Struggling to set up Tailscale + Gluetun.

Hi all. Until recently, I just had a regular Tailscale setup on my Ubuntu machine with only one instance running as a system service so I can connect to it. Alongside it, I'd configured wg-easy + gluetun (with ProtonVPN) as my own VPN solution.

I then came across posts like these, which implied you could do the same using a Tailscale docker container as an exit node instead:

https://fathi.me/unlock-secure-freedom-route-all-traffic-through-tailscale-gluetun/

https://github.com/passteque/gluetun/discussions/2201

I thought this would simplify things, allowing me to remove Wireguard and DuckDNS from my setup, but it just doesn't work. I can get it up and running without errors, and can connect to the exit node, but the issue is that it always connect via DERP and my speeds tank.

I tried to mess with DNS, like one of those posts suggested, because I do have Adguard running in a separate container. But that didn't really help with the DERP issue.

I'm not sure if this is specifically because I have another instance running on the same machine, or because I've configured something incorrectly. Here is my compose:

volumes: ts-data: services: gluetun: image: qmcgaw/gluetun:latest container_name: gluetun restart: unless-stopped cap_add: - NET_ADMIN devices: - /dev/net/tun:/dev/net/tun environment: - VPN_SERVICE_PROVIDER=custom - VPN_TYPE=wireguard - WIREGUARD_PRIVATE_KEY=${VPN_PRIVATE_KEY} - WIREGUARD_ADDRESSES=${VPN_ADDRESSES} - WIREGUARD_PUBLIC_KEY=${WIREGUARD_PUBLIC_KEY} - WIREGUARD_ENDPOINT_IP=${WIREGUARD_ENDPOINT_IP} - WIREGUARD_ENDPOINT_PORT=51820 - FIREWALL_OUTBOUND_SUBNETS=192.168.1.0/24 tailscale-vpn-exit-node: image: tailscale/tailscale:latest container_name: tailscale-vpn-exit-node network_mode: service:gluetun environment: - TS_AUTHKEY=${TAILSCALE_AUTHKEY} - TS_EXTRA_ARGS=--advertise-exit-node --accept-routes - TS_ROUTES=192.168.1.0/24 - TS_STATE_DIR=/var/lib/tailscale - TS_HOSTNAME=auxesis volumes: - ts-data:/var/lib/tailscale devices: - /dev/net/tun:/dev/net/tun cap_add: - NET_ADMIN - NET_RAW restart: unless-stopped depends_on: gluetun: condition: service_healthy 

And here are some logs when I tried to run a speedtest on my phone while connected to the exit node container:

tailscale-vpn-exit-node | close tcp 96.8.96.254:8080: endpoint not connected

tailscale-vpn-exit-node | 2026/09/26 12:27:58 backend -> client close connection: close tcp 10.2.0.2:56078->96.8.96.254:8080: shutdown: transport endpoint is not connected

tailscale-vpn-exit-node | close tcp 96.8.96.254:8080: endpoint not connected

tailscale-vpn-exit-node | 2026/09/26 12:28:25 netstack: UDP session between 0.0.0.0:50821 and 192.168.1.237:161 timed out

tailscale-vpn-exit-node | 2026/09/26 12:28:27 netstack: UDP session between 0.0.0.0:50225 and 142.250.68.194:443 timed out

tailscale-vpn-exit-node | 2026/09/26 12:28:27 netstack: UDP session between 0.0.0.0:59937 and 142.250.68.194:443 timed out

tailscale-vpn-exit-node | 2026/09/26 12:28:28 netstack: UDP session between 0.0.0.0:50822 and 192.168.1.237:161 timed out

tailscale-vpn-exit-node | 2026/09/26 12:28:29 netstack: UDP session between 0.0.0.0:45636 and 96.8.96.254:33434 timed out

tailscale-vpn-exit-node | 2026/09/26 12:28:35 magicsock: closing connection to derp-23 (idle), age 2m45s

tailscale-vpn-exit-node | 2026/09/26 12:28:35 magicsock: 1 active derp conns: derp-1=cr4m0s,wr4m0s

tailscale-vpn-exit-node | 2026/09/26 12:28:38 magicsock: disco: node [3Ub8G] d:18d5ced3fb3e6f71 now using 192.168.1.157:41641 mtu=1360 tx=6da2912e083c

tailscale-vpn-exit-node | 2026/09/26 12:28:38 netstack: UDP session between 0.0.0.0:0 and 96.8.96.254:33435 timed out

tailscale-vpn-exit-node | 2026/09/26 12:28:43 netstack: UDP session between 0.0.0.0:38507 and 96.8.96.254:8080 timed out

tailscale-vpn-exit-node | 2026/09/26 12:28:43 netstack: UDP session between 0.0.0.0:48312 and 96.8.96.254:8080 timed out

tailscale-vpn-exit-node | 2026/09/26 12:28:43 [RATELIMIT] format("netstack: UDP session between %s and %s timed out")

tailscale-vpn-exit-node | 2026/09/26 12:28:47 magicsock: adding connection to derp-23 for [3Ub8G]

tailscale-vpn-exit-node | 2026/09/26 12:28:47 magicsock: 2 active derp conns: derp-1=cr4m0s,wr4m0s derp-23=cr0s,wr0s

tailscale-vpn-exit-node | 2026/09/26 12:28:47 derphttp.Client.Send: connecting to derp-23 (dbi)

tailscale-vpn-exit-node | 2026/09/26 12:28:47 magicsock: disco: node [3Ub8G] d:18d5ced3fb3e6f71 now using 192.168.1.157:41641 mtu=1360 tx=2223590bd11d

tailscale-vpn-exit-node | 2026/09/26 12:28:49 magicsock: derp-23 connected; connGen=1

Cheers.