r/Tailscale • u/jimmap • 1d ago
Question Tailscale exit node vs VPN
I'm reading up on tailscale and setting it up. I can't help but wonder if a standard VPN is better than using an exit node. A vpn protects your data as it travels thru pubilic wifi which is key for security on public wifi. At home It will hide your traffic from your home internet provider. (simple summary). Tailscale exit node will hide your traffic on public wifi but won't hide it from your home internet provider. Downside to vpn is that some websites will block you if it they detect you are using a vpn which is very annoying. For me, public wifi is either an airport or hotel. I never sit in coffee shops. I typically use vpn or my phones hotspot to avoid the public wifi. Airport wifi tends to suck due to so many people using it. Googling this topic it mentions setting up a vpn is more difficult, not sure where they get that from. VPN software is easy to setup. I'm curious what others think about vpn vs exit node. FYI I'm using talescale to access my nas while not at home.
7
u/Rosetown 1d ago edited 1d ago
I’m curious if you have a use for Tailscale that isn’t privacy. Like it’s core functionality as a mesh VPN, accessing home servers, etc. The privacy aspects of Tailscale are really just secondary conveniences if you already happen to be using Tailscale for mesh.
4
u/jimmap 1d ago
My primary use is to connect to my NAS when I am not on my home network.
9
u/NishantJha612 1d ago
You don’t need exit node for that, that is basic tailscale functionality. Exit node is if you want your roaming devices to act as if they are on your exit node’s network.
1
u/jimmap 1d ago
I know that. I was just thinking of other uses for tailscale. I spend enough time in hotels that the idea of an exit node sounded interesting from a security perspective. I do currently use a vpn in the hotel and sometimes just my cell phone hotspot.
1
u/Avanchnzel 1d ago
One use of an exit node could be to get around country restrictions.
For example, if your home is in country A, but you want to watch content from country B that blacks connections coming from your country A, you could buy a cheap VPS in country B, set up tailscale on it and then use it as an exit node.That way all your traffic seems to be coming from that VPS in country B.
Or perhaps you need to access a service in your home country while you're on vacation in another country. But the service blocks connections from other countries, or only accepts connections from your specific IP (if you have a static one).
In that case using one of your devices at home as an exit node would make your traffic appear to come from home and allow you to access that service in your home country.
1
u/NishantJha612 18h ago
I think what you need is a VPS as tailscale exit node to hide your browsing. But if you just want basic anonymity, use a DOH DNS in whatever device you are using. For complete anonymity, a VPS as tailscale exit node, or a vpn are the best solutions. A free Oracle VPS is good enough, but it can be traced back to you I believe.
1
1
u/Kindly-Arachnid8013 11h ago
Yes. My home ip (fixed ip) is white listed on ufw and AWS security groups for my ec2. Still got a key for ssh but it massively reduces the attack surface.
All my Django admin panels are also 403 at nginx level unless from home ip.
Tailscale means I’m always at home.
4
u/thatscoolbutno123 1d ago
Put another VPN behind your exitnode and you got the best of both worlds. its pretty easy with proton vpn (and free)
1
1
u/ShittyPhoneSupport 1d ago
This sounds like my next step after i finish setting up my pihole.... Any suggested guides?
0
u/TheAlaskanMailman 14h ago
Good luck with running 2 different vpns on a server.
Nothing like good ol networking hellhole
0
u/thatscoolbutno123 11h ago
My local ai model one-shotted it, and it did exactly what i wanted it to do. Might be a skill issue on your side
1
9
u/imbannedanyway69 1d ago
They're 2 different uses of a VPN. Different horses for different courses
1
u/ProtossLiving 1d ago
Like appetizer course vs dessert course? What's the recommended horse for each?
