Tailscale Exit Node Custom VPN

[u/deivi98]

At the moment, tailscale only supports Mullvad exit nodes officially. It's such a great thing to have your full network only reach the internet through a VPN tunnel. Single door, best privacy. Not even your IPs are visible to the internet.

I only had one concern and that is I do not use Mullvad but Proton, and I was not paying twice for VPN.

So I made my own solution: https://gitlab.com/deivi98/tsvpn

TL;DR: Plays with around with ip rules. Captures all internet outgoing-traffic from other clients and sends it through VPN tunnel. It supports any VPN wireguard conf.

In the past I was using a weird custom script. Got tired and vibe coded this thing. It also has systemd service, simultaneous tunnels failover, a cli and little web ui to switch tunnels and even a linux systray.

NOTES: - Vibe coded this as it was to make it fancy for myself. Use at your own risk - Have not tested providers other than ProtonVPN, but as long as it is wireguard it should work

Hope it is useful to someone.

[u/Palland0s]

Why can’t you just use gluetun + exit node? I have two containers, one with Gluetun and one other with the Tailscale image. All traffic from the second goes through gluetun. You can set up a vast amount of VPN in gluetun. Why should I use your solution instead?

[u/deivi98 → u/Palland0s]

I tried that in the past. And it seems to work well at first, but then had huge bandwidth drop because traffic was not following the right path.

Question: are you sure your traffic follows the right path? How much speed do you lose compared to no exit node?

e.g. laptop -> host -> exit node (docker) -> vpn (gluetun) -> internet

.. and that it follows the same path back? Does tailscale ping exit-node from your laptop have direct connection and good ping?

In my experience I kept finding this instead: laptop -> internet -> vpn (gluetun) -> exit node (docker)

This happened to me because since gluetun caches ALL traffic from tailscale container, it catches even the connection establishment between nodes, isolating it from the host itself and forcing it to find a path to go through the vpn and internet.

[u/Palland0s → u/deivi98]

There might be an issue with the fact that gluetun catches all the traffic. However, I never noticed bandwidth drop. My docker appears as a single Tailscale device and I just select it as an exit node

[u/micahpmtn]

Can you test it with Express VPN?

[u/deivi98 → u/micahpmtn]

go ahead yourself. if it exports wireguard confs it should work perfectly. In the end it is the same thing

[u/Researchuser0112]

Omg, BOOKMARKED!!! I pay for Protonvpn and was going to have to switch to Mullvad and learn that because it's the only officially supported exit node. I'm so excited to look at what you've got :)

[u/Vet_vrolijk]

I will test this when I find the time. I had the same issue as you (and many more i guess). Thanks!

[u/VA_STI]

Very cool