Tailscale Exit Node Setup: Linux, ACLs, VLANs, and Tests

A Tailscale exit node is a device in your tailnet that carries another device’s internet traffic, so websites see the exit node’s public IP instead of yours. On Linux, enable IP forwarding, run sudo tailscale set --advertise-exit-node, approve the machine in the admin console, then select it on a client with sudo tailscale set --exit-node=<name>.

A correct setup does three things: advertises an internet gateway, authorizes who may use it, and proves that both IPv4 and IPv6 take the intended path. The goal is secure remote egress through a known home or office public IP, not remote access to every local VLAN and not inbound port forwarding.

A selected Tailscale exit node effectively carries 0.0.0.0/0 and ::/0 for non-Tailscale traffic, much like a conventional full-tunnel VPN. Advertisement, admin approval, and client selection are separate opt-ins by design, as the official exit-node documentation explains.

Advertise, approve, and select the exit node

Three steps turn a Linux box with a good uplink into an exit node, and they are three separate opt-ins on purpose:

1. Advertise the node. On the machine that will carry the traffic, run sudo tailscale set --advertise-exit-node.
2. Approve it in the admin console under Machines (the property:exit-node filter finds every advertiser): open the node’s Edit route settings menu and enable Use as exit node. Until an administrator approves it, advertising does nothing.
3. Select it on a client with sudo tailscale set --exit-node=<node-name>, and turn it off later with sudo tailscale set --exit-node=.

That is the whole happy path. The rest of this guide fills in what makes it reliable: enabling IP forwarding so the node will actually route, granting autogroup:internet if your tailnet runs a deny-by-default policy instead of the open default, and confirming both address families take the tunnel. If the tailnet itself is new, work through the Tailscale setup guide first so identity, tags, and the policy file are already in place. And if a selected exit node makes everything feel slow, the path is usually relayed rather than direct, which is a fixable condition covered in why Tailscale throughput is slow.

Exit node vs subnet router vs ordinary node

Every device running Tailscale is a node, and most nodes carry only their own traffic. Exit nodes and subnet routers forward traffic for others; both need IP forwarding and approval, so they get confused. The difference is the destination:

An exit node is for egress, not for reaching the NAS or printer behind it. Those need advertised LAN prefixes, covered in Tailscale subnet router configuration, and one Linux box can do both jobs. Why approval sits apart from connectivity is explained in how a Tailscale mesh VPN works.

Choose the device: Linux, Raspberry Pi, Docker, Windows, or phone

Use an always-on Linux machine with a wired uplink where you can. The exit node documentation supports Linux, macOS, Windows, Android, iOS, and tvOS, but notes that Windows, macOS, and Android route in userspace only, and Tailscale’s Docker parameters page says userspace networking “works everywhere but has lower performance.”

Whatever the device, it and its clients need Tailscale v1.20 or later. New tailnets default to a 180-day key expiry, after which a node stops working until it reauthenticates. Disable expiry for that machine in Machines, or tag it: tagged devices have key expiry disabled by default.

Configure the Linux exit node

Install Tailscale using its Linux packages or documented installer, then authenticate:

curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up

If curl | sh violates your change-control policy, use the distribution-specific package repository. Blindly piping installers is not a networking requirement.

Linux must forward both address families. Persist the sysctls, load them, and advertise the node:

printf 'net.ipv4.ip_forward = 1\nnet.ipv6.conf.all.forwarding = 1\n' \
  | sudo tee /etc/sysctl.d/99-tailscale.conf
sudo sysctl -p /etc/sysctl.d/99-tailscale.conf
sudo tailscale set --advertise-exit-node

On a firewalld host (Fedora, RHEL, Rocky), the exit-node docs add sudo firewall-cmd --permanent --add-masquerade to work around a known issue. Keep the host firewall denying forwarded traffic by default otherwise.

In the Tailscale admin console, open Machines, find exit-01, choose Edit route settings, and enable Use as exit node. No approval means no usable exit node.

The default tailnet policy permits members to use approved exit nodes. A custom deny-by-default policy must explicitly grant autogroup:internet (see the exit node ACL example); granting access to exit-01 itself only permits traffic to that machine. Merge this documented policy selector into the existing HuJSON:

{
  "tagOwners": {
    "tag:exit": ["autogroup:admin"]
  },
  "autoApprovers": {
    "exitNode": ["tag:exit"]
  },
  "grants": [
    {
      "src": ["autogroup:member"],
      "dst": ["autogroup:internet"],
      "ip": ["*"]
    }
  ]
}

The grant lets every tailnet member egress; swap autogroup:member for a group: of named users to narrow it. The autoApprovers block approves any device tagged tag:exit that advertises itself, so a rebuilt node does not wait on a click. Bring it up with sudo tailscale up --advertise-tags=tag:exit --advertise-exit-node.

