diff --git a/wgengine/magicsock/magicsock.go b/wgengine/magicsock/magicsock.go
index 2117f725c..a3b89759d 100644
--- a/wgengine/magicsock/magicsock.go
+++ b/wgengine/magicsock/magicsock.go
@@ -83,6 +83,8 @@
 	// on mobile devices, lowers the shutdown interval, and logs more
 	// verbosely about idle measurements.
 	debugReSTUNStopOnIdle, _ = strconv.ParseBool(os.Getenv("TS_DEBUG_RESTUN_STOP_ON_IDLE"))
+	// debugAlwaysDERP disables the use of UDP, forcing all peer communication over DERP.
+	debugAlwaysDERP, _ = strconv.ParseBool(os.Getenv("TS_DEBUG_ALWAYS_USE_DERP"))
 )
 
 // useDerpRoute reports whether magicsock should enable the DERP
@@ -2665,6 +2667,12 @@ func (c *Conn) bindSocket(rucPtr **RebindingUDPConn, network string, curPortFate
 	ruc.mu.Lock()
 	defer ruc.mu.Unlock()
 
+	if debugAlwaysDERP {
+		c.logf("disabled %v per TS_DEBUG_ALWAYS_USE_DERP", network)
+		ruc.pconn = newBlockForeverConn()
+		return nil
+	}
+
 	// Build a list of preferred ports.
 	// Best is the port that the user requested.
 	// Second best is the port that is currently in use.