I would really really really like to have one device on my tailnet as the exitnode for all other devices on the tailnet. However, most VPNs make this really difficult. Is there any way to do this? I’ve read it’s possible with split-tunnelling, but ProtonVPN (which I use) doesn’t support that. I just installed Alpine Linux on my RPI 4b. And would like to use this as my exit node. Does anyone have any tips for how this could be done?
With Tailscale you have only to declare this device as exit node. It’s just one single command, pretty simple
Edit:
Here’s how: https://tailscale.com/kb/1103/exit-nodes/#step-2-advertise-a-device-as-an-exit-node
Right that is pretty much clear, but I want this exit node to be running ProtonVPN as well. This however does not seem to be possible (to my knowledge). Edit: This is also why Tailscale added support for Mullvad VPN i assume.
Ok… I think I didn’t get what you’re trying to say. Do you wanna run a VPN through a VPN?
I mean, you have your RPI 4b as a Tailscale exit node, but the RPI 4b itself connects to the ProtonVPN?
Right, so I’ve got Alpine on the RPI, and have installed/configured protonvpn with wireguard. However, if I then start Tailscale, the already running ProtonVPN connection goes down. Same happens if Tailscale is already running, and I try to start the ProtonVPN connection it will just refuse the connection.
I want it to connect to both services, as then this can act as the exitnode for all other devices on the tailnet. Whilst also giving the benefit of ““being in a different location”” with protonvpn.
So essentially, both services wants to use /dev/net/tun, but only one can.
Yes you can do this, you can use ANY device/node as an exit-node among your tailscale nodes.
You do need a server to setup the nodes though. Tailscale offer this as a paid service I believe, or you could run your own headscale (open source project) server yourself, this requires a lot more knowledge
I’ve read some of the comments and it sounds like you’ve already tried installing proton VPN and tailscale on the same machine, but depending on your setup maybe you could make a “VPN gateway”
Like take your pi, install protonvpn, then enable IP forwarding and use a little nat IP tables script to nat your lan to your proton VPN interface like a home router would with the wan and lan ports.
Then on your tailscale gateway set the default route to be that box instead of your normal router. Then just use the tailscale node as the exit node on your client and check your IP.
In theory this would be similar to a qubes type setup which is what I tend to use for this kind of work.