Use an exit node from a Linux client

On a Linux client, sudo tailscale set --exit-node=<name-or-IP> turns an exit node on and sudo tailscale set --exit-node= turns it off. The full sequence is four commands:

1. List approved exit nodes with tailscale exit-node list, which prints each node’s Tailscale IP and, with MagicDNS on, its name. --filter=<country> filters by country.
2. Select one by MagicDNS name, keeping local-LAN access disabled unless a local printer or captive portal genuinely requires it.
3. Verify that curl -4 now returns the exit node’s public address.
4. Disable it when you are done.

tailscale exit-node list
sudo tailscale set --exit-node=exit-01 --exit-node-allow-lan-access=false
curl -4 https://ifconfig.co
# Disable the exit node later:
sudo tailscale set --exit-node=

The CLI reference also accepts a Tailscale IP instead of the machine name, and tailscale up takes the same --exit-node flag. With LAN access off, which is the default, the client cannot reach its own local network while the exit node is active.

Run or use an exit node on Windows

Windows handles both jobs from the system tray. To run an exit node, open the Tailscale client, select Exit node > Run exit node, then approve the machine in the admin console as you would a Linux one. To use one, select Use exit node and pick the machine; choose None to stop. That menu only appears once an approved exit node is available.

A Windows exit node is a weaker gateway than a Linux one. Tailscale lists three constraints: routing is userspace only, the PC must not sleep, and each in-flight DNS query occupies a system thread, which can hurt on a busy node. Turn on Run unattended (right-click the tray icon, Preferences > Run unattended, or tailscale set --unattended=true in PowerShell) so the client keeps running after sign-out.

The CLI works in PowerShell too, which matters for Mullvad users: the Windows client cannot display the full Mullvad exit node list, so run tailscale exit-node list instead. On macOS, pick a node from the Exit Nodes menu (versions before v1.60.0 call it Use exit node). Both desktop apps have an Allow Local Network Access setting equivalent to the Linux flag.

Raspberry Pi as a Tailscale exit node

A Raspberry Pi is configured exactly like any Linux exit node. Raspberry Pi OS is on the install script’s supported list, so the install command, forwarding sysctls, --advertise-exit-node, and approval steps above apply unchanged. The board’s network port sets the ceiling:

Those are link speeds, not tunnel throughput: every forwarded packet is also encrypted on the Pi’s CPU, so run the iperf3 test at the end of this guide before relying on it. Use the wired port. If a minimal image reports a missing tun device, load it with sudo modprobe tun and add tun to /etc/modules-load.d/tun.conf so it loads at boot.

Run a Tailscale exit node in Docker

The tailscale/tailscale image becomes an exit node when --advertise-exit-node goes in TS_EXTRA_ARGS and the container uses kernel networking. This service is trimmed from Tailscale’s ScaleTail exit-node example:

services:
  tailscale:
    image: tailscale/tailscale:latest
    hostname: exit-docker
    environment:
      - TS_AUTHKEY=${TS_AUTHKEY}
      - TS_STATE_DIR=/var/lib/tailscale
      - TS_EXTRA_ARGS=--advertise-exit-node
      - TS_USERSPACE=false
    volumes:
      - ./ts/state:/var/lib/tailscale
    devices:
      - /dev/net/tun:/dev/net/tun
    cap_add:
      - net_admin
    sysctls:
      net.ipv4.ip_forward: 1
      net.ipv6.conf.all.forwarding: 1
    restart: always

Per the Docker configuration parameters, TS_USERSPACE is enabled by default, and kernel networking needs /dev/net/tun plus added capabilities. TS_EXTRA_ARGS passes flags to tailscale up, so --advertise-exit-node --advertise-tags=tag:exit lets the autoApprovers rule above approve it. TS_STATE_DIR must persist across restarts, or the container appears as a new node each time and needs approving again.

Isolate the exit node on its own VLAN

Everything above works on a flat home network. Putting the node on its own VLAN gives it internet egress without Layer 2 adjacency to cameras, printers, and other IoT devices. This is optional hardening, not a requirement for a working exit node, so treat this section as a reference for the homelab case.

A worked topology

This concrete port map uses a UDM Pro and USW-Pro-24-PoE:

ONT -> UDM Pro WAN port 9 -> UDM Pro LAN SFP+ port 11 -> USW-Pro-24-PoE SFP+ port 25 -> Linux exit node

Make the UDM Pro-to-switch link an 802.1Q trunk: native VLAN 10 with PVID 10, plus tagged VLANs 20, 30, and 40. Put a U6-Enterprise on switch port 1 with native VLAN 10 and tagged SSID VLANs 20 and 30. Put exit-01 on switch port 2 as an untagged access port, PVID 40, with DHCP reservation 192.168.40.20/24. Do not trunk every VLAN into the exit node. It needs internet egress, not accidental Layer 2 adjacency with IoT cameras.

