Use exit nodes

Last validated: Sep 19, 2025

This topic is a quick guide for configuring exit nodes in a tailnet. For more detailed information, see Exit nodes.

Advertise a device as an exit node

To use a tailnet device as an exit node, select an OS and complete the steps.

Download and install the Tailscale client.

Open a terminal session on the device and enable IP forwarding.

If your Linux system has a /etc/sysctl.d directory, use:

echo 'net.ipv4.ip_forward = 1' | sudo tee -a /etc/sysctl.d/99-tailscale.conf
echo 'net.ipv6.conf.all.forwarding = 1' | sudo tee -a /etc/sysctl.d/99-tailscale.conf
sudo sysctl -p /etc/sysctl.d/99-tailscale.conf

Otherwise, use:

echo 'net.ipv4.ip_forward = 1' | sudo tee -a /etc/sysctl.conf
echo 'net.ipv6.conf.all.forwarding = 1' | sudo tee -a /etc/sysctl.conf
sudo sysctl -p /etc/sysctl.conf

In the terminal session, advertise the device as an exit node.
```
sudo tailscale set --advertise-exit-node
```
Go to the Machines page of the admin console.
Locate the device in the list. It should display the Exit Node badge.
Select the menu, then select Edit route settings.
Check the Use as exit node box, then select Save.

Grant access to use an exit node

By default, any user in your tailnet can use a configured exit node. You don't need to add any grants or ACLs.

This changes if you customize your tailnet's access control policy. For example, suppose you replace the default policy with one that only lets your developers access a few internal servers:

{
  "grants": [
    {
      "src": ["group:developers"],
      "dst": ["tag:prod"],
      "ip": ["*"]
    }
  ]
}

Your developers can still reach the production servers, but they can no longer use an exit node. The policy never grants access to autogroup:internet, so Tailscale has no permission to route internet traffic through the exit node.

A common point of confusion is to add the exit node device itself as the destination. That only permits connections to the exit node, such as SSH. It does not permit using the device as an internet gateway.

To permit exit node use, add a grant or ACL whose dst is autogroup:internet. This grants permission to route internet traffic through any configured exit node rather than to connect to the exit node device itself.

Use an exit node

Each device must enable the exit node separately. The instructions for enabling an exit node vary depending on the device's operating system.

Android iOS Linux macOS tvOS Windows

Run tailscale set with the --exit-node= flag, passing the Tailscale 100.x.y.z IP address of the exit node.

sudo tailscale set --exit-node=<exit-node-ip>

You can find the IP address for the device from the admin console or by running tailscale status.

Alternatively, set --exit-node-allow-lan-access to true to allow direct access to your local network when routing traffic through an exit node.

sudo tailscale set --exit-node=<exit-node-ip> --exit-node-allow-lan-access=true

To stop using an exit node, run the --exit-node flag without passing in an IP address.

sudo tailscale set --exit-node=

You can turn off routing through an exit node by selecting None from the Exit Node drop-down.