Home Linux Stuff

SYS:ONLINE

Deploying a Secure WireGuard & Tailscale Exit Node on a VPS for Private Mobile Egress

Wes

3 min read

When connecting from coffee shops, airport Wi-Fi, or international hotels, routing your personal mobile and laptop traffic through an encrypted, self-hosted VPN gateway protects against DNS hijacking, local eavesdropping, and untrusted network inspection. By deploying a WireGuard or Tailscale Exit Node on a low-cost cloud VPS (e.g. Oracle Cloud Free Tier, Hetzner, or Linode), you gain a private, dedicated encrypted gateway with zero third-party logging and seamless single-toggle activation on mobile devices.

⚡ Quick Runbook: 60-Second Implementation

Configure a Debian 12 or Ubuntu 24.04 VPS as an authorized Tailscale Exit Node:

# 1. Enable IPv4 and IPv6 packet forwarding in the Linux kernel
sudo tee /etc/sysctl.d/99-tailscale.conf <<'CONFIG'
net.ipv4.ip_forward = 1
net.ipv6.conf.all.forwarding = 1
CONFIG
sudo sysctl -p /etc/sysctl.d/99-tailscale.conf

# 2. Install official Tailscale package
curl -fsSL https://tailscale.com/install.sh | sh

# 3. Configure firewall NAT masquerading via iptables/nftables
DEFAULT_IFACE=$(ip route show default | awk '{print $5}')
sudo iptables -t nat -A POSTROUTING -o "$DEFAULT_IFACE" -j MASQUERADE
sudo ip6tables -t nat -A POSTROUTING -o "$DEFAULT_IFACE" -j MASQUERADE

# Persist firewall rules across reboots
sudo apt-get install -y iptables-persistent
sudo netfilter-persistent save

# 4. Authenticate and advertise node as an exit node
sudo tailscale up --advertise-exit-node --ssh

Architecture & Routing Topology

When operating as an Exit Node, the VPS acts as an encrypted router for authenticated mesh devices:

  • Client Encrypted Tunnel: Your mobile phone or laptop establishes an authenticated, end-to-end encrypted WireGuard tunnel to the VPS IP.
  • Kernel Routing: The VPS receives the decapsulated packets over the tailscale0 virtual interface, consults its internal routing table, and forwards them to its physical network adapter.
  • NAT Masquerade: Outbound packets undergo Network Address Translation (NAT), exiting to the public internet using the VPS public IP address.
  • Split vs Full Tunnel: Clients can toggle the exit node on-demand in the Tailscale mobile app, choosing between accessing local LAN services only (split tunnel) or routing 100% of internet traffic through the VPS (full tunnel).

Authorizing the Exit Node in Tailscale Admin Console

After advertising the exit node capability from the command line, complete authorization in the central console:

  1. Navigate to the Tailscale Admin Console → Machines.
  2. Locate your VPS instance in the machine list.
  3. Click the … (Options) menu and select Edit route settings.
  4. Enable the checkbox for Use as exit node.

Client-Side Verification

Verify that your client device routes all traffic through the VPS exit node:

# On a Linux client:
tailscale set --exit-node=<vps-hostname>

# Verify outbound public IP matches the VPS public IP
curl -s https://ifconfig.me
# Expected: Returns the cloud VPS public IP address, not your local ISP IP.

# Check DNS resolution
curl -s https://cloudflare.com/cdn-cgi/trace | grep ip

Related Runbooks in This Series

Tags:

← Previous:
Next: →