Developers identified a silent network failure where Tailscale’s VPN client drops IPv6 fragments, causing WebRTC applications to hang when packet sizes exceed the tunnel's maximum transmission unit.

Key Points

• The issue originated from a hardcoded 1,228-byte MTU constant in the webrtc-rs library, which triggered fragmentation when combined with VPN overhead.
• Tailscale’s IPv6 parser lacks support for fragmentation, causing the client to silently drop fragmented packets and label them as "ACL" policy denials.
• Debugging revealed that while IPv4 fragments were handled correctly, IPv6 fragments were lost entirely, leading to intermittent connection failures on specific devices.
• The team confirmed the bug using a simple ping -s 1400 test, which resulted in 100% packet loss over IPv6 across all tested Tailscale devices.
• Formal issues have been filed with the webrtc-rs maintainers and the Tailscale repository to address the MTU configuration and fragment handling.

Why it Matters

• This discovery highlights the risks of relying on default network assumptions in peer-to-peer applications, where mismatched MTU limits can cause silent, difficult-to-diagnose failures.
• Developers building real-time services should implement proactive path MTU discovery or use conservative packet sizing to ensure compatibility across diverse network environments and VPN tunnels.