Exit Node

Exit Node

Two separate modes; they cannot be used together.

Use another node as exit (for AP clients)

Tailscale page → Exit node: pick a tailnet exit node. Public traffic from devices on the gateway's access point goes through it. If the exit node becomes unreachable the path fails closed instead of leaking to the local Internet. LAN bypass keeps private (RFC 1918) destinations local.

Offer this gateway as an exit node

Tailscale page → Advertise this ESP32 as an exit node (opt-in), restart, then approve it in the admin console or on Headscale. IPv4 Internet traffic is masqueraded through the uplink; native clients also discover the exit-node DNS service.

Cautions

• Everything a client sends goes through your uplink and your ISP.
• The ESP32's throughput is modest; only IPv4 egress is provided.
• Status, MQTT and Home Assistant report the runtime state, not controller approval or verified Internet egress.

Full guide: EXIT-NODE.md.