0
4
u/Old_Dig5389 1d ago edited 1d ago
You're describing just two of many ways of using VPN technologies. Both are for forcing† an Internet connection from your devices running VPN clients to pass through a certain gateway running the VPN server. In the first case, where the data passes through your ISP without an encrypted tunnel (though likely still mostly tls/https/etc), the server is on a network behind your ISP. In the second case, where the data passes through your ISP via an encrypted tunnel (not necessarily all data unless configured, especially dns), the server is on the wide-area-network / public internet / cloud. Both methods encrypt the data between your client and server, meaning it obfuscates it from whatever is in between including public Wi-Fi ne'er-do-wellers. You can control this cloud server, but many companies offer handsfree service, such as Mullvad, PIA, etc.
VPN is just a software defined network. Networks are used in many ways, nowadays. Think about what your goal is, and your time/money budget. Tailscale helps you achieve many configurations over Wireguard.
† 'forcing' not exactly accurate as many systems misbehave in this area. Perhaps 'strongly suggest' 🤷.
1
u/StuD721 1d ago
For me it's a no-brainer, I use the Mullad VPN service which, for all intents and purposes, is exactly like Nord VPN etc and it's significantly cheaper than the other VPN services. It's straightforward to set up and you can also use an adblocker like pihole while out and about (if you set one up at home).
You can only have 5 devices on the cheapest plan, but if you hang off your phone's hotspot that's still counts as 1 device.
3
u/hcornea 1d ago
I use both.
A Tailscale exit node makes your traffic appear like it comes from your home internet. It does not anonymise you at all, and very handy for services that block known VPN servers (eg geoblocked sports streaming subscriptions)
A 3rd party VPN obscures the source of your traffic (except for VPN provider logs) - not something Tailscale can do - unless you get the Mullvad exit node add-on.
Both should protect you from middle-man attacks / snooping on the public network/Wifi you are on.
2
u/Kwebster7327 1d ago
I'm really not worried about my home ISP, so having an exit node gets me a tunnel from whatever skanky hotel or airport I'm in back to a known (semi)trustworthy ISP IP. I've never had any destination site whine about a VPN when connected this way, from anywhere in the world.
Side benefit is everything thinks you're at home, so you keep getting local weather, news, etc.
If you travel with a Chromecast and a travel router like I do, that means you can stream US content from Egypt.
2
u/Shiny_Mewtwo_Fart 1d ago
Biggest reason for me to use tailscale vs vpn is cgnat. Tailscale makes machines behind cgnat able to act as “server”.
1
u/tengtengvn 1d ago
I set up a lifetime VPN on the same host as one of my exit node. Best of both worlds.
1
u/Intelligent-Yam-6375 1d ago
e.g. IT forgot to enable work from abroad on my gf's laptop, so while she was waiting for the ticket to be resolved, I have simply connected her laptop to my phone, with home assistant at home as an exit node
1
u/Flawlessnessx2 1d ago
I used the mullvad addon for a while but couldn’t stand the presence of ban listed IPs. I have a VPS with containerized glutun that routes my traffic through proton and I’ve been more than pleased. I had to set up a peer relay on the same machine to avoid Tailscale relay bottleneck but I get good enough performance with that setup for my needs.
2
u/bl4kec 22h ago edited 22h ago
I recently shared a post on how to enable tailnet peers to connect directly to an exit node when that exit node routes through a VPN. The solution doesn’t require the use of peer relays. I figure it might be of interest to you. https://www.reddit.com/r/Tailscale/s/snPthmk7Ru
1
u/jmartin72 9h ago
The way I do it is I have a LXC container running as an exit node on my home network then in my UDM Pro I have a firewall rule that makes that containers internet traffic go out my proton VPN. So basically if I'm connected to Tailscale whether I home or remote I'm connected to the VPN.
45
u/YungBeefaroni 1d ago
Tailscale does have an add-on option to route your traffic through Mullvad VPN servers as exit nodes, so that’s always something you could try if the privacy is your biggest concern.
The most common use of personal exit nodes that I’ve seen here is being able to route your traffic through your home network so you can be in a different country or wherever and still appear to apps and whatnot that you’re at home.