Hey everyone! 👋 I've been deep in the weeds of Tailscale for a few months now, primarily using it to securely connect my work devices and a couple of home servers. But I recently decided to push it a bit further: I wanted a permanent, reliable exit node that wasn't my own home network (for both geo-flexibility and to keep my home IP out of it). The obvious solution? A cheap VPS!
I went with a $5/month DigitalOcean droplet (the basic shared CPU, 1GB RAM, 25GB SSD). The goal was to see if this setup was viable for 24/7 use, how it performed, and where the bottlenecks might be. Spoiler: It works *surprisingly* well for the price, but there are definitely some considerations.
Here’s my step-by-step breakdown and results:
**The Setup Process:**
* **VPS Provisioning:** Super standard. I chose Ubuntu 22.04 LTS and added my SSH key.
* **Tailscale Installation:** Followed the official `apt` instructions. It was a breeze.
* **Making it an Exit Node:** This was the key part. After `tailscale up`, I had to enable IP forwarding and modify the `sysctl.conf` on the VPS, then use the `--advertise-exit-node` flag. The Tailscale docs are clear, but you do need to be comfortable with a few command-line steps.
* **Authentication:** I used the `--operator` flag with my own user to avoid the VPS being a separate "user" in my Tailscale admin panel. Cleaner for my setup.
**Performance & Practical Use:**
I've been routing my laptop's entire traffic through this node for about three weeks. Here are my observations:
* **Speed:** My baseline home speed is ~300 Mbps down / 20 Mbps up. Through the VPS exit node, I consistently get ~180-220 Mbps down / 20 Mbps up. There's a hit, but for general browsing, video calls, and even streaming (the VPS location can access different regional content!), it's more than sufficient. The latency adds about 15-25ms, which is noticeable in gaming but irrelevant for most work.
* **Reliability:** It's been rock solid. Zero unexpected dropouts. The Tailscale connection just stays up.
* **Cost & Control:** The $5/month is predictable, and I control the virtual machine. This feels much better than relying on a commercial VPN's shared infrastructure for my specific use case. I can also install other small services on the same VPS.
**Key Considerations & Pitfalls:**
* **Bandwidth Caps:** This is the **big one**! My $5 DO droplet has a 1TB monthly transfer cap. For constant, heavy streaming or large downloads, you could hit this. It's fine for my "always-on but normal usage" scenario, but monitor it.
* **VPS Provider Terms:** Always check the AUP. Some providers might have rules about VPN/exit node usage. I made sure mine was okay with it.
* **Security:** You're opening up your VPS to route traffic. I hardened the SSH config (key-only, disable root) and ensured the firewall only allows Tailscale (port 41641/udp) and my SSH port. The principle of least privilege is your friend here.
* **Not a True VPN Replacement:** For casual privacy, it's great within my Tailscale network. But remember, all your exit traffic is now originating from a VPS that *you* rent with *your* payment info. It's not anonymous.
**Final Verdict:**
For a tech-savvy user who wants a stable, self-controlled exit node for a small team or personal devices, this is a fantastic and cost-effective solution. The $5 VPS handles the load beautifully for typical use. It's like having your own private, minimal-infrastructure WireGuard setup but with the incredible ease of Tailscale's coordination.
If you're considering it, I'd recommend:
1. Start with the cheapest tier from a provider with good bandwidth allowances.
2. Test it as an exit node for a few days before committing.
3. Keep a close eye on bandwidth usage for the first billing cycle.
For me, the combination of Tailscale's magic and a little $5 droplet has been a game-changer for my remote work setup. I'd love to hear if others have tried similar setups or have tweaks to share!
test everything twice
The phrase "surprisingly well" is doing a lot of heavy lifting there. You're routing all your traffic through a $5 box with a shared CPU and a single gig of RAM.
Have you run any consistent benchmarks beyond a quick speed test? The real test is when that noisy neighbor on the same host starts mining crypto and your latency spikes through the roof. The shared nature of that compute is the hidden bottleneck, not the bandwidth cap.
I'd be curious about the failure stories in a month or two, when the droplet inevitably gets rebooted for host maintenance. Does your exit node policy recover cleanly, or does it leave your devices scrambling? For a permanent exit node, reliability usually costs more than five bucks.
cg