ipn/localapi: make tailscale debug derp STUNOnly-aware (#16927)

Fixes #16926

Signed-off-by: Jordan Whited <jordan@tailscale.com>

ipn/localapi/debugderp.go

@@ -228,6 +228,7 @@ func (h *Handler) serveDebugDERPRegion(w http.ResponseWriter, r *http.Request) {
 
 	// Start by checking whether we can establish a HTTP connection
 	for _, derpNode := range reg.Nodes {
+		if !derpNode.STUNOnly {
 			connSuccess := checkConn(derpNode)
 
 			// Verify that the /generate_204 endpoint works
@@ -278,6 +279,9 @@ func (h *Handler) serveDebugDERPRegion(w http.ResponseWriter, r *http.Request) {
 			if len(serverPubKeys) > 1 {
 				st.Errors = append(st.Errors, fmt.Sprintf("Received multiple server public keys (%d); is the DERP server behind a load balancer?", len(serverPubKeys)))
 			}
+		} else {
+			st.Info = append(st.Info, fmt.Sprintf("Node %q is marked STUNOnly; skipped non-STUN checks", derpNode.HostName))
+		}
 
 		// Send a STUN query to this node to verify whether or not it
 		// correctly returns an IP address.