The Tailscale feature I under-used for two years: exit nodes.

For two years my use of Tailscale was boring and correct: SSH to the homelab, the odd database UI, reachability when the laptop left the building. The tailnet was a door into my machines. Then I spent a week working from hotel and conference Wi-Fi, remembered that exit nodes exist, and turned the direction around — instead of me reaching in, all of the laptop’s traffic now leaves through a machine I own. Same software, same tailnet, completely different job.

What an exit node is

A subnet router advertises specific routes — “these CIDRs live behind me”. An exit node advertises the default route: “the whole internet can leave through me”. Any device on the tailnet can point its traffic at it, per device, on demand. The two features get confused constantly; the one-line summary is that a subnet router answers “which networks can I reach?” and an exit node answers “where does my traffic come out?” — and one node can do both.

The setup, ten minutes

On the Linux box you want to exit through — the homelab, a VM on it, a small VPS:

# let the box forward packets
echo 'net.ipv4.ip_forward = 1' | sudo tee /etc/sysctl.d/99-tailscale.conf
echo 'net.ipv6.conf.all.forwarding = 1' | sudo tee -a /etc/sysctl.d/99-tailscale.conf
sudo sysctl -p /etc/sysctl.d/99-tailscale.conf

# advertise it
sudo tailscale up --advertise-exit-node

Approve the node as an exit node in the admin console (or pre-approve it with an ACL rule). Then, on any device that needs it:

sudo tailscale up --exit-node=homelab --allow-lan-access

--allow-lan-access keeps the local network — the hotel printer, the conference projector — reachable directly instead of tunnelling to another country to reach a device in the room. There is a toggle in the GUI clients for the same thing.

What it is for

• Untrusted networks. Hotel, café, airport, that conference SSID with the captive portal and the optimistic privacy policy. Your traffic leaves encrypted at the edge of a network you control.
• A consistent egress IP. Services that flag logins from new countries stop flagging when every login comes from the same box at home.
• The hardware-averse option. Tailscale resells Mullvad-hosted exit nodes as a paid add-on — region-picked, no hardware, no maintenance. A few dollars a month per location; check current pricing before you plan a fleet around it.

The honest trade-offs

• It is a single point of failure with a specific failure mode: the exit node reboots, and your laptop has no internet until you notice and unset it. The GUI clients make switching fast, but the first time it happens mid-video-call you will feel it.
• Throughput is the box plus its uplink, with encryption on top. A Raspberry Pi will disappoint on a fast line; use hardware that can cipher at your bandwidth, or accept the ceiling.
• Datacenter egress attracts friction. Captchas multiply, and streaming services treat a VPS address in another country exactly the way you would expect. A home connection behaves better precisely because it looks ordinary.
• Latency becomes the round trip to the node. Exiting through the homelab from a conference in another continent is privacy at the price of geography.
• DNS follows the exit node, so geo-fenced anything will notice the change. Usually the point. Occasionally, surprise.

Where I landed

The homelab does the job for free on hardware that was already running, and the travel laptop now has a two-click switch between “trust nothing, tunnel everything” and “this network is fine”. If I had no always-on box, the Mullvad option would be the honest alternative to half-remembering to turn a VPN app on. The feature was there the whole time, one flag deep in the same binary I was already running — the VPN you forget about turns out to have a setting worth remembering.