Tailscale Exit Node: Set One Up in 20 Minutes (and Can You Run Two?)

This guide sets up a Tailscale exit node on a small VPS, for example a Contabo Cloud VPS 4 or a Hetzner CX23 in Germany: a WireGuard-encrypted tunnel you control line by line. It gives the exact commands, not a documentation summary and not blurry screenshots. Latency and throughput depend on your route, so the guide shows how to measure them instead of quoting figures.

If what you need is the reverse, reaching your LAN's devices from outside rather than routing all your traffic through it, that is a different feature: see our guide to the Tailscale subnet router.

Shortcut: our free Tailscale exit node generator builds the exact script for your VPS from a few choices (Tailscale or Headscale, auth key or login URL, tag-based auto-approval, ufw or firewalld) and gives the approval and client commands. This guide explains each step.

What Is a Tailscale Exit Node and Why It Differs from a Classic VPN

A Tailscale exit node is a node in your Tailscale mesh configured to route all Internet traffic from other nodes through its own connection. In practice: you enable this on your Frankfurt VPS, and all your devices (Paris laptop, iPhone, iPad) exit the Internet with that VPS's IP.

The difference from a commercial VPN like NordVPN is architectural:

• Commercial VPN: shared infrastructure between thousands of users. You control nothing - not the server, not the log policy, not the configuration.
• Bare WireGuard self-host: point-to-point tunnel between each client and the server. Great for one tunnel, but with 4 devices you manually manage 4 key pairs.
• Tailscale exit node: automatically managed WireGuard mesh. The Tailscale control plane handles keys, NAT traversal and ACLs. Designate any node as exit node with one command - all other nodes use it without reconfiguration.

Only want to appear from another country, without running a server? A commercial VPN does that with no setup: Proton VPN (affiliate link) has a free plan, and its paid plans let you choose the country. The exit node is the better pick when you want an IP that stays yours and access to your own devices on the same network.

The data plane remains pure WireGuard - no company sees your payload traffic. Only Tailscale Inc. sees your mesh metadata (who talks to whom, when), which is documented in their privacy policy.

For a comprehensive comparison of self-hosting approaches, see our best self-host VPN 2026 article and for the Tailscale vs bare WireGuard deep dive, Tailscale vs WireGuard self-host.

If you are still deciding whether you need Tailscale at all, Tailscale vs WireGuard: what Tailscale adds, what it takes away sets raw WireGuard (keys, routes and NAT managed by you) against Tailscale's managed control plane.

Prerequisites

Before starting, you need:

1. A Tailscale account - Free plan works for 1 exit node. Sign up at tailscale.com.
2. A Linux server - Ubuntu 24.04 LTS recommended (5-year support). Works on Mac or Raspberry Pi too.
3. Stable connection >= 100 Mbps - for solo or family use.
4. Dedicated public IP - included at Contabo and OVH, €0.50/month extra at Hetzner since 2026.
5. Root or sudo access on the server.

This guide assumes Ubuntu 24.04 LTS. Commands are identical on Debian 12, slightly different on CentOS/RHEL (dnf instead of apt).

Choosing Your Exit Node Platform

A sensible default: a VPS in the country you want to appear from, plus a Raspberry Pi 5 at home if you also want your home IP when travelling. Hetzner was the usual pick for the first one, until its 2026 price rises put the CX23 at €5.99 with IPv4 for 4 GB of RAM; Contabo's Cloud VPS 4 now costs about the same for 8 GB, enough to run Headscale or other services on the same box. The trade-off is a 200 Mbit/s port where Hetzner gives you more headroom. The full price history is in our Contabo vs Hetzner vs OVH comparison.

Why a VPS rather than the box at home: an exit node at home only gives you your own ISP's IP, and if your line sits behind carrier-grade NAT every connection goes through a relay. A datacenter VPS has a fixed public IPv4, so Tailscale gets a direct WireGuard path from almost anywhere.

Contabo note: the entry tier advertises a 200 Mbit/s port. That is plenty for one person's browsing and streaming; for a whole family on fibre, measure it with iperf3 (see Performance) before you rely on it.

Step-by-Step Installation on Ubuntu 24.04 LTS

1. Install Tailscale

Tailscale publishes an official installer via their APT repository:

# Add GPG key and repository
curl -fsSL https://pkgs.tailscale.com/stable/ubuntu/noble.noarmor.gpg \
  | sudo tee /usr/share/keyrings/tailscale-archive-keyring.gpg >/dev/null

curl -fsSL https://pkgs.tailscale.com/stable/ubuntu/noble.tailscale-keyring.list \
  | sudo tee /etc/apt/sources.list.d/tailscale.list

# Install
sudo apt-get update
sudo apt-get install -y tailscale

# Verify version (June 2026: v1.68+)
tailscale version

2. Enable IP Forwarding

Without this step, the node cannot route client traffic to the Internet. This is the equivalent of WireGuard masquerade:

echo 'net.ipv4.ip_forward = 1' | sudo tee /etc/sysctl.d/99-tailscale.conf
echo 'net.ipv6.conf.all.forwarding = 1' | sudo tee -a /etc/sysctl.d/99-tailscale.conf
sudo sysctl -p /etc/sysctl.d/99-tailscale.conf

Verify:

sysctl net.ipv4.ip_forward
# Should return: net.ipv4.ip_forward = 1

3. Authenticate and Advertise the Exit Node

sudo tailscale up --advertise-exit-node

Tailscale prints a URL in the terminal:

To authenticate, visit:
  https://login.tailscale.com/a/xxxxxxxxxxxxxxxx

Open this URL in your browser and log in with your Tailscale account. The node appears in your machine list.

Tip: for headless/CI pre-authentication, use an auth key: sudo tailscale up --advertise-exit-node --authkey=tskey-auth-xxxxx.

