Tailscale Exit Nodes: Route Traffic From Home

Hotel wifi asks for a room number and a last name before it lets you online. That's the whole authentication. Every other guest on that network is one ARP request away from your laptop. An exit node fixes this by sending every packet through your own home connection first — the hotel network only ever sees one encrypted WireGuard tunnel, not your actual traffic.

TL;DR

An exit node routes ALL of a device's internet traffic through another device on your tailnet — not just access to your home LAN, which is what a subnet router does.
Setup is two commands: advertise the exit node on the home machine, then point a client at it. No port forwarding, ever.
Exit nodes are included on every Tailscale plan, including the free Personal tier — there's no upsell to unlock this.
Your effective ceiling is your home connection's upload speed, not the coffee shop's download speed.
It beats a commercial VPN on cost and on trusting your own network instead of a third party's; it loses on server locations, since you only get the one exit — home.

What an Exit Node Actually Routes

Our explainer on what Tailscale is covers the mesh side: every device on a tailnet can reach every other device directly, without a central VPN concentrator. An exit node is a specific, opt-in mode on top of that mesh. A subnet router shares access to a LAN behind one device. An exit node instead sends all of a client's internet-bound traffic — not just tailnet traffic — out through the chosen device, the same job a traditional VPN does.

Note

These are separate features that happen to use the same underlying device in most homelabs. A box can advertise a subnet route, an exit node, or both at once.

Under the hood, that traffic still rides the same WireGuard tunnel our Tailscale vs. WireGuard comparison covers — Tailscale just adds the coordination, NAT traversal, and the exit-node/subnet-router flags on top of raw WireGuard, instead of you hand-writing peer configs.

Setting It Up

On the home machine that will carry the traffic — a Proxmox VM, a Raspberry Pi, whatever is already on 24/7, the same box covered in our Tailscale homelab install walkthrough:

sudo tailscale set --advertise-exit-node

Then approve it once in the admin console (Machines → the device → Edit route settings → Exit node → Use as exit node). Per Tailscale's own exit-node documentation, both the exit node and every connecting device need Tailscale v1.20 or later, and Linux exit nodes need IP forwarding enabled — the same sysctl flag a subnet router needs.

On the client — laptop, phone, doesn't matter:

sudo tailscale up --exit-node=<device-name-or-ip> --exit-node-allow-lan-access

--exit-node-allow-lan-access keeps the client's local network reachable (printer, local NAS) while everything else routes home. Without that flag, the client loses its own LAN the moment the exit node connects.

DNS: The Leak Nobody Notices

Routing traffic through an exit node and leaving DNS alone defeats most of the point — a DNS resolver on the hotel's network, or your ISP's default resolver, still sees every domain you look up, even while your actual traffic is tunneled.

sudo tailscale set --exit-node=<device> --exit-node-allow-lan-access --accept-dns=true

--accept-dns=true (the default when MagicDNS is on) routes DNS queries through the exit node too. Toggle it off and run a DNS leak test from the client — the resolver that answers switches from your home network's to whatever the local wifi hands out. That's the whole test; no special tooling needed beyond a browser.

Warning

Some public wifi networks force DNS through a captive portal at the OS level before Tailscale's tunnel is even up. If a captive portal login page never loads, disconnect the exit node, complete the portal login normally, then reconnect — this is a one-time step per network, not a sign anything is broken.

The Real Ceiling: Your Home Upload Speed

An exit node can only push out as fast as the home connection's upload speed allows, because every byte a phone or laptop downloads on the road first has to travel from the exit node's location back out to the internet. A typical residential fiber or cable plan advertises a fast download number and a much smaller upload number — that upload figure is the actual cap on everything routed through it, in both directions.

Setup	What limits speed	Server locations	Monthly cost
Home Tailscale exit node	Home connection's upload speed	1 (wherever the exit node sits)	$0 extra — it's hardware already running
Commercial VPN (e.g. NordVPN, monthly plan)	Provider's server capacity	Dozens of countries	$14.99/mo on the month-to-month plan, per Security.org's NordVPN pricing breakdown
VPS-hosted Tailscale exit node	The VPS provider's uplink	1 (wherever the VPS is)	Cost of the smallest VPS tier (~$4–6/mo)

That single-location limitation is the real tradeoff, not a marketing footnote: a home exit node makes traffic look like it's coming from your home connection specifically, which is exactly what you want when the goal is "access things as if I were home," and exactly wrong when the goal is picking a different country.

KEY-STAT: $0 — additional cost to add an exit node to a Tailscale account — included on every plan tier including the free Personal plan, per Tailscale's exit node docs

When It's Actually Faster Than It Sounds

Not every connection between two tailnet devices needs Tailscale's relay infrastructure. When a direct path exists, traffic goes device-to-device over WireGuard with no intermediary; when NAT or a firewall blocks that, it falls back to a DERP relay, which adds a hop and caps throughput below what a direct link manages. Third-party testing has shown a Tailscale exit node running on a small cloud VPS pushing 680 Mbps in a direct-path benchmark — nowhere near what most home upload speeds allow, but it shows the tunnel itself isn't the bottleneck; the home connection is.

Tip

If speed matters more than "looks like home," advertising an exit node from a cheap VPS instead of a residential box removes the home-upload ceiling entirely — same setup commands, different hardware.

Auto Exit Nodes vs. Picking One Manually

Paid Tailscale plans (Standard, Premium, Enterprise, or the Mullvad add-on) can auto-select an exit node using live latency and performance data, according to Tailscale's recommended exit nodes documentation. On the free Personal plan this isn't available — with one home exit node in the tailnet anyway, there's nothing to auto-select between. The manual --exit-node= flag is the entire feature at this scale.

When a Home Exit Node Beats a Commercial VPN — and When It Doesn't

It wins on cost (nothing extra, ever) and on trust — traffic exits through your own ISP connection, not a VPN provider's infrastructure with its own logging policy to take on faith. It wins specifically for "I want this device to look like it's at home," which a commercial VPN can't do at all.

It loses on server choice, and on availability: if home internet drops, the exit node drops with it, with no automatic fallback to a second location the way a VPN app just reconnects to another server. For someone who wants a different country's IP, or wants five nines of exit-node uptime, a commercial VPN — or a second exit node on a VPS in a different location — is still the better tool.

FAQ

Does a Tailscale exit node slow down my internet?

It caps you at the exit node's upload speed for outbound data and its download speed for inbound data, whichever end is running the exit node. On a typical home connection, upload is the binding limit, not the tunnel overhead itself.

Is a Tailscale exit node as secure as a VPN?

The tunnel itself uses WireGuard, the same modern protocol many commercial VPNs are built on. The difference is who you're trusting: a home exit node keeps traffic on your own connection, while a commercial VPN routes it through the provider's infrastructure under their logging policy.

Can I use a Tailscale exit node on my phone?

Yes — the Tailscale app on iOS and Android supports connecting to any exit node on your tailnet, including a home device, the same way a laptop client does.

Does an exit node hide my IP address from websites?

Websites see the exit node's IP address instead of the client device's. For a home exit node, that means sites see your home connection's IP — not hidden, but consistently your home location rather than wherever the client physically is.