Tailscale Exit Node Setup

This utility provides an interactive script to install and configure Tailscale as an exit node on a Debian-based system. It also installs and configures ufw (Uncomplicated Firewall) to secure the machine.

The script will install Tailscale, prompt you to authenticate, and then configure it as an exit node. It will also set up firewall rules and apply network optimizations to ensure reliable and performant operation, including support for Tailscale's Peer Relay and DERP fallback mechanisms.

How the Script Works: A Detailed Breakdown

The installation script is designed to be safe and transparent. Here is a step-by-step explanation of what it does:

Step 1: System Preparation

Root Check: Ensures the script is run with sudo, as it needs administrative privileges to install software and modify system settings.
Error Handling: Uses set -e to ensure the script will exit immediately if any command fails, preventing partial or broken installations.

Step 2: Tailscale Repository and Package Installation

Installs Tailscale: The script uses Tailscale's official install.sh script, which handles adding the repository and installing the package. This is the standard method for installing Tailscale on Debian/Ubuntu and ensures you receive trusted updates. Learn more.
Installs Dependencies:
- ufw: The "Uncomplicated Firewall" used to secure the server. Learn more.
- unattended-upgrades: Enables the system to automatically install security updates, keeping it secure over time. Learn more.
- qrencode: A tool to generate a QR code from the authentication URL, making it easy to log in from a mobile device.
- ethtool: A utility for querying and controlling network device driver and hardware settings. It's used to apply advanced performance optimizations.

Step 3: Automatic Security Updates for Tailscale

The script creates a configuration file that allows unattended-upgrades to automatically update the Tailscale package itself, ensuring your exit node always has the latest features and security patches.

Step 4: Network Performance and Forwarding

Enables IP Forwarding: It sets net.ipv4.ip_forward = 1 and net.ipv6.conf.all.forwarding = 1. This is a critical step that allows the Linux kernel to forward network packets from one interface to another, which is the fundamental requirement for an exit node or any router.
Optimizes Network Performance: The script enables modern algorithms to reduce latency and fight bufferbloat. It automatically uses BBRv2 if your kernel supports it (v5.18+), otherwise it falls back to the original BBR. It also enables the Cake packet scheduler (net.core.default_qdisc = cake), a "batteries-included" algorithm that is highly effective at managing network queues. This combination maximizes throughput and keeps latency low, even on congested networks.
Applies UDP GRO Forwarding Optimizations: For systems with Linux kernel 6.2 or newer, the script uses ethtool to enable rx-udp-gro-forwarding. This offloads part of the UDP packet processing to the network card, significantly improving throughput for exit nodes and subnet routers. The script also attempts to make this setting persistent across reboots by creating a script for networkd-dispatcher. Learn more.

Step 5: Peer Relay Configuration

The script interactively prompts you to choose a UDP port for the Peer Relay service. This feature allows the node to help other devices in your tailnet establish connections when they are behind difficult NATs.
It suggests common ports like 443 (often allowed by firewalls) or 3478 (standard STUN/TURN port) and defaults to 443 if you don't enter a value.
For other nodes to use this relay, you must grant them access in your Tailscale ACLs. This rule is not required for this node to connect to Tailscale's global DERP network.

For example, you would add a grant to your ACL policy. In this example, devices tagged us-east-relays (like this exit node) can act as relays for devices tagged us-east-vpc:
```
{
  "grants": [
    {
      "src": ["tag:us-east-vpc"], // Devices that can be accessed through the peer relay
      "dst": ["tag:us-east-relays"], // Devices functioning as peer relays for the src devices
      "app": {
        "tailscale.com/cap/relay": [] // The relay capability doesn't require any parameters
      }
    }
  ]
}
```
Learn more.

Step 6: Firewall Configuration (UFW)

Resets and Sets Defaults: The script resets UFW to a clean state, then sets a secure default policy: deny incoming traffic and allow outgoing traffic.
Allows Essential Traffic:
- allow ssh: Ensures you don't get locked out of your server.
- allow 41641/udp: The primary port Tailscale uses for its WireGuard®-based encrypted traffic.
- allow [your-chosen-port]/udp: This rule opens the UDP port you selected in the previous step for the Peer Relay service.

Step 7: Tailscale Configuration and Authentication

Starts Tailscale with Configuration: Runs tailscale up with all necessary flags, including --advertise-exit-node and --relay-server-port=[your-chosen-port], to bring the service online and configure it in a single step.
Displays Auth URL and QR Code: The script extracts the authentication URL from the output and displays it both as text and as a QR code, giving you an easy way to log in and authorize the new exit node on your tailnet.
Waits for Authentication: The script pauses and waits for you to complete the browser authentication before proceeding to the final steps.

Recommended VPS Providers

Looking for a reliable and affordable server to run your Tailscale exit node? Here are a few providers I recommend. These are affiliate links, which means I may earn a commission if you sign up through them, at no extra cost to you.

Catalysthost - Recommended for their Dallas, TX location.
ServerPoint - Great for a Bay Area, CA presence.
Vultr - Excellent global coverage, including harder-to-find locations like Hawaii.

Automated Installation

To install, run the following command in your terminal. This will download the script and execute it in a way that allows for user interaction during the setup process.

Using curl:

sudo bash -c "$(curl -sL https://random.clusterlabs.dev/scripts/tailscale-exit/install.sh)"

Using wget:

sudo bash -c "$(wget -qO- https://random.clusterlabs.dev/scripts/tailscale-exit/install.sh)"

Download install.sh

Installation Script Content:

Automated Uninstallation

To remove the configuration, run the corresponding command below. This will download the uninstallation script and pipe it to bash with sudo, which will remove Tailscale and the firewall rules.

Using curl:

curl -sL https://random.clusterlabs.dev/scripts/tailscale-exit/uninstall.sh | sudo bash

Using wget:

wget -qO- https://random.clusterlabs.dev/scripts/tailscale-exit/uninstall.sh | sudo bash

Download uninstall.sh

Tailscale Exit Node Setup

How the Script Works: A Detailed Breakdown

Step 1: System Preparation

Step 2: Tailscale Repository and Package Installation

Step 3: Automatic Security Updates for Tailscale

Step 4: Network Performance and Forwarding

Step 5: Peer Relay Configuration

Step 6: Firewall Configuration (UFW)

Step 7: Tailscale Configuration and Authentication

Recommended VPS Providers

Automated Installation

Using curl:

Using wget:

Installation Script Content:

Automated Uninstallation

Using curl:

Using wget:

Uninstallation Script Content: