Understand exit nodes

By default, Tailscale routes only tailnet destinations and approved subnet routes. Your ordinary Internet traffic keeps using your local connection, exactly as before.

That default is worth appreciating. The tailnet is an overlay for private traffic, not a middleman for everything. Browsing, streaming, and system updates never touch it.

An exit node changes that deal.

What an exit node does

An exit node advertises the IPv4 and IPv6 default routes, meaning “send me everything”. A client explicitly chooses that node, then sends its Internet traffic through it. All of it: every website, every API call leaves the Internet from the exit node’s location, encrypted along the way from your device to that node.

Both halves matter. Advertising makes the offer. Nothing routes through the node until a client opts in. And the opt-in is per client: choosing an exit node on your laptop changes nothing for your phone.

You can list what your tailnet offers:

tailscale exit-node list

IP             HOSTNAME     COUNTRY   CITY      STATUS
100.101.9.23   lab-server   Italy     Milan     -

The STATUS column shows - because no exit node is selected on this device yet.

What actually changes

Four things change when you select an exit node: your egress location, who you trust, your latency, and your local network access.

Websites see the exit node’s public IP. On hostile Wi-Fi, the local network sees only encrypted tunnel traffic. Good.

The exit node’s operator and network now sit in your Internet path. You are moving trust, not removing it. If the exit node is your own server, fine. If it is someone else’s, think about it.

Every packet takes a detour, and a distant exit node adds real milliseconds to everything. Milan to Milan is fine. Tokyo to Milan and back is not.

And traffic to your local printer or NAS may stop working, unless the client explicitly allows LAN access alongside the exit node. We handle that in the next lesson.

Exit nodes are available on all plans.

When you need one

Two good reasons: you are on an untrusted network and want to tunnel out of it, or you need to appear from the exit node’s network.

Write down when you need private device access and when you truly need different Internet egress. They are different needs. Most of the time you want the first one, and a plain tailnet already gives it to you.

Do not enable an exit node to solve a DNS-only problem. If names resolve wrong on some network, fix the DNS configuration. Rerouting your entire Internet connection is a heavy tool for a light problem.