How I fit use my VPS as Tailscale exit node

Wetin Tailscale exit node dey do

Tailscale exit node na machine for your tailnet wey carry all internet traffic for your other devices. VPS (virtual private server) good for this work because e get fixed public address and e dey online all the time. To set am up, follow five steps: install Tailscale for the server, advertise the exit node, enable IP forwarding, approve the route for the admin console, then select the node for your laptop. The fourth step na toggle for web page, no be command, and na there most people dey stop.

Once e don turn on, your laptop go encrypt every packet and send am go VPS. VPS go apply source NAT (network address translation), then send the packet out with its own public IP address. Websites go see VPS. Café Wi-Fi go see only one encrypted UDP flow to VPS and nothing else.

Tailscale na WireGuard for the data path, plus coordination server wey distribute keys and help two machines find each other through NAT. Na this coordination server make key copying no dey needed for anywhere below. For the trade-offs wey explain everything well, read how Tailscale and plain WireGuard compare. If you prefer to control every part of the tunnel by yourself, self-host a plain WireGuard VPN on your VPS instead.

The steps below assume say Tailscale don already dey run for your laptop, and both machines sign in to the same tailnet. Tailnet na your private Tailscale network, and every device inside am get stable address inside 100.64.0.0/10.

Install Tailscale for your VPS

curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up

The install script dey choose the package repository for your distribution and install the tailscaled daemon. tailscale up go then print authentication URL. Open am for browser and sign in with the same account wey your laptop dey use, because VPS wey sign in to different tailnet no fit serve your laptop at all.

tailscale status
tailscale ip -4

tailscale status suppose now list both machines. tailscale ip -4 dey print the VPS tailnet address, and na this address you go give the client later.

Tailscale need TUN device to build the tunnel. For KVM VPS, the device dey available. For plans wey use container virtualisation and share the host kernel, /dev/net/tun fit sometimes dey missing, and tailscaled no fit create the tailscale0 interface. Run ls -l /dev/net/tun before you continue.

Enable IP forwarding, or the VPS go drop every packet

Linux machine dey drop any packet wey no address to itself, because net.ipv4.ip_forward dey 0 by default. Exit node go accept your traffic, decrypt am, then throw am away. Write the setting to file so e go survive reboot.

echo 'net.ipv4.ip_forward = 1' | sudo tee -a /etc/sysctl.d/99-tailscale.conf
echo 'net.ipv6.conf.all.forwarding = 1' | sudo tee -a /etc/sysctl.d/99-tailscale.conf
sudo sysctl -p /etc/sysctl.d/99-tailscale.conf

tee -a dey append, so if you run these lines again, e go write both settings two times. Result still dey work, but cat /etc/sysctl.d/99-tailscale.conf go look strange. Confirm the live value instead of trusting the file:

sysctl net.ipv4.ip_forward

E must print net.ipv4.ip_forward = 1. If you skip this and use tailscale up --advertise-exit-node, client go tell you:

Warning: IP forwarding is disabled, subnet routing/exit nodes will not work.

tailscale set --advertise-exit-node no dey run that check, so if set quiet, that no prove say forwarding dey on. Read the sysctl value by yourself.

You no need write masquerade rule by hand. tailscaled dey install im own firewall chains, wey dem name ts-input, ts-forward and ts-postrouting, and NAT rule for exit node traffic dey inside ts-postrouting. Look dem with sudo iptables-save | grep ts-, or use sudo nft list ruleset for nftables box.

Advertise VPS as exit node

sudo tailscale set --advertise-exit-node

tailscale set dey change one preference and leave the others as dem dey. tailscale up --advertise-exit-node dey advertise the node too, and e get one side effect: up dey treat the flags for e command line as the complete set of non-default settings, so if you later run bare sudo tailscale up, e go refuse to run and print

changing settings via 'tailscale up' requires mentioning all
non-default flags. To proceed, either re-run your command with --reset or
use the command below to explicitly mention the current value of
all non-default settings:

Use set for changes wey you go continue to make, and you no go see that message.

Advertising na offer. VPS don dey tell coordination server say e ready to work as exit node. No client fit use am yet.

Approve Tailscale exit node for admin console

Na this step wey no get command behind am. Open Machines page for admin console, find the VPS, open the three-dot menu for the end of its row, choose Edit route settings, then turn on Use as exit node.

Until you turn on that toggle, control plane go hold the offer and no give am to anybody. tailscale exit-node list for your laptop no go show anything, and your traffic go continue to use the normal route. No error message go show for either machine. Exit node simply no go appear.

You fit approve exit nodes automatically with one entry for the tailnet policy file:

"autoApprovers": {
  "exitNode": ["tag:exit"],
}

Device wey you bring up with --advertise-tags=tag:exit go get approval by itself, as long as tag:exit dey defined under tagOwners for the same policy file. Tagging dey change ownership: tailnet go own tagged device instead of your user account, and the access rules wey apply to am go change too. For one VPS, the toggle dey simpler.

