscale netcheck in both cases:
- UDP: true
- MappingVariesByDestIP: true (consistent across both routers)
- PortMapping: UPnP (working, confirmed UPnP is active and responding)
- Nearest DERP: Dallas, ~46-62ms
tailscale ping to two different peers (Android TV and iPhone), 10/10 attempts each:
- 100% via DERP(dfw)
- Latencies of 73-171ms
- "direct connection not established" in both cases
Already ruled out: active exit node (none selected), DNS (MagicDNS working fine, no overrides), bandwidth (86Mbps down / 64Mbps up, nothing saturated), AP isolation on the router (disabled), and a saturated UPnP table on the previous router (no longer applies after switching routers).
My current hypothesis is ISP-side CGNAT, since MappingVariesByDestIP stays true regardless of the router, which per your docs is the typical signature of symmetric NAT imposed upstream of my local network.
Questions:
- Has anyone with Telmex/similar ISPs in Mexico confirmed CGNAT and found a solution other than a Peer Relay?
- Is it worth setting up a Peer Relay on my VPS (I have one with a public IP) for this, or is there another way to force/improve NAT negotiation?
- For 4K streaming specifically over DERP, is there any way to prioritize throughput over latency, or is a Peer Relay literally the only way to improve this?
Thanks in advance.