Configure and test an exit node

The exit node needs packet forwarding and permission to advertise default routes. The client then opts into using it.

The forwarding requirement is the same one a subnet router has. If you completed that lesson on this machine, it is already done. Otherwise enable IPv4 and IPv6 forwarding through sysctl first.

Advertise and approve

Advertise exit-node capability on the server, approve it in the admin console, and select it on the laptop:

sudo tailscale set --advertise-exit-node

The machine gets an “Exit node” badge in the console once an admin approves it. Until then, clients cannot select it.

Select it and measure the change

Record the public IP before and after:

curl -4 https://ifconfig.me
# 93.44.120.15        <- your normal egress
tailscale set --exit-node=lab-server
curl -4 https://ifconfig.me
# 203.0.113.40        <- the exit node's public IP

The egress address changed. Your Internet traffic now leaves from the server’s network.

Test whether local LAN access is allowed. By default, using an exit node cuts you off from your local network. If you still need the printer or NAS while tunneled:

tailscale set --exit-node=lab-server --exit-node-allow-lan-access

Keep the way out ready

Keep a command ready to stop using the node if routing or DNS fails:

tailscale set --exit-node=

The empty value clears the selection and ordinary routing returns. Learn this command before you need it. If the exit node’s connectivity or DNS breaks while selected, your whole Internet connection breaks with it, and you will be typing this without a search engine to help.

Verify the egress address changes, test one tailnet destination, then disable the exit node and confirm ordinary routing returns. The tailnet check matters: private connectivity should keep working while the exit node handles public traffic.