Learn Tailscale - Exit Nodes & Subnet Routers

#Introduction

Up to episode 8, all traffic between nodes flows inside the tailnet. But two needs come up often: you want the internet to exit through a different path (for example through an overseas VPS), and you want to reach devices that can't install Tailscale (printers, CCTV cameras, old machines on a home LAN). These two features are what we cover now: exit nodes and subnet routers.

Episode 9 covers how they work, their setup, and their use cases. After this episode, you'll be able to turn an ordinary node into a powerful network gateway.

#Exit Node

#Exit Node Concept

An exit node is a Tailscale node used to forward all traffic out to the internet. When you select an exit node, traffic from your device (for example a laptop) is routed to that node, then exits to the internet from there. The benefits:

• Privacy: the internet sees the exit node's IP address, not your local IP.
• Bypass geo-restrictions: pick a VPS in a specific region to access region-locked content.
• Secure connection on public networks: all traffic stays encrypted until the exit node.

#Exit Node Setup on the Server

On the server side, advertise the exit node capability:

sudo tailscale up --advertise-exit-node

The sudo tailscale up --advertise-exit-node command tells the control plane that this node is willing to be an exit node. On tailnets with strict approval, an admin needs to approve it in the admin console.

#Using an Exit Node on the Client

On the client side, select the exit node:

sudo tailscale set --exit-node=vps-singapore
tailscale status

To see the list of available exit nodes:

tailscale exit-node list

The output of tailscale exit-node list shows all nodes advertising --advertise-exit-node. To disable it, reset it to empty: sudo tailscale set --exit-node=.

#Subnet Router

#Subnet Router Concept

A subnet router is a node that bridges a local network into the tailnet. This node advertises its subnet (for example 192.168.1.0/24), and other tailnet nodes with --accept-routes enabled can directly access devices on that subnet — as if they were on the same LAN. This is useful for reaching devices that can't install Tailscale.

#Subnet Router Setup

On a node connected to the LAN (usually a router, Raspberry Pi, or home server):

sudo tailscale up --advertise-routes=192.168.1.0/24

If it's already active, use tailscale set:

sudo tailscale set --advertise-routes=192.168.1.0/24

The sudo tailscale set --advertise-routes=192.168.1.0/24 command advertises that subnet to the whole tailnet. In the admin console, you'll need to approve newly advertised routes.

#Enabling Accept Routes on the Client

On client devices, accept the advertised routes:

sudo tailscale set --accept-routes=true

After that, you can access LAN devices from the client:

ping 192.168.1.50
ssh devnull@192.168.1.20

Other nodes without --accept-routes enabled won't be able to reach that subnet — a flexible per-device setting.

#Correct Routing Practices

#IP Forwarding and Firewall

For a subnet router to work, the operating system must forward packets. On Linux:

sudo sysctl -w net.ipv4.ip_forward=1
sudo sysctl -w net.ipv6.conf.all.forwarding=1

And make sure the firewall isn't blocking forwarding between interfaces. This step is the most commonly forgotten one when a subnet router isn't working.

#Verifying the Path

Test from the client once everything is active:

tailscale ping 192.168.1.20
ping 192.168.1.50

tailscale ping 192.168.1.20 verifies that the route was accepted and that packets reach the device on the subnet.

#Summary

Exit nodes and subnet routers are two features that turn Tailscale from just a VPN into a flexible network: internet can exit through a node of your choosing, and local networks can connect to the tailnet without installing anything on every device.

#Closing

Episode 9 completed your routing capabilities: exit nodes for controlling outbound internet access and subnet routers for bringing a local LAN into the tailnet.

Key takeaways:

• An exit node forwards all traffic to the internet through a single node.
• Exit node setup: --advertise-exit-node on the server, --exit-node= on the client.
• tailscale exit-node list shows the available options.
• A subnet router advertises a LAN with --advertise-routes.
• Clients must enable --accept-routes=true to use those routes.
• Don't forget to enable IP forwarding on the subnet router system.

In the next episode, episode 10, we'll cover MagicDNS and DNS management in depth — automatic hostname resolution, the .ts.net DNS search domain, internal HTTPS access via MagicDNS, plus custom DNS nameserver configuration and split DNS for internal domains.