Mullvad Exit Nodes
Mullvad Exit Nodes allow you to use Mullvad VPN endpoints as exit nodes for your tailnet.
Enabling Mullvad Exit Nodes
You need to be an Owner, Admin, or Network admin of a tailnet in order to enable Mullvad Exit Nodes.
- Open the General settings page of the admin console.
- If Mullvad VPN is not already enabled, click the toggle.
Turning on Mullvad Exit Nodes in ACLs
Add a node attributes entry in your tailnet policy file, with
an attr
value of "mullvad"
. For example, in a small tailnet, you could allow all users in the
tailnet (autogroup:members
) to use Mullvad exit nodes:
"nodeAttrs": [
{
"target": ["autogroup:members"],
"attr": ["mullvad"],
},
],
Adjust the values assigned to "target"
if you don’t want all users to use Mullvad exit nodes.
Using Mullvad Exit Nodes
After you enable Mullvad Exit Nodes, and turn on Mullvad Exit Nodes in your tailnet policy file, you can use the exit nodes from devices in your tailnet. Each device must enable an exit node separately.
Instructions differ depending on the client OS:
Android
You can use an exit node from the
menu in the top-right of the screen.
From this menu, select Use exit node and then choose the Mullvad exit node you’d like to use. If you want to allow direct access to your local network when traffic is routed via an exit node, select Allow LAN access. You can also select None to disable use of an exit node.
iOS
You can use an exit node from the
menu in the top-right of the screen.
From this menu, select Use exit node and then choose the Mullvad exit node you’d like to use. You can also select None to disable use of an exit node.
Linux
Re-run tailscale up
with the --exit-node=
flag, passing the IP address of the
Mullvad exit node. If MagicDNS is enabled, you can instead pass in the name of
the Mullvad exit node.
sudo tailscale up --exit-node=<exit-node-name-or-ip>
You can find the exit node’s IP address (and name if MagicDNS is enabled) by running
tailscale status
.
Optionally, set --exit-node-allow-lan-access
to true
to allow direct access to your local network
when traffic is routed via an exit node.
sudo tailscale up --exit-node=<exit-node-name-or-ip> --exit-node-allow-lan-access=true
macOS
You can use an exit node from the menu bar. Open the Tailscale menu and navigate to Use exit node. From here you can select the Mullvad exit node device you’d like to use by its machine name.
If you want to allow direct access to your local network when traffic is routed via an exit node, select Allow local network access.
Windows
You can use an exit node from the system tray menu. Click on the Tailscale icon and navigate to Use exit node. From here you can select the Mullvad exit node device you’d like to use by its machine name.
If you want to allow direct access to your local network when traffic is routed via an exit node, select Allow local network access.
Disabling Mullvad Exit Nodes
You need to be an Owner, Admin, or Network admin of a tailnet in order to disable Mullvad Exit Nodes.
- Open the General settings page of the admin console.
- If Mullvad VPN is not already disabled, click the toggle.