# Performance best practices

Last validated Dec 4, 2025

Tailscale continuously seeks ways to improve performance, such as [making significant changes to `wireguard-go`][bl-throughput-improvements] (the userspace WireGuard implementation that Tailscale uses) and taking advantage of the [transport layer offload engine][xt-tcp-offload-engine] to push Tailscale to [10Gb/s and beyond][bl-more-throughput].

In most cases, Tailscale delivers the best possible performance without additional configuration or customization. But there are some situations in which you can use best practices to achieve the highest performance. The following sections offer best practices for getting the most out of Tailscale in various environments, operating systems, and modes of operation ([exit nodes][kb-exit-nodes], [subnet routers][kb-subnets], and the like).

## Direct connections

Tailscale uses [direct and relayed connections][kb-connection-types], opting for direct connections when possible. Direct connections nearly always result in lower latency and higher throughput.

To increase the likelihood of a direct connection, you can:

* Expose a public IP address for your tailnet devices.
* [Open a firewall port][kb-firewall-ports] when necessary.
* Use the [device connectivity guide][kb-device-connectivity] to troubleshoot why a device might be using a relayed connection.

> **Tip:**
>
> You can also set up one or more [Tailscale Peer Relay servers][kb-peer-relays] in your tailnet. These are devices in your own infrastructure that Tailscale clients can use to connect to each other when a direct connection isn't possible. Peer relay servers are usually faster than DERP relay servers.

## Operating system recommendations

Use a recent version of your preferred operating system because it typically offers the most recent software and hardware optimizations. For example, using [Linux kernel version 6.2 or later][xt-linux-kernel-releases] provides the best performance by enabling Tailscale to use the latest kernel features.

### Linux optimizations for subnet routers and exit nodes

Tailscale version 1.54 or later used with a Linux 6.2 or later kernel enables UDP throughput improvements using [transport layer offloads][xt-kernel-segmentation-offloads]. If a Linux device is acting as an exit node or subnet router, ensure the following network device configuration is in place for the best results:

```shell
NETDEV=$(ip -o route get 8.8.8.8 | cut -f 5 -d " ")
sudo ethtool -K $NETDEV rx-udp-gro-forwarding on rx-gro-list off
```

By default, changes made using the `ethtool` don't persistent after a reboot. On Linux distributions using `networkd-dispatcher` (which you can verify with `systemctl is-enabled networkd-dispatcher`), you can run the following commands to create a script that configures these settings on each boot.

```shell
printf '#!/bin/sh\n\nethtool -K %s rx-udp-gro-forwarding on rx-gro-list off \n' "$(ip -o route get 8.8.8.8 | cut -f 5 -d " ")" | sudo tee /etc/networkd-dispatcher/routable.d/50-tailscale
sudo chmod 755 /etc/networkd-dispatcher/routable.d/50-tailscale
```

Run the following commands to test the script to ensure it runs successfully on your devices:

```shell
sudo /etc/networkd-dispatcher/routable.d/50-tailscale
test $? -eq 0 || echo 'An error occurred.'
```

## Machine sizing recommendations

For best performance, use the most recent generation of CPU architecture available to you. In general, higher CPU clock speed is more important than more cores.

### Provider-specific recommendations

Refer to the following for provider-specific sizing recommendations:

* [Amazon Elastic Compute Cloud (EC2) instance sizing][kb-aws-recommended-instance-sizing]
* [Google Compute Engine (GCE) sizing][kb-gce-recommended-instance-sizing]
* [Microsoft Azure virtual machine sizing][kb-azure-recommended-vm-sizing]

#### AWS single-flow bandwidth limitation

\[Missing snippet: aws\_single\_flow\_bandwidth\_limitation.mdx]

[bl-more-throughput]: /blog/more-throughput

[bl-throughput-improvements]: /blog/throughput-improvements

[kb-aws-recommended-instance-sizing]: /docs/reference/reference-architectures/aws#recommended-instance-sizing

[kb-azure-recommended-vm-sizing]: /docs/reference/reference-architectures/azure#recommended-vm-sizing

[kb-connection-types]: /docs/reference/connection-types

[kb-device-connectivity]: /docs/reference/device-connectivity

[kb-exit-nodes]: /docs/features/exit-nodes

[kb-firewall-ports]: /docs/reference/faq/firewall-ports

[kb-gce-recommended-instance-sizing]: /docs/reference/reference-architectures/gcp#recommended-instance-sizing

[kb-peer-relays]: /docs/features/peer-relay

[kb-subnets]: /docs/features/subnet-routers

[xt-kernel-segmentation-offloads]: https://www.kernel.org/doc/html/latest/networking/segmentation-offloads.html

[xt-linux-kernel-releases]: https://www.kernel.org/category/releases.html

[xt-tcp-offload-engine]: https://en.wikipedia.org/wiki/TCP_offload_engine