You already installed Tailscale. Now buy a Raspberry Pi 5, plug it in at home, and route your traffic through it. It takes 10 minutes.
Let's be honest about what you actually want:
And your solution is to pay £10/month to route all your traffic through some company's server in a data centre you've never seen, operated by people you've never met, who pinky promise they don't log anything?
You already have a home internet connection. You already have Tailscale. Just route your traffic through your own house. It's your exit node. You control it. Done.
Normally, Tailscale connects your devices in a private mesh. Traffic between them is encrypted and direct. Beautiful.
An exit node takes it further: you pick one device on your tailnet and say "route ALL my internet traffic through this thing."
So when you're sat in a Caffè Nero on dodgy Wi-Fi, your laptop sends everything through an encrypted tunnel back to your Pi at home, and out through your home broadband.
To the internet, you're at home. To the coffee shop, you're just sending encrypted gibberish. To hackers on the network: good luck.
This is not a 47-part homelab build. It's four things.
Total: roughly £80–100 one time. That's 8–10 months of NordVPN. After that, it's free. Forever. Because it's yours.
If you can follow a recipe, you can do this. It's literally copy-paste into a terminal.
Download Raspberry Pi Imager, pick Raspberry Pi OS Lite (64-bit), flash it to your SD card. In the settings, enable SSH and set a username/password. No desktop needed. This is a headless box.
SD card in. Ethernet cable in. Power in. Wait 60 seconds. Find its IP from your router's admin page, or just try:
ssh your-username@raspberrypi.localsudo apt update && sudo apt upgrade -yThis takes a couple of minutes. Go make a brew.
curl -fsSL https://tailscale.com/install.sh | shOne line. That's the whole install.
This lets your Pi forward traffic. Without it, exit node won't work.
echo 'net.ipv4.ip_forward = 1' | sudo tee -a /etc/sysctl.d/99-tailscale.conf
echo 'net.ipv6.conf.all.forwarding = 1' | sudo tee -a /etc/sysctl.d/99-tailscale.conf
sudo sysctl -p /etc/sysctl.d/99-tailscale.confsudo tailscale up --advertise-exit-nodeIt'll give you a URL. Open it. Authenticate. Done.
Go to login.tailscale.com/admin/machines, find your Pi, click the ... menu, and approve the exit node. Tailscale doesn't auto-approve for security reasons.
On your laptop/phone, open Tailscale, go to Exit Nodes, pick your Pi. All your traffic now goes through your home broadband.
Check it: whatismyipaddress.com — it should show your home IP.
Tailscale auto-starts on boot by default. But let's make sure everything's solid.
# Confirm tailscaled starts on boot
sudo systemctl enable tailscaled
# Optional: set a static hostname so it's easy to find
sudo hostnamectl set-hostname exit-nodeNow tuck it behind your router, forget about it, and enjoy your own personal VPN for the rest of time.
Block ads and trackers at the DNS level for your entire tailnet. Your exit node is already forwarding traffic — might as well clean it on the way out.
Advertise your home LAN through the Pi so you can access printers, NAS, smart home stuff — all over Tailscale, without installing Tailscale on each device.
sudo apt install unattended-upgrades -y
sudo dpkg-reconfigure -plow unattended-upgradesSecurity patches apply themselves. You sleep soundly.
Depends on your home broadband. If you've got decent fibre, it'll be faster than most VPN providers because there's no congested shared server in the middle. Your traffic goes through your own pipe.
No. Your exit node is at your house. You'll appear to be at home. That's the whole point. If you want to pretend to be in Japan, this isn't that. But if you want to appear to be at home while you're abroad — this is exactly that.
No. The connection is end-to-end encrypted using WireGuard. Tailscale's coordination server handles key exchange and device discovery, not your actual traffic. They literally can't see it.
Then your exit node goes down. Same as if your VPN provider has an outage — except this time you can walk over and unplug and replug your router. Which is more than you can do with NordVPN's data centre in Panama.
About 3–5 watts idle. That's roughly £10–15 a year in electricity. Less than one month of most VPN subscriptions.
Nope. Tailscale handles NAT traversal. Your Pi connects outward to Tailscale's coordination server, so it works behind CGNAT, dynamic IPs, double NAT, whatever. That's the whole point of Tailscale.
Yes. It'll work fine. The Pi 5 is just faster and has better thermals. A Pi 4 (2GB+) will handle exit node duties without breaking a sweat.