Configure and test an exit node

An exit node needs two things: packet forwarding on the server, and permission to advertise the default routes. Then a client opts in to using it.

The forwarding requirement is the same one a subnet router has. If you completed that lesson on this machine, it is already done. Otherwise, enable IPv4 and IPv6 forwarding through sysctl first, the same way.

Advertise and approve

On the server, advertise exit-node capability:

sudo tailscale set --advertise-exit-node

Then approve it in the admin console. The machine gets an “Exit node” badge once an admin approves it. Until then, clients cannot select it. Same pattern as subnet routes: the server offers, the admin approves, the client chooses.

Select it and measure the change

Record your public IP before and after. This is the proof that the exit node is doing something:

curl -4 https://ifconfig.me
# 93.44.120.15        <- your normal egress
tailscale set --exit-node=lab-server
curl -4 https://ifconfig.me
# 203.0.113.40        <- the exit node's public IP

The egress address changed. Your Internet traffic now leaves from the server’s network. Every website you open sees 203.0.113.40.

Now test local LAN access. By default, using an exit node cuts you off from your local network, because “everything” goes through the tunnel. If you still need the printer or the NAS while tunneled, allow LAN access explicitly:

tailscale set --exit-node=lab-server --exit-node-allow-lan-access

Keep the way out ready

Before you rely on this, learn the command that turns it off:

tailscale set --exit-node=

The empty value clears the selection, and ordinary routing returns.

Learn this command before you need it. If the exit node’s connectivity or DNS breaks while it is selected, your whole Internet connection breaks with it. You will be typing this command without a search engine to help you. I keep it in a note on my laptop for exactly that moment.

The full test

Run the full cycle once: verify the egress address changes, test one tailnet destination with tailscale ping lab-server, then disable the exit node and confirm ordinary routing returns with another curl -4 https://ifconfig.me.

The tailnet check in the middle matters. Private connectivity should keep working while the exit node handles public traffic. If it does not, something is wrong with the routes, and you want to know that before you are on hotel Wi-Fi.