A faster DERP relay for Tailscale and Headscale -- plus a UDP relay for stock WireGuard. Same clients, half the hardware.
What is Hyper-DERP?
A high-performance relay server that does two things in one daemon:
- DERP relay -- drop-in replacement for Tailscale's Go derper. Same protocol, same clients, no Tailscale or Headscale config changes beyond pointing the DERP map at the new address. 2-10x more bytes per CPU at lower tail latency.
- WireGuard relay -- a transparent UDP middlebox for stock WireGuard clients (no Tailscale required). Two peers behind NAT point their
Endpoint =at hyper-derp; the relay forwards based on a peer + link table you set up once. Optional XDP fast path keeps forwarding in the kernel. → quickstart.
When Tailscale or Headscale can't establish a direct WireGuard connection between two peers -- because of NAT, firewalls, or CGNAT -- traffic falls back to a DERP relay. If you're running DERP as a permanent relay path (industrial networks, enterprise deployments, any setup where the relay carries sustained traffic rather than occasional fallback), Hyper-DERP delivers more throughput on less hardware. WireGuard-relay mode covers the same NAT-traversal problem at a different layer -- for people running plain wg-quick on both ends.
Performance
DERP relay vs Tailscale derper
| vCPU | HD Peak (Mbps) | TS Ceiling (Mbps) | HD/TS |
|---|---|---|---|
| 2 | 3,730 | 1,870 | 10.8x |
| 4 | 6,091 | 2,798 | 3.5x |
| 8 | 12,316 | 4,670 | 2.7x |
| 16 | 16,545 | 7,834 | 2.1x |
HD on 8 vCPUs outperforms derper on 16. Across the board, HD matches derper's throughput on half the cores -- a 50% compute cost reduction for a relay fleet.
WireGuard relay (XDP fast path)
| Setup | Single-peer TCP |
|---|---|
| Mellanox CX-4 LX, 25 GbE bare-metal | 10.4 Gbit/s |
| GCP n2-standard-4 (gVNIC GQI) | 3.7 Gbit/s |
Full benchmark results -- 4,903 runs across throughput, latency, tunnel quality, and peer scaling.
Get Started
Install from APT (Debian/Ubuntu, amd64 + arm64):
curl -fsSL https://hyper-derp.dev/repo/key.gpg | \
sudo gpg --dearmor \
-o /usr/share/keyrings/hyper-derp.gpg
echo "deb [signed-by=/usr/share/keyrings/hyper-derp.gpg] \
https://hyper-derp.dev/repo stable main" | \
sudo tee /etc/apt/sources.list.d/hyper-derp.list
sudo apt update && sudo apt install hyper-derp
Or build from source. Then point your DERP map at the new relay (for Tailscale/Headscale) -- or follow the WireGuard relay quickstart (for stock wg-quick setups).
Installation guide | Configuration | WireGuard relay | Source on GitHub