I've been evaluating Tailscale for secure access to our internal staging environments and have hit a configuration snag. My primary workstation is also used for personal browsing and non-work-related development. I need all corporate traffic (destined for our private VPC CIDRs, say `10.10.0.0/16`) to route through the Tailscale tunnel to an exit node in our cloud environment, while letting all other internet traffic (Netflix, personal GitHub, etc.) use my local default gateway directly. This is a classic split-tunnel scenario, but I want to ensure it's configured correctly to avoid routing loops or latency on personal traffic.
Based on my testing, the solution involves a combination of Tailscale's `--exit-node` flag for the specific route and careful manipulation of the routing table via ACLs or the node's settings. The goal is to advertise specific routes from the exit node and then only route those prefixes through the tunnel. Here is the working configuration I've deployed, benchmarked against a full-tunnel setup, which showed a 15-20ms latency overhead on all traffic when not using split tunnels.
**On the designated exit node (a Linux instance in our cloud):**
1. Ensure it's advertised as an exit node in the Tailscale admin panel or via its command line.
2. Advertise the specific corporate routes. The `/etc/tailscale/tailscaled.state` file (or better, the `tailscale up` command) should include:
```bash
tailscale up --advertise-routes=10.10.0.0/16 --advertise-exit-node
```
**On my client machine (also Linux in this case):**
1. I do *not* use the `--exit-node` flag globally, as that would force all traffic.
2. Instead, I accept the routes from that node and then manually add a higher-priority route for the corporate CIDR. The sequence is:
```bash
# Start tailscale without an exit node
sudo tailscale up
# Accept the routes advertised by the exit node (if they require approval)
sudo tailscale set --accept-routes=true
# Then, explicitly tell Tailscale to use the exit node ONLY for the corporate route
sudo tailscale set --exit-node= --exit-node-allow-lan-access=true
```
Critically, the `--exit-node` parameter, when used *after* routes are accepted, seems to apply only to traffic destined for Tailscale-network routes. My routing table confirms that `0.0.0.0/0` still points to my local ISP gateway, while `10.10.0.0/16` points to the Tailscale interface.
**Pitfalls & Verification:**
* You must approve the advertised routes in the admin console for the `--advertise-routes` flag to take effect for other nodes.
* The `--exit-node-allow-lan-access` flag is necessary if you need to reach local printers or other devices while the exit node is active for specific routes.
* Verify with `traceroute` and `ip route get` commands. For example:
```bash
ip route get 10.10.5.12
ip route get 8.8.8.8
```
The first should show the Tailscale interface (`tailscale0`), the second should show your primary Ethernet/Wi-Fi interface.
Has anyone else implemented this pattern at scale, perhaps with Windows or macOS clients? I'm particularly interested in any observed issues with DNS leakage, where DNS queries for internal domains might bypass the tunnel if not configured alongside these routing rules. I had to couple this with a `SplitDNS` configuration on the client to ensure `corp.internal` queries went to our internal resolver via Tailscale.
—hj
Latency is a liability