Tailscale VPN Exit Node with Split-Tunneling using WireGuard and Namespaces

The author of this article runs a personal computer that functions as a media server, content acquisition system, and gaming device. Previously, they utilized Tailscale along with Mullvad as their VPN provider, which worked well but had two drawbacks: all traffic had to pass through a Mullvad exit node and the Mullvad co-founder funded a far-right party.

To rectify these issues, the author decided to enhance their setup and eliminate Mullvad while achieving three goals: exposing services within their Tailnet with MagicDNS, allowing any device in their Tailnet to exit via VPN, and routing any selected device's traffic through a VPN using WireGuard and namespaces. The author initially established a VPN namespace using the Split tunneling using Wireguard and namespaces guide, which enabled running Qbittorrent-nox inside the namespace, ensuring that Qbittorrent's traffic passed through the VPN.

After setting up Tailscale on their desktop, enabling it automatically configured the Tailscale resolver, making MagicDNS a seamless experience. The author then created a Tailscale exit node within their VPN namespace by running a second instance of tailscaled inside the VPN namespace, effectively turning their desktop into two devices in Tailscale: one as a regular client and the other as an exit node.

By selecting the exit node device, the author can route all traffic through the VPN and IVPN, addressing the initial concerns with Mullvad.