Tailscale Exit Nodes vs a Commercial VPN: What Still Leaks to Your ISP

People turn on a Tailscale exit node in a coffee shop and feel a familiar click. Traffic is leaving through some other machine. The cafe Wi-Fi can no longer see the hostnames they type. That feeling is real. The conclusion they draw from it is usually wrong.

An exit node is not a commercial VPN with a friendlier admin page. It is a default route on a mesh you already trust. Your cafe ISP sees less of the destinations. Someone else’s ISP, or Tailscale’s relays, or your own home uplink, sees more. If you came here because a search result asked whether Tailscale is a VPN, the useful answer is: it can move your internet egress. It does not buy you the threat model printed on a Mullvad homepage.

What an exit node actually changes

Tailscale is a WireGuard mesh with a control plane. Peers find each other, punch holes, and fall back to DERP relays when NAT is rude. An exit node is a peer that advertises “send me 0.0.0.0/0 and ::/0.” Your laptop encapsulates packets to that peer. The peer NATs them out its own interface. Destinations on the public internet see the exit node’s IP, not the cafe’s.

That is the whole trick. It is a powerful trick for reaching your house, spoofing a home geo for a bank that panics at hotel Wi-Fi, or keeping a travel laptop off a hostile LAN. It is not a privacy product unless you are precise about whose eyes you are dodging.

A commercial VPN is a different contract. You pay a company to terminate WireGuard or OpenVPN in a datacenter. The cafe ISP sees a long-lived tunnel to a VPN ASN. The VPN company sees your destinations, unless you also wrap more layers, which almost nobody does. You are trading one observer for another on purpose, with a privacy policy you either believe or you do not.

Tailscale’s contract is closer to “we will get your packets to your devices.” The control plane sees device names, keys, and who is talking to whom at the overlay level. DERP sees encrypted blobs and timing. An exit node sees everything that leaves it in the clear, the same way a home router does. If that exit node is a mini PC under your TV, your home ISP is now the observer of your cafe browsing. You did not disappear. You relocated the tap.

What the cafe ISP still sees

Assume you enabled “use exit node,” MagicDNS is on, and you did not also enable a browser that ships its own DNS. The cafe ISP, or the person running a cheap packet capture on the shop router, still sees several things.

They see a WireGuard-shaped flow to a peer IP if hole punching worked, or to a DERP relay if it did not. DERP hostnames and IPs are not a secret. “This laptop is speaking Tailscale” is often guessable from destinations and ports even if the payload is opaque. A commercial VPN looks similar: one encrypted flow to a known VPN range. Neither one looks like raw HTTPS to news sites. Both look like “this person is tunneling.”

They see volume and timing. Netflix in 4K through a home exit node is a fat, steady stream toward your house or toward a relay. That is not the URL. It is still a fingerprint. If you only tunnel when you do something you would rather hide, the on/off pattern is the tell.

They may still see DNS. This is the leak that survives the most careful Tailscale setups. The exit node steals the default route. It does not automatically steal every stub resolver on the planet. Chrome can speak DoH to a provider you never chose. Android can use Private DNS. iCloud Private Relay can race your tunnel. A split-DNS domain that fails open can query the cafe resolver. If you have not verified with a leak test and a packet capture, you do not know.

They see local traffic you allowed. Tailscale’s “allow local network access” is there so you can still print and hit the hotel TV. It is also how a lookup to a captive portal or a .local name bypasses the exit node. That is not a bug. It is a checkbox people leave on and then forget.

What your home ISP sees if the exit node is at home

This is the part the “just use Tailscale instead of ExpressVPN” posts skip.

If the exit node is a box on your residential connection, your home ISP sees the destinations. HTTPS still hides paths and bodies. SNI and IP addresses still name the services. Your home IP becomes the source for every site you visit from the cafe. That is great for the bank that wants a familiar geo. It is the opposite of hiding from an ISP. You have concentrated the browsing history of every travel day onto the circuit that already has your name on the bill.

You have also created a new outage mode. When the mini PC reboots, when the ISP CGNAT flaps, or when Tailscale’s key expiry hits a node you forgot was an exit, clients that were set to “use exit node” may fail closed or fail open depending on the client and the day. Fail closed means you have no internet and you notice. Fail open means you have the cafe ISP back in the path and you do not. Test the failure. Do not assume the UI badge is a policy engine.

Bandwidth and legality sit here too. You are sending a household uplink through a consumer ToS. A roommate torrenting through your exit node is your ISP ticket. A commercial VPN at least puts that fight on a company that sells the fight.

