← All Articles
#networking#tailscale

Tailscale Exit Node: Route All Traffic Through Your Homelab

Configure a Proxmox LXC container as a Tailscale exit node so all your device traffic routes through your home network — including split tunneling, subnet routing, and the MagicDNS settings that make it seamless.

Josh Hall··6 min read

The Tailscale subnet router post covers accessing your homelab from anywhere. This post goes further: configuring a Tailscale exit node so that all internet-bound traffic from your phone, laptop, or tablet routes through your home connection.

Use cases:

  • Access geo-restricted content as if you’re at home
  • Browse with your home ISP’s IP address on public WiFi
  • Route traffic through your home Pi-hole or AdGuard for ad blocking on the road
  • Keep IoT device traffic off public networks

Exit node vs. subnet router

Both run on the same Tailscale node. The distinction is in how devices use the node:

Feature Subnet router Exit node
What it does Exposes a LAN subnet to Tailscale peers Routes all internet traffic through the node
DNS Optional, per-subnet Routes all DNS too (via MagicDNS)
Activated by Auto for subnet peers User must explicitly select exit node
Split tunnel N/A Optional — exclude some traffic

A single LXC container can be both simultaneously.

Architecture

Your PhonePublic WiFiexit node: ONCT 112 · LXCTailscale exit node10.0.0.80InternetExits via yourhome ISP IPTailscaleHome LAN192.168.1.0/24 · NAT via router

Task 1: Create the exit node container

1Create CT 112 for the Tailscale exit node5 min
Field Value
VMID 112
Hostname tailscale-exit
OS Ubuntu 24.04 LXC (unprivileged)
IP 10.0.0.80 (static)
Cores 1
RAM 256 MB
Disk 2 GB
2Enable TUN device access for the LXC container3 min

Tailscale requires access to the /dev/tun device. For an unprivileged container, add this to the container config on the Proxmox host:

pvelab04 host — enable TUN for CT 112

echo "lxc.cgroup2.devices.allow: c 10:200 rwm" >> /etc/pve/lxc/112.conf
echo "lxc.mount.entry: /dev/net/tun dev/net/tun none bind,create=file" >> /etc/pve/lxc/112.conf

Alternatively, set this in the UI: CT 112 → Options → Features → TUN device: Yes.

Then restart CT 112.

Task 2: Install Tailscale and advertise as exit node

1Install Tailscale inside CT 1125 min
Inside CT 112 — install Tailscale

curl -fsSL https://tailscale.com/install.sh | sh
2Enable IP forwarding2 min

Exit nodes must forward packets. Enable IP forwarding in the container:

Inside CT 112 — enable IP forwarding

echo 'net.ipv4.ip_forward = 1' >> /etc/sysctl.d/99-tailscale.conf
echo 'net.ipv6.conf.all.forwarding = 1' >> /etc/sysctl.d/99-tailscale.conf
sysctl -p /etc/sysctl.d/99-tailscale.conf
3Authenticate and advertise as exit node3 min
Inside CT 112 — connect to Tailscale as exit node

tailscale up --advertise-exit-node --advertise-routes=10.0.0.0/24 --accept-routes

This command:

  • --advertise-exit-node — tells Tailscale this node can route all internet traffic
  • --advertise-routes=10.0.0.0/24 — also exposes your lab LAN (combines subnet router and exit node)
  • --accept-routes — allows the node to use routes from other Tailscale nodes

Copy the auth URL that appears and open it in your browser to authenticate.

Task 3: Approve the exit node in the Tailscale admin console

1Approve the exit node and subnet route3 min

In the Tailscale admin console:

  1. Find the tailscale-exit machine
  2. Click … → Edit route settings
  3. Enable Use as exit node
  4. Enable the subnet route 10.0.0.0/24
  5. Click Save
Note

Tailscale requires admin approval for exit nodes as a security measure — a rogue device can’t silently become an exit node for your tailnet.

Task 4: Use the exit node on your devices

1Enable exit node on iOS2 min

In the Tailscale iOS app:

  1. Tap the Tailscale toggle to connect
  2. Tap the arrow next to your network name
  3. Tap Exit Node
  4. Select tailscale-exit

All internet traffic now routes through your home connection. Verify at whatismyip.com — it should show your home ISP’s IP.

2Enable exit node on Linux/Mac2 min
Select exit node on a Linux or Mac client

# List available exit nodes
tailscale exit-node list

# Use your homelab exit node
sudo tailscale set --exit-node=tailscale-exit

# Verify it's routing (should show your home IP)
curl https://ipinfo.io/ip
3Enable split tunneling (exclude some traffic)3 min

If you want most traffic to go through the exit node but want some subnets to bypass it (e.g., for performance when accessing cloud services):

Linux client — allow LAN bypass while using exit node

sudo tailscale set --exit-node=tailscale-exit --exit-node-allow-lan-access

With --exit-node-allow-lan-access, traffic to your local LAN subnet still goes directly — only internet-bound traffic routes through the exit node. This prevents issues like smart home devices becoming unreachable when the exit node is active.

Task 5: Verify exit node is routing correctly

1Check routing from the exit node container2 min
Inside CT 112 — verify forwarding and routes

# Should show nat rules for forwarding
iptables -t nat -L POSTROUTING -v

# Tailscale status
tailscale status

# Should show this node as exit node
tailscale netcheck

Combining with Pi-hole for ad blocking on the road

If you run Pi-hole on your LAN (or in another LXC container), you can route DNS through it while using the exit node:

In Tailscale admin console → DNS → Add nameserver: enter your Pi-hole’s Tailscale IP.

Enable Override local DNS. Now all DNS queries from exit-node-connected devices resolve through Pi-hole — ads and trackers are blocked on mobile data and public WiFi, not just at home.

Troubleshooting

Common exit node diagnostics

# Check if forwarding is enabled
cat /proc/sys/net/ipv4/ip_forward   # should be 1

# Check Tailscale logs
journalctl -u tailscaled -f

# Verify the node is advertised as exit
tailscale status --json | python3 -c "import sys,json; d=json.load(sys.stdin); print(d['Self']['ExitNodeOption'])"

# From a client, confirm traffic is routing through the exit node
traceroute 8.8.8.8   # first hop should be through Tailscale