Tailscale exit node setup generator
Pick your control server, hostname, login method and firewall: the generator writes the full setup script for a Linux VPS, the approval step, an optional auto-approve policy and the commands to use and check the exit node from your devices. Nothing leaves your browser.
Everything is generated in your browser. Nothing is sent or stored. Do not paste a real auth key on any website: keep the placeholder and replace it on the server.
Name shown in the exit node menu of your devices. Lower case, digits and hyphens.
With a tag such as tag:exit, an autoApprovers rule can approve the exit node automatically. Leave empty to approve by hand.
An auth key lets a script or cloud-init log in without a browser. Create it in Settings > Keys (Tailscale) or with headscale preauthkeys create.
The script never enables a firewall. It only adds the rules Tailscale needs to one that is already in use.
- The script stops at tailscale up and prints a login URL: open it in your browser to add the server to your tailnet.
Generated for exit-vps · 5 steps
#!/usr/bin/env bash
set -euo pipefail
# 1. Install Tailscale with the official script
curl -fsSL https://tailscale.com/install.sh | sh
# 2. Enable IP forwarding (required for an exit node)
echo 'net.ipv4.ip_forward = 1' | sudo tee /etc/sysctl.d/99-tailscale.conf
echo 'net.ipv6.conf.all.forwarding = 1' | sudo tee -a /etc/sysctl.d/99-tailscale.conf
sudo sysctl -p /etc/sysctl.d/99-tailscale.conf
# 3. Optional: UDP GRO forwarding for throughput
command -v ethtool >/dev/null || { sudo apt-get install -y ethtool 2>/dev/null || sudo dnf install -y ethtool; }
NETDEVS=$(
(ip -4 -o route get 8.8.8.8; ip -6 -o route get 2001:4860:4860::8888) 2>/dev/null |
awk '{for (i = 1; i < NF; i++) if ($i == "dev") print $(i + 1)}' |
sort -u
)
for NETDEV in $NETDEVS; do
sudo ethtool -K "$NETDEV" rx-udp-gro-forwarding on rx-gro-list off || true
done
# 4. Log in and advertise the exit node
sudo tailscale up \
--advertise-exit-node \
--hostname=exit-vps
# 5. Check: the node is online and forwarding is on (= 1)
tailscale status
sysctl net.ipv4.ip_forward
Approve the exit node
In the admin console, open Machines, open the menu of the node, choose Edit exit node, then tick Use as exit node. Only an admin can do this.
# List the exit nodes this device can use
tailscale exit-node list
# Send all traffic through the exit node
sudo tailscale set --exit-node=exit-vps
# Same, but keep access to the local network
sudo tailscale set --exit-node=exit-vps --exit-node-allow-lan-access=true
# Must print the VPS public IP
curl -4 https://ifconfig.me
# Stop using the exit node
sudo tailscale set --exit-node=
On Windows, macOS, iOS and Android, the Tailscale app lists approved exit nodes in its Exit node menu: pick the hostname above. Allow local network access if you still need your printer or NAS.
An exit node needs a server that stays on
A small VPS gives you a fixed public IP in the country you choose, runs this script as is, and can host Headscale or a WireGuard server on the same machine.
Affiliate link: we may earn a commission at no extra cost to you. The generator stays free and does not depend on it.
What the script does, step by step
An exit node is a device of your tailnet that forwards the internet traffic of your other devices. On Linux it needs three things the default install does not do: IP forwarding enabled in the kernel, the --advertise-exit-node flag, and an approval by an admin of the tailnet. The script handles the first two; the approval is either a click in the Machines page or automatic through a tag and an autoApprovers rule.
The UDP GRO step is an optional throughput tweak documented by Tailscale for exit nodes and subnet routers on Linux kernel 6.2 or later. It does not survive a reboot unless you add it to networkd-dispatcher or NetworkManager, and it fails harmlessly on older kernels, which is why the script ignores its errors.
Several devices can be exit nodes in the same tailnet. Each client picks one at a time: by name, by Tailscale IP, or with --exit-node=auto:any to follow the suggested node. Run the script on every server you want to offer, with a different hostname each time.
Where to run your exit node
The exit node decides which IP websites see. Each option answers a different need.
| Exit node on | IP websites see | Good for | Limit |
|---|---|---|---|
| A VPS | A data-centre IP in the country you pick | Always-on exit, public Wi-Fi, stable IP for allow-lists | Monthly cost; the IP is in your name, not anonymous |
| A home machine or router | Your home IP | Reaching home services, streaming your home catalogue | Depends on home upload speed and power |
| Mullvad add-on | A Mullvad server IP | Many countries, shared IPs | Paid add-on, no control over the server |