You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
🔒 A beginner-friendly walkthrough for setting up a Raspberry Pi as a secure, self-hosted VPN exit node using [Tailscale](https://tailscale.com) — with clear command-line steps and privacy-focused configuration.
23
28
24
29
📖 View this guide online: [johnnyfivepi.github.io/tailscale-on-raspberry-pi](https://johnnyfivepi.github.io/tailscale-on-raspberry-pi/)
@@ -164,8 +169,6 @@ This guide is licensed under the [Creative Commons Attribution 4.0 License](http
164
169
165
170
Use it, share it, remix it — just link back here and give credit. ✌️
166
171
167
-
---
168
-
169
172
_Made with curiosity, coffee, and command-line trial & error_ ☕🖥️
170
173
171
174
---
@@ -182,7 +185,7 @@ Do you have a spare Raspberry Pi lying around just waiting for a fun project? If
182
185
183
186
---
184
187
185
-
### Table of Contents
188
+
## Table of Contents
186
189
187
190
- [Introduction](#introduction)
188
191
- [Prerequisites](#prerequisites)
@@ -210,6 +213,8 @@ Tailscale creates a private network called a **tailnet**, built on top of WireGu
210
213
211
214
**Note:** Going through this process yesterday was relatively quick, but I wanted to make sure I understood what I was doing, what I was observing, and what speed-bumps I might have been accidentally speeding over. While catching some air was fun for all but the metaphorical vehicle's suspension, we'll slow down a bit in this guide, taking it step by step, ensuring we understand the process, and troubleshooting any bumps along the way.
212
215
216
+
[↑ Back to top](#table-of-contents){: .back-to-top }
217
+
213
218
---
214
219
215
220
### Prerequisites
@@ -222,12 +227,18 @@ Before we dive into setting up Tailscale and our exit node on the Raspberry Pi,
222
227
- **A Tailscale account**: We’ll need this to connect our Raspberry Pi and other devices to our private network. If you don’t already have an account, [you can sign up for free](https://tailscale.com/pricing?plan=personal)!
223
228
- **A computer or device to interact with the Raspberry Pi**: You'll need to connect to your Pi via SSH or directly using a monitor and keyboard. I used the command line to SSH into my Raspberry Pi, as I don't have an extra keyboard, mouse, or display.
224
229
230
+
[↑ Back to top](#table-of-contents){: .back-to-top }
231
+
225
232
---
226
233
227
234
### Preparing your Raspberry Pi
228
235
229
236
If you already know how to flash your microSD card with Raspberry Pi OS, you can skip ahead to the next section. For those of us who prefer a quick refresher or are new to this, let's go over how to flash our microSD card with a Raspberry Pi OS!
230
237
238
+
[↑ Back to top](#table-of-contents){: .back-to-top }
239
+
240
+
---
241
+
231
242
### Flashing the microSD Card
232
243
233
244
1. **Download and install the Raspberry Pi Imager**:
@@ -254,7 +265,6 @@ If you already know how to flash your microSD card with Raspberry Pi OS, you can
254
265
- c. In the **Services** tab:
255
266
- Make sure to check **Enable SSH**.
256
267
- Choose the option to **Use password authentication**.
257
-
258
268
- d. In the **Options** tab:
259
269
- Select any of the options you'd like. I only checked **Eject media when finished**, but which options you choose or don't is completely up to you.
260
270
- e. Click the **Save** button.
@@ -272,6 +282,10 @@ If you already know how to flash your microSD card with Raspberry Pi OS, you can
272
282
273
283
With that, we’re ready to SSH into our Raspberry Pi and start setting up Tailscale!
274
284
285
+
[↑ Back to top](#table-of-contents){: .back-to-top }
286
+
287
+
---
288
+
275
289
### Using SSH to connect to your Raspberry Pi
276
290
277
291
1. **Find your Raspberry Pi's IP address**:
@@ -294,6 +308,8 @@ With that, we’re ready to SSH into our Raspberry Pi and start setting up Tails
294
308
295
309
- After logging in, you’ll be at the Raspberry Pi’s command prompt, ready to run commands.
296
310
311
+
[↑ Back to top](#table-of-contents){: .back-to-top }
312
+
297
313
---
298
314
299
315
### Checking for Updates
@@ -352,6 +368,8 @@ Before moving forward, it’s a good practice to update our Raspberry Pi’s sof
352
368
353
369
Now we're ready to start the fun part!
354
370
371
+
[↑ Back to top](#table-of-contents){: .back-to-top }
372
+
355
373
---
356
374
357
375
### Setting up Tailscale on Raspberry Pi
@@ -387,6 +405,8 @@ Now we're ready to start the fun part!
387
405
388
406
**High five!** We've successfully installed and authenticated Tailscale on our Raspberry Pi, and located our Pi's IPv4 address! Another excuse to stand up, stretch our legs, and treat ourselves to some celebratory noms!
