Exit Nodes (route all traffic)

The exit node feature lets you route all non-Tailscale internet traffic through a specific device on your Tailscale network (known as a tailnet). The device routing your traffic is called an "exit node."

By default, Tailscale acts as an overlay network: it only routes traffic between devices running Tailscale, but doesn't touch your public internet traffic, such as when you visit Google or Twitter. This is ideal for most people, who need secure communication between sensitive devices (company servers, home computers), but don't need extra layers of encryption or latency for their public internet connection.

However, there may be times when you do want Tailscale to route your public internet traffic: in a cafe with untrusted Wi-Fi, or when traveling overseas and needing access to an online service (such as banking) only available in your home country.

By setting a device on your network as an exit node, you can use it to route all your public internet traffic as needed, like a consumer VPN.

If you've ever used default routes (0.0.0.0/0, ::/0) with other VPNs or native WireGuard®, exit nodes are Tailscale's equivalent. Exit nodes use default routes under the hood.

Configuring an exit node

Let's walk through how to configure an exit node for your network. For security purposes, every device must explicitly opt in to using the exit node:

• A device must advertise that it's willing to be an exit node.
• An Owner, Admin, or Network admin must allow it to be an exit node for the network.
• And then other devices on your network can use that exit node as they'd like.

Prerequisites

1. Before you begin this guide, you'll need a Tailscale network, called a tailnet, set up. Read our getting started guide if you need help with this.

2. Ensure both the exit node and devices using the exit node will run Tailscale v1.20 or later.

3. Ensure your exit node is a Linux, macOS, Windows, or Android device.

4. If your tailnet is using the default ACL, users of your tailnet already have access to any exit nodes that you configure. If you have modified your ACL, ensure you have created an access rule that grants access to autogroup:internet to users who you wish to use exit nodes. They do not need access to the exit node itself in order to use the exit node. Here's an example line to add to your ACL that allows all users access to the internet through an exit node:

   // All users can use exit nodes
   // If you are using the default ACL, this rule is not needed because the
   // default ACL allows all users access to the internet through an exit node
   { "action": "accept", "src": ["autogroup:member"], "dst": ["autogroup:internet:*"] },
   

Step 1: Install the Tailscale client

Step 2: Advertise a device as an exit node

If the device is authenticated by a user who can approve exit nodes in autoApprovers, then the exit node will automatically be approved.

Step 3: Allow the exit node from the admin console

This step is not required if using autoApprovers.

An admin in your network must now allow this device to be used as an exit node.

Open the Machines page of the admin console, and locate the exit node device. You can look for the Exit Node badge in the machines list, or use the property:exit-node filter to see all devices claiming to be exit nodes.

Once you've found the machine, from the menu, open the Edit route settings panel, and enable the Use as exit node option.

Step 4: Use the exit node

You can now use the exit node from devices in your network. Each device must enable the exit node separately.

Instructions differ depending on the OS:

Step 5: Done!

You can verify that your traffic is routed by another device by checking your public IP address using online tools. You should see the exit node's public IP rather than your local device's IP.

You can disable routing through the exit node at any time by selecting None from the same menu used in step 4.

Caveats