Select exit node for your laptop

For Linux client:

tailscale exit-node list
sudo tailscale set --exit-node=vps.your-tailnet.ts.net

exit-node list dey print the approved exit nodes for your tailnet together with their addresses. If the list empty, e mean say approval step no happen. For macOS, Windows, iOS and Android, na menu item under Exit Node for Tailscale app you go use make the same choice.

Verify am from the client, never from the server:

curl -4 https://ifconfig.me

Run am once before you select exit node and once after. The address suppose change from your local one to the VPS public IP. To stop using the exit node:

sudo tailscale set --exit-node=

One more flag important from day one. When you select exit node, client dey send everything inside the tunnel, including packets wey address 192.168.1.50, so your printer and network storage no go answer again. Keep local network for local route:

sudo tailscale set --exit-node=<name> --exit-node-allow-lan-access=true

Why your DNS dey change as soon as exit node dey on

By default, device wey dey use exit node go also use that exit node as e DNS (domain name system) resolver for every domain. This one override the global and split DNS nameservers wey you configure for your tailnet. Na deliberate behaviour. If queries continue go local network resolver, café router still go see the name of every site wey you visit, even though the traffic itself private. Names and packets suppose comot from the same place.

One problem dey affect people wey dey run internal resolver: tailnet nameserver wey you depend on go stop to dey used while exit node dey on. Turn on Use with exit node for that nameserver for the DNS page of admin console to bring am back.

MagicDNS names still dey work, because Tailscale client dey answer dem locally at 100.100.100.100 before anything reach exit node. Check am with dig @100.100.100.100 your-vps.your-tailnet.ts.net, or for systemd-resolved client use resolvectl status, where Tailscale interface list 100.100.100.100 as e DNS server.

If you disable Tailscale DNS handling with --accept-dns=false, client go keep the resolver wey e learn from local network. The traffic dey tunnel, but the queries no dey, and this na the same DNS leak wey dey catch hand-built WireGuard tunnels. Leave --accept-dns as e be unless you get specific reason to change am.

IPv6 through the exit node

An exit node dey advertise both default routes, 0.0.0.0/0 and ::/0. If VPS no get working IPv6 path go internet, IPv6 packets go arrive through tunnel and stop there. Test am for VPS before you trust am:

ip -6 addr show
curl -6 https://ifconfig.me

Failed request mean say VPS no get IPv6 upstream. Dual stack websites usually still go load, because client go give up on IPv6 and retry through IPv4, although that retry go add delay for the first connection to each site. IPv6-only destinations go remain unreachable.

The other half na forwarding. net.ipv4.ip_forward = 1 with net.ipv6.conf.all.forwarding still set to 0 go give you working IPv4 path and black hole for IPv6. Reader go experience am as "some sites dey slow" instead of clear error wey person fit search for. Both lines belong inside sysctl file.

VPS suppose advertise subnet routes too?

Exit node dey carry all internet traffic. Subnet route dey carry one private range wey dey behind the machine wey advertise am. Dem na separate features with separate approvals, and one machine fit do both.

sudo tailscale set --advertise-routes=10.0.0.0/24

Advertise subnet when VPS share private network with other servers wey you wan reach through their private addresses. Approve am for the same Edit route settings panel, through its own toggle.

Choose the range carefully. Advertised route dey more specific than your laptop default route, so if VPS advertise 192.168.1.0/24, e go take over addresses for home network wey dey use the same range, and the devices for your desk go stop responding. Use range wey you choose, no be the range wey your home router choose for you.

Make exit node fast with UDP GRO forwarding

Tailscale 1.54 and later, for Linux 6.2 or later kernel, fit use receive offload wey dey increase throughput for forwarded traffic. GRO (generic receive offload) dey merge incoming packets before kernel process dem one by one. As of August 2026, you still need do this manual step for exit node.

sudo apt install -y ethtool
NETDEV=$(ip -o route get 8.8.8.8 | cut -f 5 -d " ")
sudo ethtool -K $NETDEV rx-udp-gro-forwarding on rx-gro-list off

ip -o route get 8.8.8.8 dey report the interface wey really dey reach internet, so you no need guess between eth0, ens3 and enp1s0. Confirm am with ethtool -k $NETDEV | grep udp-gro-forwarding, wey suppose now show on.

This setting go disappear after reboot. If system dey run networkd-dispatcher, make am automatic:

printf '#!/bin/sh\n\nethtool -K %s rx-udp-gro-forwarding on rx-gro-list off \n' "$(ip -o route get 8.8.8.8 | cut -f 5 -d " ")" | sudo tee /etc/networkd-dispatcher/routable.d/50-tailscale
sudo chmod 755 /etc/networkd-dispatcher/routable.d/50-tailscale

First check say /etc/networkd-dispatcher/routable.d/ dey exist. If e no dey, the machine no dey run networkd-dispatcher. For this case, small systemd unit wey dey run the ethtool line during boot go do the same work.

