Setting Up a Raspberry Pi as a Tailscale Subnet Router and Exit Node (September 2026)

Setting up a Raspberry Pi as a Tailscale subnet router and exit node gives you a powerful home VPN gateway that runs 24/7 on minimal power. I have deployed this exact setup for remote network access, helping family members bypass restrictive firewalls, and reaching home devices from anywhere in the world. This guide walks through the full process from a fresh Raspberry Pi OS installation to a fully functional subnet router and exit node combination.

Most tutorials cover only one of these features. I will show you how to configure both on the same Pi, because that is what most people actually want. You will learn how IP forwarding works, how to advertise routes and exit nodes, how to approve them in the Tailscale admin console, and how to verify everything works before you rely on it.

By the end of this guide, your Raspberry Pi will serve as a permanent gateway to your home network, letting you access local devices, route all internet traffic through your home connection, and maintain a secure tailnet connection from any device you own.

What Is Tailscale and Why Use It with a Raspberry Pi?

Tailscale is a mesh VPN built on WireGuard that connects your devices into a private network called a tailnet. Unlike traditional VPNs that route everything through a central server, Tailscale creates direct peer-to-peer connections between your devices whenever possible. This means faster speeds and lower latency for most traffic.

A Raspberry Pi makes an ideal always-on node for Tailscale because it draws very little power, generates minimal heat, and runs silently. You can plug it in, forget about it, and trust that your network gateway stays available around the clock. I have run a Pi 4 as my subnet router and exit node for over a year with zero reboots needed for stability.

The two features that turn a Pi into a true network gateway are subnet router and exit node. A subnet router lets tailnet devices reach devices on your home LAN that do not run Tailscale themselves, like printers, cameras, and smart home hubs. An exit node routes all internet traffic from your remote devices through your home network, effectively giving you a personal VPN server.

Together, these two features transform a $35 single-board computer into a networking tool that rivals commercial VPN services. No subscription fees, no third-party servers, and full control over your traffic.

Subnet Router vs Exit Node: Key Differences

The confusion between subnet router and exit node is the most common question I see in forums. They serve fundamentally different purposes, though both act as traffic gateways within your tailnet.

A subnet router bridges your tailnet to a physical network subnet, such as your home LAN at 192.168.1.0/24. It lets you reach devices on that subnet from anywhere, even if those devices cannot run Tailscale. Think of it as giving your remote devices a window into your local network.

An exit node routes all of your internet traffic through the node, replacing your current connection entirely. When you select an exit node on your phone or laptop, websites see the exit node’s IP address instead of yours. Think of it as giving your remote devices a tunnel to the internet through your home connection.

Here is a comparison to make the distinction clear:

• Subnet router: Accesses devices on your LAN (printers, NAS, cameras, smart home). Traffic destined for your local subnet only.

• Exit node: Routes all internet traffic through the Pi. Changes your visible IP address to your home IP.

• Subnet router use case: Managing home devices remotely, accessing local files, controlling IoT hardware.

• Exit node use case: Bypassing geo-restrictions, using public Wi-Fi safely, accessing location-locked services.

• Combined: Full home network access plus internet routing through a single always-on Pi.

One important detail: subnet routers perform source NAT (SNAT) by default, meaning devices on your LAN see traffic coming from the Pi’s local IP, not the remote tailnet device. This works for most situations, but you can disable SNAT if you need to preserve original source IPs for logging or access control.

Prerequisites: Hardware and Software You Need

Before starting, gather the following hardware and prepare your software environment.

Hardware:

• Raspberry Pi 4 (recommended) or Pi 5. A Pi 3 works but may bottleneck exit node throughput.

• MicroSD card, at least 16 GB, Class 10 or better.

• Reliable power supply (official Raspberry Pi USB-C adapter preferred).

• Ethernet cable for wired connection to your router. Wi-Fi works but wired is more stable.

• MicroSD card reader for flashing the OS.

Software:

• Raspberry Pi OS Lite (64-bit recommended for Pi 4 and 5). The Lite version has no desktop environment, which saves resources.

• Raspberry Pi Imager for flashing the SD card.

• A Tailscale account. The free Personal plan supports up to 100 devices, which is plenty.

• SSH access to the Pi. You can enable this during the imager setup or through raspi-config.

Flash the SD card using Raspberry Pi Imager. Under the settings gear, set your hostname, enable SSH with password authentication, and configure your Wi-Fi credentials if using wireless. This saves time compared to configuring everything manually after first boot.

