Tailscale Exit Node Setup: Linux, ACLs, VLANs, and Tests

A correct tailscale exit node setup does three things: advertises an internet gateway, authorizes who may use it, and proves that both IPv4 and IPv6 take the intended path. The goal is secure remote egress through a known home or office public IP, not remote access to every local VLAN and not inbound port forwarding.

A selected Tailscale exit node effectively carries 0.0.0.0/0 and ::/0 for non-Tailscale traffic, much like a conventional full-tunnel VPN. Advertisement, admin approval, and client selection are separate opt-ins by design, as the official exit-node documentation explains.

Advertise, approve, and select the exit node

Three commands turn a Linux box with a good uplink into an exit node, and they are three separate opt-ins on purpose:

1. Advertise the node. On the machine that will carry the traffic, run sudo tailscale set --advertise-exit-node.
2. Approve it in the admin console under Machines: open the node’s Edit route settings menu and enable Use as exit node. Until an administrator approves it, advertising does nothing.
3. Select it on a client with sudo tailscale set --exit-node=<node-name>, and turn it off later with sudo tailscale set --exit-node=.

That is the whole happy path. The rest of this guide fills in what makes it reliable: enabling IP forwarding so the node will actually route, granting autogroup:internet if your tailnet runs a deny-by-default policy instead of the open default, and confirming both address families take the tunnel. If the tailnet itself is new, work through the Tailscale setup guide first so identity, tags, and the policy file are already in place. And if a selected exit node makes everything feel slow, the path is usually relayed rather than direct, which is a fixable condition covered in why Tailscale throughput is slow.

Configure the Linux exit node

Install Tailscale using its Linux packages or documented installer, then authenticate:

curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up

If curl | sh violates your change-control policy, use the distribution-specific package repository. Blindly piping installers is not a networking requirement.

Linux must forward both address families. Persist the sysctls, load them, and advertise the node:

printf 'net.ipv4.ip_forward = 1\nnet.ipv6.conf.all.forwarding = 1\n' \
  | sudo tee /etc/sysctl.d/99-tailscale.conf
sudo sysctl -p /etc/sysctl.d/99-tailscale.conf
sudo tailscale set --advertise-exit-node

In the Tailscale admin console, open Machines, find exit-01, choose Edit route settings, and enable Use as exit node. No approval means no usable exit node.

The default tailnet policy permits members to use approved exit nodes. A custom deny-by-default policy must explicitly grant autogroup:internet; granting access to exit-01 itself only permits traffic to that machine. Merge this documented policy selector into the existing HuJSON:

{
  "groups": {
    "group:exit-users": ["[email protected]"]
  },
  "grants": [
    {
      "src": ["group:exit-users"],
      "dst": ["autogroup:internet"],
      "ip": ["*"]
    }
  ]
}

On a Linux client, select the node by MagicDNS name and keep local-LAN access disabled unless a local printer or captive portal genuinely requires it:

sudo tailscale set --exit-node=exit-01 --exit-node-allow-lan-access=false
# Disable the exit node later:
sudo tailscale set --exit-node=

Windows, macOS, iOS, and Android expose the same choice under Exit Node. The CLI reference also accepts a Tailscale IP instead of the machine name.

Isolate the exit node on its own VLAN

Everything above works on a flat home network. Putting the node on its own VLAN gives it internet egress without Layer 2 adjacency to cameras, printers, and other IoT devices. This is optional hardening, not a requirement for a working exit node, so treat this section as a reference for the homelab case.

A worked topology

This concrete port map uses a UDM Pro and USW-Pro-24-PoE:

ONT -> UDM Pro WAN port 9 -> UDM Pro LAN SFP+ port 11 -> USW-Pro-24-PoE SFP+ port 25 -> Linux exit node

Make the UDM Pro-to-switch link an 802.1Q trunk: native VLAN 10 with PVID 10, plus tagged VLANs 20, 30, and 40. Put a U6-Enterprise on switch port 1 with native VLAN 10 and tagged SSID VLANs 20 and 30. Put exit-01 on switch port 2 as an untagged access port, PVID 40, with DHCP reservation 192.168.40.20/24. Do not trunk every VLAN into the exit node. It needs internet egress, not accidental Layer 2 adjacency with IoT cameras.

VLAN plan

VLAN	Name	CIDR	DHCP range	Gateway	Inter-VLAN policy
10	management	192.168.10.0/24	.100-.199	192.168.10.1	Deny by default; allow named admin flows
20	trusted	192.168.20.0/24	.50-.239	192.168.20.1	Deny by default; allow explicit services
30	iot	192.168.30.0/24	.50-.239	192.168.30.1	Deny RFC1918; allow DNS, NTP, and WAN
40	tail-exit	192.168.40.0/24	.100-.199	192.168.40.1	Deny RFC1918; allow resolver and WAN

Firewall rules

Apply these UDM Pro rules in order:

1. any -> any, state ESTABLISHED,RELATED, accept.
2. 192.168.10.0/24 -> 192.168.40.20, TCP 22, accept for administration.
3. 192.168.40.20 -> 192.168.40.1, TCP/UDP 53, accept.
4. 192.168.40.20 -> any, TCP/UDP 53, drop to enforce the named resolver.
5. 192.168.40.0/24 -> 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, any protocol, drop.
6. 192.168.40.20 -> WAN, any protocol, accept.
7. Remaining inter-VLAN traffic, drop.

Rule 6 must follow the RFC1918 deny; reversing them shadows the isolation rule. Broad WAN egress is intentional because users may need more than TCP 443. Tailscale itself normally needs outbound TCP 443, UDP source 41641, and UDP destination 3478; see the vendor firewall-port guidance. Do not enable UPnP. If the path proves to remain relayed and throughput matters, consider one static WAN UDP 41641 mapping to 192.168.40.20:41641.

DNS and discovery

MagicDNS resolves tailnet machine names; it does not turn Bonjour into routed DNS. mDNS is link-local UDP 5353 by definition in RFC 6762, “Multicast DNS”. Keep any mDNS reflector narrowly scoped between VLANs 20 and 30 for required services. Do not reflect it into VLAN 40. IGMP snooping can contain multicast on those Ethernet/Wi-Fi segments, but it does nothing for the Tailscale overlay.

Allow only the intended unicast resolver on each VLAN. Blocking TCP/UDP 53 does not stop DNS-over-HTTPS on TCP 443; endpoint policy is required if DNS enforcement is the actual goal.

Things to test before you call it done

Run these on the client after selecting exit-01:

tailscale status
tailscale ping exit-01
tailscale netcheck
ping -c 4 1.1.1.1
mtr -rw -c 20 1.1.1.1
dig A example.com
dig AAAA example.com
getent ahosts exit-01
curl -4 https://ifconfig.co
curl -6 https://ifconfig.co
nc -vz -w 3 192.168.10.1 443

Run both curl commands on exit-01 too; the client and node public addresses should match for each working address family. The nc attempt should fail under the VLAN policy above. For tunnel capacity, run iperf3 -s on exit-01, then iperf3 -c exit-01 -P 4 on the client. That measures the encrypted client-to-node path, not the node’s ISP download rate.

If tailscale ping reports a relay rather than a direct path, expect added latency and lower throughput. Tailscale documents how NAT conditions drive direct, peer-relay, and DERP connections. Check journalctl -u tailscaled, both forwarding sysctls, and sudo nft list ruleset before inventing NAT rules. Keep the host patched and follow relevant network-security advisories; this box is now an internet gateway.