Subnets and exit nodes
Understand exit nodes
Compare an ordinary overlay path with an exit node that routes public Internet traffic through another tailnet device.
8 minute lesson
Tailscale normally routes only tailnet and approved subnet destinations. Your ordinary Internet traffic keeps using the local connection.
That default is worth appreciating. The tailnet is an overlay for private traffic, not a middleman for everything. Browsing, streaming, and system updates never touch it.
An exit node changes that deal.
What an exit node does
An exit node advertises the IPv4 and IPv6 default routes. A client explicitly chooses that node, then sends Internet traffic through it. All of it: every website, every API call leaves the Internet from the exit node’s location, encrypted along the way from your device to that node.
Both halves matter. Advertising makes the offer; nothing routes through the node until a client opts in. And the opt-in is per client. Choosing an exit node on your laptop changes nothing for your phone.
You can list what your tailnet offers:
tailscale exit-node listIP HOSTNAME COUNTRY CITY STATUS
100.101.9.23 lab-server Italy Milan -What actually changes
This changes egress location and trust, adds latency, and can affect local-network access.
Websites see the exit node’s public IP. On hostile Wi-Fi, the local network sees only encrypted tunnel traffic. The exit node’s operator and network now sit in your Internet path, so you are moving trust, not removing it. Every packet takes a detour, and a distant exit node adds real milliseconds to everything. Traffic to your local printer or NAS may stop working unless the client explicitly allows LAN access alongside the exit node.
Exit nodes are available on all plans.
When you need one
Good reasons: an untrusted network you want to tunnel out of, or needing to appear from the exit node’s network.
Write down when you need private device access and when you truly need different Internet egress. Do not enable an exit node to solve a DNS-only problem. If names resolve wrong on some network, fix the DNS configuration. Rerouting your entire Internet connection is a heavy tool for a light problem.
Lesson completed