389
407
408
+
[↑ Back to top](#table-of-contents){: .back-to-top }
409
+
390
410
---
391
411
392
412
### Understanding Key Expiry
@@ -435,6 +455,8 @@ In the end, it's all about finding that sweet spot where security and convenienc
435
455
436
456
[Learn more about key expiry directly from Tailscale](https://tailscale.com/kb/1028/key-expiry).
437
457
458
+
[↑ Back to top](#table-of-contents){: .back-to-top }
459
+
438
460
---
439
461
440
462
### Configuring the Raspberry Pi as an Exit Node
@@ -485,6 +507,8 @@ When you're ready, SSH into your Raspberry Pi and follow these steps:
485
507
486
508
From the Tailscale app on our other devices, we can now use the Raspberry Pi as an exit node for secure traffic routing. Tailscale has us covered with step-by-step instructions on **[how to use an exit node](https://tailscale.com/kb/1408/quick-guide-exit-nodes#use-an-exit-node)** depending on the type of device.
487
509
510
+
[↑ Back to top](#table-of-contents){: .back-to-top }
511
+
488
512
---
489
513
490
514
### Troubleshooting
@@ -565,6 +589,8 @@ To enable **UDP GRO forwarding** permanently:
565
589
566
590
Credit to [@brkdncr](https://github.com/brkdncr) for surfacing this tip and sharing a reproducible service example ([Issue #1](https://github.com/johnnyfivepi/tailscale-on-raspberry-pi/issues/1)).
567
591
592
+
[↑ Back to top](#table-of-contents){: .back-to-top }
593
+
568
594
---
569
595
570
596
### Additional notes
@@ -573,12 +599,16 @@ Credit to [@brkdncr](https://github.com/brkdncr) for surfacing this tip and shar
573
599
- No logs are generated by Tailscale for your activity, thanks to the end-to-end encryption that comes with WireGuard. This makes it more secure and private by design.
574
600
- I started this project not just as a technical challenge, but also to explore networking, privacy, and security as I work toward growing my tech skills.
575
601
602
+
[↑ Back to top](#table-of-contents){: .back-to-top }
603
+
576
604
---
577
605
578
606
### Conclusion
579
607
580
608
Self-hosting a VPN (and setting up an exit node) with Tailscale on a Raspberry Pi is not only fun but also a great way to improve your privacy and security while browsing the internet. If you're interested in building a similar setup or want to ask questions about the process as I experienced it, feel free to leave a comment or reach out!
581
609
610
+
[↑ Back to top](#table-of-contents){: .back-to-top }
611
+
582
612
---
583
613
584
614
**Maintainer note:** Want to edit or contribute to this guide?
@@ -597,6 +627,8 @@ If this guide helped you set up your own Tailscale exit node, consider buying me
597
627
<p align="center">
598
628
<a href='https://ko-fi.com/A0A41O8776' target='_blank'><img height='36' style='border:0px;height:36px;' src='https://storage.ko-fi.com/cdn/kofi3.png?v=6' border='0' alt='Buy Me a Coffee at ko-fi.com' /></a></p>
599
629
630
+
[↑ Back to top](#table-of-contents){: .back-to-top }
<p>🔒 A beginner-friendly walkthrough for setting up a Raspberry Pi as a secure, self-hosted VPN exit node using <ahref="https://tailscale.com">Tailscale</a> — with clear command-line steps and privacy-focused configuration.</p>
65
70
66
71
<p>💡 You’re viewing the full online version of this guide, hosted via GitHub Pages. Follow along step-by-step or jump to a specific section using the table of contents.</p>
<p><strong>Note:</strong> Going through this process yesterday was relatively quick, but I wanted to make sure I understood what I was doing, what I was observing, and what speed-bumps I might have been accidentally speeding over. While catching some air was fun for all but the metaphorical vehicle’s suspension, we’ll slow down a bit in this guide, taking it step by step, ensuring we understand the process, and troubleshooting any bumps along the way.</p>
291
294
295
+
<p><ahref="#table-of-contents" class="back-to-top">↑ Back to top</a></p>
<li><strong>A computer or device to interact with the Raspberry Pi</strong>: You’ll need to connect to your Pi via SSH or directly using a monitor and keyboard. I used the command line to SSH into my Raspberry Pi, as I don’t have an extra keyboard, mouse, or display.</li>
304
309
</ul>
305
310
311
+
<p><ahref="#table-of-contents" class="back-to-top">↑ Back to top</a></p>
312
+
306
313
<hr/>
307
314
308
315
<h3id="preparing-your-raspberry-pi">Preparing your Raspberry Pi</h3>