Installing Tailscale on Your Raspberry Pi

Once your Pi is booted and you have SSH access, installing Tailscale takes a single command. Tailscale provides an official installation script that adds the repository and installs the package.

Run these commands in order:

curl -fsSL https://tailscale.com/install.sh | sh

This downloads and runs the official installer, which detects your Linux distribution and installs the correct package. On Raspberry Pi OS, it uses the Debian repository.

After installation completes, bring Tailscale up:

sudo tailscale up

This command outputs an authentication URL. Open it in a browser and log in with your Tailscale account. Once authenticated, your Pi joins your tailnet and receives a Tailscale IP address in the 100.x.y.z CGNAT range.

Verify the connection with:

tailscale status

You should see your Pi listed as active. Take note of its Tailscale IP, because you will use it for SSH access going forward.

Tip: Enable Tailscale SSH to access your Pi through Tailscale without managing SSH keys separately:

sudo tailscale set --ssh

Configuring IP Forwarding on the Raspberry Pi

IP forwarding is what allows your Pi to pass traffic between your tailnet and your local network or the internet. Without it, subnet routing and exit node functionality simply do not work. This is the step most beginners skip, then wonder why nothing functions.

Enable IPv4 and IPv6 forwarding by editing the sysctl configuration:

echo -e 'net.ipv4.ip_forward = 1nnet.ipv6.conf.all.forwarding = 1' | sudo tee -a /etc/sysctl.d/99-tailscale.conf

Apply the changes immediately:

sudo sysctl -p /etc/sysctl.d/99-tailscale.conf

Verify that forwarding is active:

cat /proc/sys/net/ipv4/ip_forward

The output should be 1. If you see 0, the sysctl change did not apply correctly. Reboot the Pi and check again.

On some systems, you also need to handle firewall rules that block forwarded traffic. If you use ufw or firewalld, covered later in this guide, you will need to allow forwarded packets explicitly.

This single configuration step unlocks both subnet router and exit node capabilities. Tailscale checks for IP forwarding when you advertise routes or exit nodes, and it will warn you if forwarding is disabled.

Setting Up the Raspberry Pi as a Tailscale Subnet Router

Configuring your Raspberry Pi as a Tailscale subnet router involves advertising the local subnet routes and approving them in the admin console. Here is the exact process.

Step 1: Identify your local subnet. Run ip route and look for the line starting with default via. Note the subnet of your local interface. For most home networks, this is 192.168.1.0/24 or 192.168.0.0/24.

Step 2: Advertise the subnet route:

sudo tailscale set --advertise-routes=192.168.1.0/24

Replace the subnet with your actual local network range. You can advertise multiple subnets by separating them with commas.

Step 3: Approve the route in the Tailscale admin console. Open https://login.tailscale.com/admin/machines and find your Pi. Click the three-dot menu next to it and select Edit route settings. Toggle on the subnet route you just advertised.

Step 4: On each client device that needs to access the subnet, enable route acceptance. On most Tailscale clients, this means toggling Accept subnet routes in the app settings. From the command line:

sudo tailscale set --accept-routes

Step 5: Test access. From a remote device on your tailnet, try pinging a local device by IP:

ping 192.168.1.50

If the ping succeeds, your subnet router is working. You can now reach printers, NAS drives, cameras, and any other LAN device from anywhere in the world.

Setting Up the Raspberry Pi as a Tailscale Exit Node

Setting up the Raspberry Pi as a Tailscale exit node follows a similar pattern to the subnet router. The difference is the flag you advertise and the approval step in the admin console.

Step 1: Ensure IP forwarding is enabled, as covered in the previous section. This is mandatory for exit nodes.

Step 2: Advertise the Pi as an exit node:

sudo tailscale set --advertise-exit-node

This tells your tailnet that the Pi is willing to route all internet traffic for other devices.

Step 3: Approve the exit node in the admin console. Go to https://login.tailscale.com/admin/machines, find your Pi, open the route settings, and toggle Use as exit node.

Step 4: Select the exit node on your client device. In the Tailscale app on your phone or laptop, open settings and choose your Pi from the exit node dropdown.

Step 5: Verify the exit node is working. Check your public IP address:

curl ifconfig.me

If the returned IP matches your home network’s public IP, your traffic is routing through the Pi correctly. You can also visit a site that shows your IP in a browser to confirm.

One common issue reported in forums is slow speeds when using a Raspberry Pi exit node. This is typically a hardware limitation. A Pi 4 can handle roughly 100 to 200 Mbps through an exit node, while a Pi 5 performs better. If you need higher throughput, consider a more powerful device.

