Types of Nodes

Figure: Tailscale Machine List in the Admin Console There are several node types to be aware of, two of which are subnet routers and exit nodes. Both of these require administrator approval, creating an indicator of compromise in the Tailscale admin console that prompts a call for attention in the UI. While regular nodes do not create an eye-catching alert on the admin console, they do show up in the Tailnet’s machine list, so it is important to align your node’s hostname and operating system to those of the target Tailnet to avoid detection. In a default access control configuration, a Tailscale node can access (and is accessible by) all other nodes on the Tailnet. For example, a node can port scan and interact with another node’s open ports via its Tailnet IP address.

When you discover Tailscale keys and connect a machine to the associated Tailnet without additional configuration, this will be the type of node you will operate as. Nodes that advertise and provide access to internal networks are called subnet routers. If your connected node has access, these advertised routes to internal networks and the systems therein will be available and configured for you. For example, my Ludus node advertises its internal interface and the IP space of its deployed range. When I connect my MacBook to the Tailnet, I can immediately SSH to range systems in a split tunnel-like VPN configuration without further configuration.

If my MacBook didn’t have access to the Tailnet access control policy, I would not see the advertised routes. An exit node allows other nodes to proxy internet-bound traffic through it. Any node on the Tailnet can connect to the exit node, passing all network traffic through it, akin to a “full tunnel” VPN. Tailnets can have multiple exit nodes that can be listed and subsequently used as you like. Note that exit nodes only route internet-bound traffic, meaning they do not provide access to internal networks like subnet routers.