DERP_VERIFY_CLIENTS issue

[ppllpig]

once set DERP_VERIFY_CLIENTS=true,works well in some hours,after that,show a lot of error:

rejected: failed to query local tailscaled status: Failed to connect to local Tailscale daemon for /localapi/v0/status; not running? Error: dial unix /var/run/tailscale/tailscaled.sock: connect: connection refused

tested in three new install machines

[BrokenChip231]

In order to give Derper access to Tailscale running on the host add this to your volumes declaration: /var/run/tailscale:/var/run/tailscale.

[itbencn]

Tailscale of the server where derper is located

root@VM-0-10-ubuntu:~# tailscale netcheck
2026/01/03 23:03:34 portmap: monitor: gateway and self IP changed: gw=10.6.0.1 self=10.6.0.10

Report:
        * Time: 2026-01-03T15:03:39.158493145Z
        * UDP: true
        * IPv4: yes, 172.20.0.1:56340
        * IPv6: yes, [2402:**************************]:54075
        * MappingVariesByDestIP: true
        * PortMapping: 
        * CaptivePortal: false
        * Nearest DERP: chengdu
        * DERP latency:
                - txy: 1.1ms   (chengdu)
                - sfo: 187ms   (San Francisco)
                - lax: 192ms   (Los Angeles)
                - nue: 194.1ms (Nuremberg)
                - .......................

Remote Tailscale device

PS C:\Users\HUAWEI> tailscale netcheck
2026/01/03 23:06:29 portmap: monitor: gateway and self IP changed: gw=192.168.3.1 self=192.168.3.8
2026/01/03 23:06:29 portmap: [v1] UPnP reply {Location:http://192.168.3.1:37215/56c286b8-6289-e85d-9b66-bc68c19f3ea1/upnpdev.xml Server:Linux UPnP/1.0 Huawei-ATP-IGD USN:uuid:56c286b8-6289-e85d-9b66-bc68c19f3ea1::urn:schemas-upnp-org:device:InternetGatewayDevice:1}, "HTTP/1.1 200 OK\r\nLOCATION: http://192.168.3.1:37215/56c286b8-6289-e85d-9b66-bc68c19f3ea1/upnpdev.xml\r\nSERVER: Linux UPnP/1.0 Huawei-ATP-IGD\r\nHILINK_EXT: 0\r\nCACHE-CONTROL: max-age=86500\r\nEXT: \r\nST: urn:schemas-upnp-org:device:InternetGatewayDevice:1\r\nUSN: uuid:56c286b8-6289-e85d-9b66-bc68c19f3ea1::urn:schemas-upnp-org:device:InternetGatewayDevice:1\r\nDATE: Sat, 03 Jan 2026 15:06:25 GMT\r\n\r\n"
2026/01/03 23:06:29 portmap: UPnP meta changed: [{Location:http://192.168.3.1:37215/56c286b8-6289-e85d-9b66-bc68c19f3ea1/upnpdev.xml Server:Linux UPnP/1.0 Huawei-ATP-IGD USN:uuid:56c286b8-6289-e85d-9b66-bc68c19f3ea1::urn:schemas-upnp-org:device:InternetGatewayDevice:1}]

Report:
        * Time: 2026-01-03T15:06:32.7111788Z
        * UDP: true
        * IPv4: yes, *********:7561
        * IPv6: yes, [2409:**************************]:61603
        * MappingVariesByDestIP: true
        * PortMapping: UPnP
        * CaptivePortal: false
        * Nearest DERP: chengdu
        * DERP latency:
                - txy: 23.1ms  (chengdu)
                - sin: 81.4ms  (Singapore)
                - hkg: 92.7ms  (Hong Kong)
                - tok: 99.8ms  (Tokyo)
                - ..............

How to verify if DERP_VERIFY_CLIENTS has been properly enabled?
Also, why do I always see portmap: monitor:..................... output at the beginning when executing tailscale netcheck

[ngc7331]

How to verify if DERP_VERIFY_CLIENTS has been properly enabled

Maybe you can stop the tailscaled service on the server where derp is located, then check derp's logs for any output like “peer xxx not authorized” or “failed to query local tailscaled status”.

Something like:

$ sudo tailscale down
$ docker logs --since 10m -f derper

Also, why do I always see portmap: monitor:..................... output at the beginning when executing tailscale netcheck

This is tailscale's log, which should be unrelated to the custom derp server. When tailscale is working behind a NAT, it uses package portmapper to try establishing direct connect with other machines via NAT-PMP/PCP/UPnP, and that package will gives these logs when initializing. You may want to check the official documentation for more information, like https://tailscale.com/kb/1411/device-connectivity.