Combining Subnet Router and Exit Node on the Same Pi

This is where most guides stop, but the real power comes from running both features simultaneously on one Pi. The good news is that Tailscale fully supports this, and the configuration is straightforward.

Advertise both routes and exit node in a single command:

sudo tailscale set --advertise-routes=192.168.1.0/24 --advertise-exit-node

In the admin console, approve both the subnet route and the exit node option for the Pi. Once approved, your tailnet devices can use the Pi for both LAN access and full internet routing.

When a remote device selects your Pi as an exit node, it also gains access to advertised subnet routes automatically. This means you get both capabilities with no additional configuration on the client side.

For users who want to preserve source IPs instead of relying on SNAT, you can add the --snat-subnet-routes=false flag. This requires return routes on your local network pointing back to the Pi, which adds complexity. I recommend starting with default SNAT enabled and only disabling it if you have a specific need for source IP visibility.

This combined setup is what I run at home. My phone connects to the Pi as an exit node when I am on public Wi-Fi, and simultaneously reaches my home printer and NAS through the subnet router. One device, two powerful features.

Firewall and Security Considerations

If your Raspberry Pi runs a firewall, you need to configure it to allow forwarded traffic. The two most common firewalls on Raspberry Pi OS are ufw and firewalld. Here is how to handle each.

Using ufw:

Allow forwarding by editing the default policies:

sudo nano /etc/default/ufw

Change DEFAULT_FORWARD_POLICY to "ACCEPT".

Reload ufw: sudo ufw reload

Using firewalld:

Add masquerading for your interface zone:

sudo firewall-cmd --add-masquerade --permanent

sudo firewall-cmd --reload

Key expiry: Tailscale nodes re-authenticate every 180 days by default. On an always-on Pi that you access remotely, an expired key means losing access entirely. Disable key expiry for your Pi in the admin console by clicking the key icon next to the device and toggling Disable key expiry. This prevents unexpected disconnections after six months.

ACL policies: Use Tailscale ACLs to restrict which devices can use your exit node or access your subnet routes. In the admin console under Access Controls, you can define which users and devices have permission. This is especially important if you share your tailnet with others.

Testing and Verifying Your Setup

After configuring everything, run through these verification steps to confirm your Raspberry Pi Tailscale subnet router and exit node setup is fully functional.

Verify Tailscale status:

tailscale status

Confirm the Pi shows as active with subnet routes and exit node advertised.

Verify subnet router access:

From a remote device, ping a local LAN device:

ping 192.168.1.50

Then try accessing a service by IP, like your router admin page or a network printer web interface.

Verify exit node routing:

Select the Pi as your exit node on a client device, then check your public IP:

curl ifconfig.me

The IP should match your home network’s public address.

Verify DNS resolution:

nslookup google.com

If DNS fails while using the exit node, check that your Pi’s DNS configuration uses a reachable resolver like 1.1.1.1 or 8.8.8.8.

Common troubleshooting:

• No internet through exit node: Verify IP forwarding is enabled. Check cat /proc/sys/net/ipv4/ip_forward returns 1.

• Cannot reach LAN devices: Confirm subnet route is approved in admin console. Verify client has --accept-routes enabled.

• Device disappears after months: Key expiry likely triggered. Disable it in the admin console.

• Slow speeds: Expected on Pi 3. Upgrade to Pi 4 or 5, or use a wired Ethernet connection.

• Firewall blocking traffic: Configure ufw or firewalld as described in the previous section.

Frequently Asked Questions

Conclusion

Setting up a Raspberry Pi as a Tailscale subnet router and exit node gives you a permanent, low-cost gateway to your entire home network from anywhere in the world. The combination of subnet routing for LAN access and exit node for full internet traffic routing covers virtually every remote networking scenario you might need.

The key steps are straightforward: install Tailscale, enable IP forwarding, advertise your routes and exit node, approve them in the admin console, and disable key expiry for uninterrupted service. Once configured, the Pi runs reliably for months or years without intervention.

I have used this exact setup for remote file access, secure browsing on public networks, helping family members bypass restrictive firewalls, and managing smart home devices while traveling. The flexibility is hard to match with any commercial VPN service.

If you want to take it further, consider integrating services like AdGuard Home or Pi-hole on the same Pi for network-wide ad blocking alongside your Tailscale gateway. You can also explore Tailscale ACLs for fine-grained access control across multiple users and devices.

Your Raspberry Pi Tailscale subnet router and exit node is now ready to serve as your personal, always-on network gateway. Plug it in, connect from anywhere, and enjoy secure access to everything on your home network.