Tailscale Exit Node: A US Home IP for Banking and Streaming Abroad

Commercial VPNs have an address problem. NordVPN, ExpressVPN and the rest route you through datacenter IP ranges, and banks know those ranges. Log in to your brokerage from one and you can land in fraud review, or find the account frozen while you sort it out by phone.

A Tailscale exit node fixes that with a box at a house in the US. Your laptop and phone send their traffic home through an encrypted tunnel, and your bank sees a residential connection in the state where you used to live.

I use one for banking from Costa Rica. Setup takes an afternoon, and the hardware costs less than a year of most VPN subscriptions.

Tailscale exit nodes, in plain terms

Tailscale is a mesh VPN built on WireGuard. You install it on your devices, sign in with one account, and the devices can reach each other over encrypted connections in any country.

An exit node is one of those devices, set up to carry internet traffic for the others. Pick a US machine as your exit node and your travel laptop’s traffic leaves the internet from that machine’s home connection. Websites see the US home’s IP address, not the café Wi-Fi in Lisbon.

Tailscale encrypts the traffic between your devices and can’t read it. The company does process account and connection metadata, which its privacy policy describes. Read it if that matters to you.

The Personal plan is free and covers this setup, with room for a few family members. Check the current limits, since Tailscale has changed them before.

Residential IP vs. datacenter IP

Banks and streaming services look up your IP address before they decide how much to trust a login. A datacenter address tells them you’re on a VPN or a server. A residential address from a US internet provider looks like a customer at home.

That’s the whole advantage. A cheap cloud server in Virginia won’t help, because it’s a datacenter IP too. The exit node needs to sit on a home internet connection.

Use it for anything money-adjacent: your bank, brokerage, credit card portals, PayPal, Venmo and crypto exchanges. Start logging in through it a few weeks before you leave, so your accounts see a consistent pattern before the move.

If your job is remote, ask your employer before you route work traffic through it. Some companies allow it, and others treat a hidden work location as a policy violation. Get the answer in writing.

Pick the hardware

The exit node has to stay on around the clock, with steady power and internet. You have two good options.

A Raspberry Pi 5. About $80 for the board, plus a case, power supply and microSD card. It draws about 5 watts and runs Linux without complaint. This is my pick if you don’t have a spare machine.
A computer you already own. A Mac mini or a desktop works well. An old laptop can work if its battery is healthy and its operating system still gets security updates. A Mac laptop won’t stay awake with the lid closed unless you set it up for clamshell mode, so test that before you leave.

Skip your work laptop. Skip a phone as the main node too, though an old phone makes a decent backup.

Put it somewhere you trust

The best spot is a family member’s house with stable broadband and a person you can text to unplug the box and plug it back in. Ask yourself whether you’d be comfortable sending that text at 6am their time.

Check their upload speed. Your traffic leaves through their connection, so their upload speed caps your download speed abroad. Banking needs little bandwidth. Streaming in HD needs a lot more, and a cable plan with a slow upload can make video crawl.

Set up the exit node

Do this while you still have physical access to the US machine.

1. Create a tailnet. Sign up at tailscale.com with a personal Google, Microsoft, Apple or GitHub account. Don’t use a work account, since you’ll lose the network if you change jobs.

2. Install Tailscale on each device. That means the exit node, your travel laptop and your phone. On a Mac, use the Mac App Store. On a Raspberry Pi or other Linux machine, run the install script:

curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up

3. Turn on IP forwarding on Linux. A Linux exit node has to forward traffic for other devices, and most distributions ship with that turned off:

echo 'net.ipv4.ip_forward = 1' | sudo tee -a /etc/sysctl.d/99-tailscale.conf
echo 'net.ipv6.conf.all.forwarding = 1' | sudo tee -a /etc/sysctl.d/99-tailscale.conf
sudo sysctl -p /etc/sysctl.d/99-tailscale.conf

Mac and Windows handle this for you.

4. Advertise the exit node. On a Mac, open the Tailscale menu and turn on “Run as exit node.” On Linux:

sudo tailscale set --advertise-exit-node

5. Approve it in the admin console. Find the machine, open the ”…” menu, choose Edit route settings, and turn on “Use as exit node.” The node won’t carry traffic until you approve it.

6. Disable key expiry. In the same machine menu, choose Disable key expiry. Tailscale expires device keys on a schedule by default, and an expired key on a machine 3,000 miles away means someone has to sign it back in.

Use it from abroad

On your laptop or phone, open Tailscale, choose Exit Node, and pick the US machine. On Linux:

sudo tailscale set --exit-node=<machine-name> --exit-node-allow-lan-access

The --exit-node-allow-lan-access flag keeps your local printer and casting working while internet traffic goes through the US. The Mac and mobile apps have the same toggle in their exit node menu.

Verify it before you trust it. Visit whatismyipaddress.com and look for the US city of the exit node. Then run the standard test at dnsleaktest.com. If either page shows your current country, the exit node isn’t active and your bank will see your real location.

Streaming on a TV

Tailscale publishes apps for Apple TV and Android TV devices, including Google TV, so you can pick the exit node on the TV itself. Samsung and LG sets can’t run Tailscale. Plug in an Apple TV or a Google TV streamer instead of fighting the TV’s built-in apps.

A residential IP gets flagged less than a datacenter one, but streaming services still check location in other ways and set their own terms. Read the terms for the services you pay for, and test them before you leave. Your library abroad depends on licensing, and an exit node doesn’t change what you agreed to.

Keep it running

Set these up before you leave, while you can still reach the machine.

Add a small UPS. An APC BE600M1 costs about $60 and keeps a Pi or Mac mini running through a 10- to 15-minute power cut. Set the machine to restart after a power failure in case an outage outlasts the battery.

Monitor it. Healthchecks.io has a free tier. Add a cron job on the exit node that pings it every 10 minutes, and you’ll get an email when the pings stop. I run it on mine, and it has warned me about outages before I needed the connection.

Test a reboot before you leave. Unplug the machine, plug it back in, and confirm it reappears in the admin console without you touching it. The Linux install script sets Tailscale to start on boot.

Have a failover plan

Power and internet fail. Plan for the day your exit node goes dark.

A second exit node at a different house gives you a second power grid and a second internet provider. An old phone running Tailscale at a sibling’s place is enough.

Keep a paid commercial VPN as the last resort. Its datacenter IPs will get flagged by some banks, but they’re better than logging in to your brokerage from a hotel connection. Save the order of operations somewhere you can reach from your phone: turn off the exit node, text the person near the US machine, use the backup VPN for urgent logins, and stay off banking until the node is back.

The Exit Nerd’s Guide covers the rest of the setup this depends on, including the authenticator apps and backup cards that keep you in your accounts when the network fails. Start with the free 47-item checklist if you’re early in planning.

Pair the exit node with a US phone number your bank accepts. The Google Voice abroad post covers the two-line setup, and the Schwab debit card guide covers cash and cards.