Tailscale DERP
Designated Encrypted Relay for Packets — Tailscale's relay network that forwards encrypted traffic when two nodes can't establish a direct WireGuard connection (hard NAT/firewall). The relay only sees encrypted data; it's a fallback, not an eavesdropping point.
Problem: a mesh VPN wants direct peer-to-peer tunnels, but symmetric NAT/CGNAT/strict firewalls sometimes make NAT hole-punching impossible. Then a DERP server is used as a relay so the connection always works (albeit with higher latency). Tailscale always tries direct first (via STUN-like hole punching) and falls back to DERP when needed, often temporarily until a direct path is found. Since traffic is E2E-encrypted with WireGuard, the relay sees no content. DERP is open source and can be self-hosted. It illustrates the practical reality: NAT traversal doesn't always succeed, so a relay is needed as a guarantee.