309
316
310
317
<p>If you already know how to flash your microSD card with Raspberry Pi OS, you can skip ahead to the next section. For those of us who prefer a quick refresher or are new to this, let’s go over how to flash our microSD card with a Raspberry Pi OS!</p>
311
318
319
+
<p><ahref="#table-of-contents" class="back-to-top">↑ Back to top</a></p>
320
+
321
+
<hr/>
322
+
312
323
<h3id="flashing-the-microsd-card">Flashing the microSD Card</h3>
313
324
314
325
<ol>
@@ -388,6 +399,10 @@ <h3 id="flashing-the-microsd-card">Flashing the microSD Card</h3>
388
399
389
400
<p>With that, we’re ready to SSH into our Raspberry Pi and start setting up Tailscale!</p>
390
401
402
+
<p><ahref="#table-of-contents" class="back-to-top">↑ Back to top</a></p>
403
+
404
+
<hr/>
405
+
391
406
<h3id="using-ssh-to-connect-to-your-raspberry-pi">Using SSH to connect to your Raspberry Pi</h3>
392
407
393
408
<ol>
@@ -426,6 +441,8 @@ <h3 id="using-ssh-to-connect-to-your-raspberry-pi">Using SSH to connect to your
426
441
</li>
427
442
</ol>
428
443
444
+
<p><ahref="#table-of-contents" class="back-to-top">↑ Back to top</a></p>
445
+
429
446
<hr/>
430
447
431
448
<h3id="checking-for-updates">Checking for Updates</h3>
@@ -512,6 +529,8 @@ <h3 id="checking-for-updates">Checking for Updates</h3>
512
529
513
530
<p>Now we’re ready to start the fun part!</p>
514
531
532
+
<p><ahref="#table-of-contents" class="back-to-top">↑ Back to top</a></p>
533
+
515
534
<hr/>
516
535
517
536
<h3id="setting-up-tailscale-on-raspberry-pi">Setting up Tailscale on Raspberry Pi</h3>
@@ -558,6 +577,8 @@ <h3 id="setting-up-tailscale-on-raspberry-pi">Setting up Tailscale on Raspberry
558
577
559
578
<p><strong>High five!</strong> We’ve successfully installed and authenticated Tailscale on our Raspberry Pi, and located our Pi’s IPv4 address! Another excuse to stand up, stretch our legs, and treat ourselves to some celebratory noms!</p>
560
579
580
+
<p><ahref="#table-of-contents" class="back-to-top">↑ Back to top</a></p>
<p><ahref="https://tailscale.com/kb/1028/key-expiry">Learn more about key expiry directly from Tailscale</a>.</p>
631
652
653
+
<p><ahref="#table-of-contents" class="back-to-top">↑ Back to top</a></p>
654
+
632
655
<hr/>
633
656
634
657
<h3id="configuring-the-raspberry-pi-as-an-exit-node">Configuring the Raspberry Pi as an Exit Node</h3>
@@ -690,6 +713,8 @@ <h3 id="configuring-the-raspberry-pi-as-an-exit-node">Configuring the Raspberry
690
713
691
714
<p>From the Tailscale app on our other devices, we can now use the Raspberry Pi as an exit node for secure traffic routing. Tailscale has us covered with step-by-step instructions on <strong><ahref="https://tailscale.com/kb/1408/quick-guide-exit-nodes#use-an-exit-node">how to use an exit node</a></strong> depending on the type of device.</p>
692
715
716
+
<p><ahref="#table-of-contents" class="back-to-top">↑ Back to top</a></p>
<p>Credit to <ahref="https://github.com/brkdncr">@brkdncr</a> for surfacing this tip and sharing a reproducible service example (<ahref="https://github.com/johnnyfivepi/tailscale-on-raspberry-pi/issues/1">Issue #1</a>).</p>
775
800
801
+
<p><ahref="#table-of-contents" class="back-to-top">↑ Back to top</a></p>
<li>I started this project not just as a technical challenge, but also to explore networking, privacy, and security as I work toward growing my tech skills.</li>
784
811
</ul>
785
812
813
+
<p><ahref="#table-of-contents" class="back-to-top">↑ Back to top</a></p>
814
+
786
815
<hr/>
787
816
788
817
<h3id="conclusion">Conclusion</h3>
789
818
790
819
<p>Self-hosting a VPN (and setting up an exit node) with Tailscale on a Raspberry Pi is not only fun but also a great way to improve your privacy and security while browsing the internet. If you’re interested in building a similar setup or want to ask questions about the process as I experienced it, feel free to leave a comment or reach out.</p>
791
820
821
+
<p><ahref="#table-of-contents" class="back-to-top">↑ Back to top</a></p>
822
+
792
823
<hr/>
793
824
794
825
<p><strong>Maintainer note:</strong> Want to edit or contribute to this guide?<br/>
@@ -818,6 +849,8 @@ <h3 id="support-this-project">Support this project</h3>
818
849
});
819
850
</script>
820
851
852
+
<p><ahref="#table-of-contents" class="back-to-top">↑ Back to top</a></p>
0 commit comments