Tailscale VPN Configuration Including Exit Node in 5 Minutes

Here’s a general topology diagram for Tailscale:

• Nodes (Devices): Show different devices like laptops, servers, cloud VMs, and mobile phones connected via Tailscale.
• Tailscale Coordination Server: Represent the central Tailscale coordination server, which helps establish peer-to-peer connections.
• Peer-to-Peer Mesh: Indicate direct encrypted communication between devices (e.g., through WireGuard) without traffic passing through a central server.
• Exit Nodes & Subnet Routers: Optionally show an exit node for internet traffic and a subnet router for accessing a private network.

root@ubuntu-tailscale-exit-node:~# tailscale ip -4 100.104.248.81 root@ubuntu-tailscale-exit-node:~# 

Configure Exit Node for your Tailscale VPN Network

The exit node feature lets you route all traffic through a specific device on your Tailscale network (known as a tailnet). The device routing your traffic is called an exit node. There are many ways to use exit nodes in a tailnet. For example, you can:

• Route all non-Tailscale traffic through an exit node.
• Use suggested exit nodes to automatically use the best exit node based on client information, such as location and latency.
• Force devices to use an exit node based on system policies, which you can deploy using mobile device management (MDM) solutions.

For security purposes, you must opt in to exit node functionality. For example:

• Every device must explicitly opt in to using an exit node.
• A device must advertise itself as an exit node.
• An Owner, Admin, or Network admin must allow a device to be an exit node for the tailnet.

1 Understand the prerequisites.

If your tailnet is using the default ACL, users of your tailnet already have access to any exit nodes that you configure.

2 Configure a device to act as an exit node.

• Install the Tailscale client.
• Download and install Tailscale onto the Linux device you plan to use as an exit node.
• Advertise the device as an exit node

• Warning: IP forwarding is disabled, subnet routing/exit nodes will not work.

  See https://tailscale.com/s/ip-forwarding

• Warning: UDP GRO forwarding is suboptimally configured on ens4, UDP forwarding throughput capability will increase with a configuration change.

  See https://tailscale.com/s/ethtool-config-udp-gro

• From the device you plan to use as an exit node, use the --advertise-exit-node flag when you run tailscale set or tailscale up:

  sudo tailscale up --advertise-exit-node 

  If you pass the --advertise-exit-node flag to the tailscale set command, you must run tailscale up afterward.

  sudo tailscale set --advertise-exit-node sudo tailscale up

3 Allow the exit node from the admin console.

• Approve it from console
  

• 

The machine is set as Exit node now.

4 Configure other devices to use the exit node.

• Use the exit node.

• Run tailscale set with the --exit-node= flag, passing the Tailscale IP address of the exit node.

  sudo tailscale set --exit-node=<exit-node-ip> 

  You can find the IP address for the device from the admin console or by running tailscale status.

  Alternatively, set --exit-node-allow-lan-access to true to allow direct access to your local network when routing traffic through an exit node.

  sudo tailscale set --exit-node=<exit-node-ip> --exit-node-allow-lan-access=true 

  To stop using an exit node, run the --exit-node flag without passing in an IP address.

  sudo tailscale up --exit-node=

Example in linux:

• sudo tailscale set --exit-node=100.104.248.81

Enable exit node for your windows client

Use Case: Webvm

Once connected , you will see an ip address has been assigned to the vm. 

Videos