Wetin your provider acceptable use policy mean for exit traffic

Every packet wey client send through the exit node go comot with the VPS public IP address, so dem go attribute am to your account. Abuse reports go land for your inbox: copyright notices and port scan complaints. Read your provider AUP (acceptable use policy) before you route household or team traffic through one server, and no open exit node to people wey you no fit vouch for.

Bandwidth dey count two times. Traffic go enter the VPS through the tunnel, then e go comot again go internet, and both directions normally count against the transfer allowance for the plan. Video stream wey person watch through exit node fit use much more bandwidth than most people expect.

Datacenter address ranges too get reputation. Some sites go show more CAPTCHAs for dem, and some streaming services go refuse dem completely. Nothing for your configuration go change that, because na property of the address block wey your provider own.

Why traffic still dey pass through your local connection

The exit node don advertise am but dem never approve am. tailscale exit-node list for the client no print anything, and no machine log error. Go Machines page and turn on Use as exit node.

The client never select am. Approval make the node available to the tailnet. But each device still need select am separately. Run sudo tailscale set --exit-node=<name> again, then check curl -4 https://ifconfig.me again.

Forwarding dey off. The symptom clear: tailscale ping <vps> succeed, the tunnel dey properly up, but every outside address dey timeout. sysctl net.ipv4.ip_forward read 0. Fix the sysctl file, then run sudo sysctl -p /etc/sysctl.d/99-tailscale.conf.

Firewall dey drop the forwarded packets. tailscaled dey insert its own ts-forward chain, and for clean VPS that one dey enough. But box wey already dey run ufw or Docker fit end up with FORWARD policy as DROP, with rules wey dey before Tailscale own rules. No guess which one dey happen: run sudo iptables -L FORWARD -n -v while the client dey try load page, and monitor which counters dey increase. For ufw box, the usual fix na DEFAULT_FORWARD_POLICY="ACCEPT" inside /etc/default/ufw, then run sudo ufw reload. Check your provider network firewall for control panel too, because na separate control from anything wey dey run for the server.

E dey work, but e slow. Run tailscale netcheck for both machines. If e report say UDP dey blocked, the two devices no fit build direct path and dem go fall back to DERP relay. This one dey add latency to every connection. If you allow inbound UDP for port 41641 to the VPS inside the provider network firewall, e usually go restore the direct path.

When to leave Tailscale coordination server

Everything wey come before depend on Tailscale hosted coordination server for key exchange and the approval wey you click. Your traffic still dey go direct from laptop to VPS, and coordination server no dey carry am. But e still dey decide who fit join the tailnet and wetin each device fit reach. If na this dependency you wan remove, run Headscale as your own Tailscale control server and point both clients go am. The exit node steps remain the same afterwards. You go do route approval through Headscale command line instead of the hosted console. Headscale replace the control plane but keep you on Tailscale clients. If you prefer run the complete stack by yourself, NetBird get its own coordination server and clients wey you fit host for one VPS.

FAQ

Why my traffic still dey use my local connection after I select the exit node?

Two common causes dey. The exit node na advertised but dem never approve am: open the Machines page for the admin console, find the VPS, choose Edit route settings, then turn on Use as exit node. Approval na console toggle, and no command for the server fit perform am. The second cause different: IP forwarding dey off, so the tunnel comes up, tailscale ping to the VPS dey work, but every outside address dey time out. Check am with sysctl net.ipv4.ip_forward, and the result must read 1.

I need approve the exit node by hand every time?

The toggle na one-time action for each machine. If you dey rebuild the VPS often, add an autoApprovers block to your tailnet policy file wey contain "exitNode": ["tag:exit"], define tag:exit under tagOwners, then bring the node up with --advertise-tags=tag:exit. A tagged device belong to the tailnet instead of your user account, so the access rules wey apply to am go change too.

Which DNS server my laptop dey use when exit node dey on?

Na the exit node itself. Device wey dey use exit node sends all DNS queries go there, and this override the global and split DNS nameservers wey you set for the tailnet. E stop the local network from seeing the names wey you look up. To make one tailnet nameserver continue to apply, enable Use with exit node for am on the DNS page of the admin console. MagicDNS names still resolve, because the Tailscale client dey answer dem locally for 100.100.100.100.

One VPS fit be exit node and subnet router at the same time?

Yes. sudo tailscale set --advertise-exit-node and sudo tailscale set --advertise-routes=10.0.0.0/24 dey independent, and each one get im own approval toggle under Edit route settings. Both need IP forwarding enabled for the VPS. Avoid advertising a range wey match your laptop home network, because the advertised route more specific than the default route, and your local devices go become unreachable.

Exit node dey hide my traffic from my VPS provider?

No. The tunnel end for the VPS, so traffic leave the server in the form wey the destination expect, and your provider carry am in clear wherever the site itself no use encryption. Exit node move the point where your traffic join the internet, from the network wey you dey use to the server wey you rent. E hide your browsing from café Wi-Fi and your home ISP, but e show that same browsing to your VPS provider with your account name attached.