4. Approve in the Admin Console

By default, Tailscale requires manual approval for exit nodes (security feature). On login.tailscale.com/admin/machines:

1. Find your node (e.g. hetzner-cx23-fra)
2. Click (...) → Edit route settings
3. Check Use as exit node
4. Click Save

The node is now available as an exit node for all members of your tailnet.

Alternative: disable manual approval globally in Admin → Settings → Disable exit node approval requirement. Convenient for a solo personal tailnet.

5. Verify the State

tailscale status
# The node should appear as "offers exit node"

sudo tailscale ping node-name
# Should return an RTT

Client Configuration

macOS

1. Install Tailscale from the Mac App Store or brew install tailscale
2. Launch Tailscale from the menu bar
3. Log in with the same account
4. Click the Tailscale icon → Exit node → select your node
5. Verify: curl ifconfig.me - the IP shown must be the VPS IP

LAN access: by default when an exit node is active, local traffic (192.168.x.x) also goes through the tunnel. To keep direct LAN access: click Tailscale → Allow LAN access.

Windows

1. Download from tailscale.com/download/windows
2. Right-click systray icon → Exit node → select the node
3. Confirm the UAC elevation prompt

iOS and Android

1. Install the Tailscale app from App Store / Play Store
2. Log in to the tailnet
3. Go to Settings (iOS) or gear icon (Android) → Use exit node → select

On iOS, Tailscale integrates via Network Extension - no jailbreak required. The connection survives WiFi/4G transitions.

Linux CLI

# Select the exit node (by name or Tailscale IP)
sudo tailscale set --exit-node=hetzner-cx23-fra

# Or by Tailscale IP (100.x.y.z)
sudo tailscale set --exit-node=100.64.0.1

# Disable
sudo tailscale set --exit-node=

# Check
tailscale status | grep "exit node"

Optimizations and Troubleshooting

Performance: Check Connection Type

Tailscale prefers a direct WireGuard tunnel (NAT traversal). If two nodes cannot see each other directly (strict NAT, CGNAT), traffic goes through a DERP relay - noticeably slower:

tailscale netcheck
# Shows which relay is used and whether direct is possible

tailscale ping node-name
# "pong from ... via DERP(fra)" = relay
# "pong from ... via 1.2.3.4:41641" = direct (preferred)

If you're on relay despite both machines having public IPs, check UFW:

sudo ufw allow 41641/udp comment "Tailscale WireGuard"
sudo ufw allow 3478/udp comment "Tailscale STUN"

DNS Leaks After Enabling Exit Node

Tailscale pushes its own DNS (MagicDNS) but occasionally lets system DNS leak through. Test:

# From the client with exit node active
dig +short whoami.cloudflare.com TXT @1.1.1.1
# The returned IP must be the VPS IP, not your real IP

If your real IP leaks: on macOS, disable and re-enable the exit node. On Linux:

sudo tailscale set --exit-node=hetzner-cx23-fra
sudo resolvectl flush-caches

MTU and Fragmentation

WireGuard reduces the effective MTU by ~60 bytes (tunnel overhead). On some links this causes drops with large packets (video, long SSH sessions). Fix:

# On the exit node server
sudo ip link set tailscale0 mtu 1280
# Make permanent via /etc/systemd/network/ or rc.local script

Kernel Routing: Advanced Performance

On the server, enable BBR congestion control for better throughput:

echo 'net.core.default_qdisc = fq' | sudo tee -a /etc/sysctl.d/99-tailscale.conf
echo 'net.ipv4.tcp_congestion_control = bbr' | sudo tee -a /etc/sysctl.d/99-tailscale.conf
sudo sysctl -p /etc/sysctl.d/99-tailscale.conf

This tuning typically yields a modest throughput gain under load - measure the before/after on your own link to confirm.

Security and Privacy Considerations

What Tailscale Inc. Sees

Tailscale sees control plane metadata only:

• Tailscale IP addresses (100.x.y.z) of your nodes
• Timestamps of WireGuard handshakes
• Machine names registered in your tailnet

Tailscale never sees:

• The content of your traffic (WireGuard end-to-end encrypted)
• Your DNS queries (if MagicDNS disabled and using an external DNS resolver)
• The websites you visit

The data plane is pure WireGuard. The client code is open source.

ACLs on the Free Plan

The Free plan offers basic JSON ACLs to control which nodes can communicate with which others. Minimal example to restrict the exit node to your own devices only:

{
  "acls": [
    {
      "action": "accept",
      "src": ["tag:personal"],
      "dst": ["tag:exit-node:*"]
    }
  ],
  "tagOwners": {
    "tag:exit-node": ["autogroup:admin"],
    "tag:personal": ["autogroup:admin"]
  }
}

DERP Relays: Jurisdiction

When traffic passes through a DERP relay (strict NAT case), it transits through Tailscale's infrastructure. EU relays are in Germany and the Netherlands. If jurisdiction matters, you can deploy your own DERP relay - guide in the official Tailscale docs.

Server-Side Logs

By default Ubuntu generates kernel logs via journald for WireGuard connections. For zero logs:

sudo journalctl --vacuum-time=1s

To go deeper on Tailscale vs self-hosted control plane, see our Tailscale vs Headscale comparison. And for bare WireGuard templates without Tailscale overhead: WireGuard config templates 2026.

Bottom line: a Tailscale exit node on a small VPS (about €5.50/month) gives you a fully self-controlled WireGuard mesh VPN tunnel with no per-gigabyte fees. The Free plan is sufficient for personal or family use: as listed on 7 October 2026, up to 6 users with unlimited user devices. Setup takes 20 minutes - commands are all in this guide.

Related guides

• Tailscale Funnel: the one-word difference that puts your app on the public internet