VLAN plan

Firewall rules

Apply these UDM Pro rules in order:

1. any -> any, state ESTABLISHED,RELATED, accept.
2. 192.168.10.0/24 -> 192.168.40.20, TCP 22, accept for administration.
3. 192.168.40.20 -> 192.168.40.1, TCP/UDP 53, accept.
4. 192.168.40.20 -> any, TCP/UDP 53, drop to enforce the named resolver.
5. 192.168.40.0/24 -> 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, any protocol, drop.
6. 192.168.40.20 -> WAN, any protocol, accept.
7. Remaining inter-VLAN traffic, drop.

Rule 6 must follow the RFC1918 deny; reversing them shadows the isolation rule. Broad WAN egress is intentional because users may need more than TCP 443. Tailscale itself normally needs outbound TCP 443, UDP source 41641, and UDP destination 3478; see the vendor firewall-port guidance. Do not enable UPnP. If the path proves to remain relayed and throughput matters, consider one static WAN UDP 41641 mapping to 192.168.40.20:41641.

DNS and discovery

MagicDNS resolves tailnet machine names; it does not turn Bonjour into routed DNS. mDNS is link-local UDP 5353 by definition in RFC 6762, “Multicast DNS”. Keep any mDNS reflector narrowly scoped between VLANs 20 and 30 for required services. Do not reflect it into VLAN 40. IGMP snooping can contain multicast on those Ethernet/Wi-Fi segments, but it does nothing for the Tailscale overlay.

Allow only the intended unicast resolver on each VLAN. Blocking TCP/UDP 53 does not stop DNS-over-HTTPS on TCP 443; endpoint policy is required if DNS enforcement is the actual goal.

Things to test before you call it done

Run these on the client after selecting exit-01:

tailscale status
tailscale ping exit-01
tailscale netcheck
ping -c 4 1.1.1.1
mtr -rw -c 20 1.1.1.1
dig A example.com
dig AAAA example.com
getent ahosts exit-01
curl -4 https://ifconfig.co
curl -6 https://ifconfig.co
nc -vz -w 3 192.168.10.1 443

Run both curl commands on exit-01 too; the client and node public addresses should match for each working address family. The nc attempt should fail under the VLAN policy above. For tunnel capacity, run iperf3 -s on exit-01, then iperf3 -c exit-01 -P 4 on the client. That measures the encrypted client-to-node path, not the node’s ISP download rate.

If tailscale ping reports a relay rather than a direct path, expect added latency and lower throughput. Tailscale documents how NAT conditions drive direct, peer-relay, and DERP connections. Check journalctl -u tailscaled, both forwarding sysctls, and sudo nft list ruleset before inventing NAT rules. If the path is direct and throughput still trails the uplink, the performance guide recommends UDP GRO forwarding on the exit node’s physical NIC with Tailscale 1.54 or later on a Linux 6.2 or later kernel. Keep the host patched and follow relevant network-security advisories; this box is now an internet gateway.

FAQ

does a tailscale exit node need port forwarding?

No. An exit node needs outbound connectivity, not an inbound port forward: Tailscale normally uses outbound TCP 443, UDP source port 41641 and UDP destination 3478, and falls back to a relay when a direct path fails. A single static UDP 41641 mapping only helps if the path stays relayed and throughput matters.

is a tailscale exit node free?

Yes, on your own hardware. Tailscale’s pricing page lists subnet routers and exit nodes among the plan basics, and the Personal plan is free for up to 6 users. The paid option is Mullvad exit nodes, a $5 per month add-on for every 5 devices (checked October 2026), which supplies exit locations without running a server.

why is my tailscale exit node not showing up?

Usually it was advertised but never approved: enable Use as exit node under Edit route settings on the Machines page. Next check that both devices run Tailscale v1.20 or later and that a custom policy grants autogroup:internet. An exit node whose key has expired also stops working until it reauthenticates.

does a tailscale exit node hide my ip address?

It hides your current network’s public IP, not your activity. Sites see the exit node’s public address, and that network’s ISP sees the connections leaving it. Exit node destination logging is off by default in Tailscale. With Mullvad exit nodes, Tailscale can still see which users connect to which Mullvad servers unless the device opts out of client logging.

can tailscale choose the best exit node automatically?

Yes, on Standard, Premium and Enterprise plans or with the Mullvad add-on. tailscale exit-node suggest prints a recommended node, and sudo tailscale set --exit-node=auto:any keeps tracking the recommendation as nodes or network conditions change. Tailscale prefers your own exit nodes, ranked by latency and performance, before any Mullvad node.