Context

When Tailscale is active on a client machine, its virtual network interface (e.g., utun7 on macOS) uses an MTU of 1280 bytes. Coder's direct connection probing sends padded DISCO ping packets (~1334 bytes) to verify that a path can carry full-size WireGuard data packets. Because these probe packets exceed the Tailscale interface MTU, the direct connection attempt fails and Coder falls back to a DERP relay instead.

Running coder ping <workspace> in this scenario will show a warning similar to:

Network interface utun7 has MTU 1280 (less than 1378), which may degrade the quality of direct connections or render them unusable.

and all pongs will be proxied via DERP.

Answer

This behavior is intentional and was introduced in Coder v2.24.0 (coder/coder#18323). Previously, Coder would establish a "direct" connection over a low-MTU path, but real WireGuard data packets (inner IPv6 stack hardcoded to 1280 + ~30 bytes WireGuard overhead ≈ 1310 bytes) would be fragmented or silently dropped, causing SSH and VS Code sessions to hang. The fix deliberately fails the probe over any path with an MTU below the safe threshold (1378 bytes) and falls back to DERP, which is reliable and not subject to MTU constraints.

Running Coder's network inside another Tailscale tailnet is not a supported configuration. If you must do so, Coder will fall back to DERP for all connections.

The following options are available depending on your requirements:

1. Accept DERP relay (recommended if P2P is not required). DERP connections are fully functional, just relayed via the Coder control plane. To avoid the overhead of futile direct-connection probing, you can set the environment variable CODER_BLOCK_DIRECT=true on the Coder server to skip direct connection attempts entirely for all users in all workspaces.

2. Route Coder traffic outside the Tailscale tunnel (recommended if P2P is required). If your workspace or agent endpoints are being reached via a Tailscale-advertised subnet route, every direct connection candidate will land on the 1280-MTU interface. Ensure that Coder agent/workspace addresses are reachable via a native-MTU path that does not traverse the Tailscale tunnel. This is the only supported path to achieving true P2P connections.

For more details, see the Low MTU troubleshooting documentation.