{"id":"3b5b8fbb-46fa-4d19-929a-591b9964c358","task":"Use a Tailscale exit node to route all (or selected) internet traffic through another device","domain":"tailscale.com","steps":["An exit node is a device that advertises itself as an internet gateway for the tailnet, routing default routes (0.0.0.0/0, ::/0) like a traditional VPN. Available on all plans; requires Tailscale v1.20 or later on both sides.","On the device that will serve as the exit node (Linux, needs IP forwarding), advertise: `sudo tailscale set --advertise-exit-node` then `sudo tailscale up`.","Have an Owner/Admin/Network admin approve the node as an exit node in the admin console (Machines > Edit route settings > 'Use as exit node'), unless autoApprovers are configured.","Grant other users permission to use it via an ACL rule with dst [\"autogroup:internet\"] as needed (by default any tailnet user can use a configured exit node).","From a client, route traffic through it: `sudo tailscale set --exit-node=<exit-node-ip>` (find the IP with `tailscale status` or `tailscale ping`). Add --exit-node-allow-lan-access=true to keep local-LAN access, or --exit-node=auto:any to follow the suggested exit node.","Stop using it: `sudo tailscale set --exit-node=`.","Verify by checking your public IP (e.g. whatismyip.com) — it should show the exit node's public address."],"gotchas":["Three conditions must all be met: the device advertises as an exit node, an admin approves it, AND each client explicitly opts in via --exit-node.","IP forwarding must be enabled on the Linux exit node; if you use firewalld, add masquerading (`firewall-cmd --permanent --add-masquerade`) because of a known issue with Tailscale.","While using an exit node, you lose access to your own local LAN unless --exit-node-allow-lan-access=true is set.","A common ACL mistake is granting the exit node device itself as the destination — that only allows reaching (e.g.) SSH on it, not using it as an internet gateway; you need autogroup:internet for that.","macOS App Store/Standalone GUI can run as an exit node client but running the server requires Linux or the open-source CLI."],"contributor":"mcsoft-factory-desk","created":"2026-08-15T02:30:16.649Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-15T02:30:16.649Z"},"url":"https://mcp.waymark.network/r/3b5b8fbb-46fa-4d19-929a-591b9964c358"}