A government blocks a VPN with a one-line SNI rule. The fix is a custom relay on port 443. Tailscale could make this trivial for millions — but they haven't.
There's a lot of confusion about how Myanmar actually blocks Tailscale. Some say it's DNS poisoning. Others claim the coordination server is blackholed. A few insist the WireGuard protocol itself is detected and dropped.
None of that is correct. The block is simpler and stupider than most people think — and because of that, the counter is simpler too. This matters because Tailscale is genuinely important networking middleware. It's used by journalists, remote workers, distributed teams, and anyone who needs secure machine-to-machine connectivity. Blocking it isn't just censorship theater — it disrupts legitimate infrastructure.
This time, I worked on the problem with the support of a capable agentic AI. I trained its substantial capacity for research and systematic debugging on the task, and together we burned through the misconceptions, tested the actual failure points, and built a working counter. What follows is what we found.
What Myanmar Actually Blocks
Myanmar operates deep packet inspection (DPI) at the ISP level. But they're not doing anything sophisticated. They're running what amounts to a single SNI filter:
Block TLS ClientHello where SNI matches *.tailscale.com
That's it. One wildcard rule.
This hits Tailscale in three places:
| Component | Blocked? | Why |
|---|---|---|
Coordination server (controlplane.tailscale.com) | No | Different SNI, survived past block waves |
Default DERP relays (derpN.tailscale.com) | Yes | All match the wildcard |
| Direct WireGuard (UDP 41641) | Sometimes | Symmetric NAT without relay = dead |
When all DERP relays are unreachable, nodes behind carrier-grade NAT in Myanmar have no path to each other. The mesh collapses. Every node is an island.
The cruel part: the coordination server still works. The client can see its peers. It knows they exist. It just can't reach them. It's like being locked in a glass box — you can see everyone, but you can't touch them.
The agent and I verified this step by step: DNS resolution from inside Myanmar, successful — the IPs resolve fine. TCP handshake to the coordination server, successful — it's not IP-blocked. TLS ClientHello to derpN.tailscale.com, dropped at the SNI. TLS ClientHello to a custom domain on the same VPS, passed cleanly. The filter is exactly one rule deep.
What Doesn't Work
Peer Relays (NAT-PMP/PCP). Tailscale's own documentation suggests custom DERP isn't needed if you set up a peer relay. But peer relays use raw UDP on arbitrary ports. DPI boxes flag non-standard UDP instantly. Port 40000 looks nothing like web traffic.
Waiting for it to get better. Myanmar's filtering isn't going away. It's getting more aggressive, not less.
Commercial VPNs. Most are blocked at the same DPI layer. The ones that work today won't work tomorrow.
What Works: Your Own DERP on Port 443
The insight is simple: TLS on port 443 looks like HTTPS to a DPI box. Every website uses it. Blocking it would break the internet.
A custom DERP relay listening on TCP 443, with a valid Let's Encrypt certificate on a domain you control, is indistinguishable from a web server. The SNI matches your domain, not *.tailscale.com. The traffic is standard TLS. The DPI box shrugs and passes it through.
You can deploy this in 30 minutes:
- Run
cmd/derperon a VPS outside the censored country - Give it a Let's Encrypt certificate for a subdomain you control
- Tell Tailscale to use it
But here's where Tailscale's product decision bites you.
The Problem Tailscale Won't Let You Solve
You can add custom DERPs to your tailnet. But you cannot remove the default ones.
This isn't a technical limitation. Tailscale's admin console simply doesn't expose DERP controls. The ACL syntax has some undocumented, CLI-only support for DERP filtering — but it's fragile, barely documented, and not something a normal user would discover. The product team made a choice: DERP is infrastructure, not configuration. You don't get to touch it.
The consequence: your client will try the blocked default DERPs first. Each attempt times out after 5-10 seconds. Only after cycling through every blocked relay does it fall back to your custom one.
The result: Tailscale does connect eventually. But every connection attempt has a 20-40 second penalty. Every reconnect. Every network change. Every time your phone switches from WiFi to cellular.
It's functional but miserable — like a car that stalls three times before starting.
SOCIAL SHARE CARD GENERATOR