What still leaks even when the tunnel is “up”

I keep a short list on the inside of a travel router. It is not complete. It is the stuff that has bitten me in the last two years.

IPv6. An exit node that advertises IPv4 only, or a client that prefers native IPv6 on the cafe SSID, will happily send AAAA traffic beside your beautiful WireGuard tunnel. Disable IPv6 on the client or require the exit node to handle both families. Half-tunnels are worse than no tunnel because they look like success.

WebRTC and app sockets. Browsers can still learn local candidates. Some apps bind their own interfaces. A STUN request that bypasses the default route is an old story and it is still true. If your threat is “the cafe should not learn my home IP,” WebRTC can donate it.

The control plane. Tailscale clients talk to coordination servers. That traffic is not your HTTPS to a newspaper, but it is metadata: which device, when it came online, which exit it selected. If your threat model includes “nobody should know I run Tailscale,” you already lost, and Headscale only moves the coordinator to a box you run. It does not erase the cafe’s view of a WireGuard flow.

Logged-in identity. An exit node does not log you out of Google. The destination site still sees a cookie and a familiar fingerprint. ISP leaks are only one column. Account-shaped tracking is the column people forget because it does not show up on ipleak.net.

Mullvad-via-Tailscale is a third thing. Tailscale will sell you Mullvad as an exit. That is closer to a commercial VPN: egress from Mullvad’s network, billed through Tailscale, with a different observer than your house. It is still not “Tailscale hid me.” It is “I bought Mullvad and used Tailscale as the client.” Useful. Different product.

When a commercial VPN is the better tool

Use a commercial VPN when the observer you care about is your own ISP, or a hotel that you do not want tying your name to a destination list, and you do not want that list to land on your home bill instead.

Use it when you need an egress country that is not your house. A home exit node cannot pretend to be Frankfurt. A VPN POP can. The geo is a lie everyone understands. It is still the lie streaming sites and some banks act on.

Use it when you do not want to run an always-on box. Exit nodes die the way homelab services die: power blips, expired certs on the management UI, a roommate unplugging the switch to plug in a vacuum. Mullvad’s endpoint being down is their incident. Your ThinkCentre being down is your evening.

Use it when you need a written policy and a company to be angry at. That sounds cynical. It is how a lot of contractors are allowed to work from a client network. “I route through my house” is not an answer those questionnaires want.

Do not use a random free VPN because Tailscale felt like work. The worst commercial VPNs are a malware distribution channel with an app store listing. If you are going to pick a VPN, pick one you would let terminate your DNS. If you cannot name the DNS story, you are not ready to compare it to an exit node.

When an exit node is the better tool

Use a home exit node when the goal is continuity with your house. Printers, split DNS for *.lab.home, a Pi-hole that already knows your blocklists, a bank that only likes your residential IP. Tailscale is excellent at “this laptop is on my LAN even though I am not.” That is the product.

Use it when you already trust the box and the people who can admin it. An exit node is a full packet tap for every client that selects it. In a household that is a feature. On a tailnet that includes a contractor’s laptop, it is a data-handling decision you should write down.

Use it when you want LAN speed to your own services and only need the default route as a side effect. Subnet routers and exit nodes get mixed up in forum posts. If you only need 10.0.0.0/8, do not steal 0.0.0.0/0. The extra route is how you accidentally send a 4K stream through a 20 Mbps uplink and then blame Tailscale for being slow.

Use Mullvad-as-exit through Tailscale when you want one client, one ACL story, and datacenter egress. That is a reasonable “I already live in Tailscale” move. Just stop calling it a free privacy win. You are paying, and Mullvad is the observer.

A setup that fails in boring, visible ways

The setups that hurt people fail quietly. Prefer ones that fail loud.

Pin one exit node. Do not rotate through whatever is advertised. Name it home-exit so a phone UI cannot select a travel router you left in a bag.

Force DNS through the tailnet. I send clients to a Pi-hole or NextDNS profile that only exists on the mesh. Then I watch query logs while I join a cafe SSID. If I see the cafe’s resolver in a capture, I fix that before I congratulate myself. Browser DoH gets disabled or pointed at the same place. This is unglamorous and it is most of the work.

Decide IPv6 on purpose. Either the exit node handles it or the client has it off. A maybe is a leak.

Turn off local-network access unless you are on a network you need. Hotel printing is not worth a silent bypass if your goal was “no cafe DNS.”

Watch the client when the node dies. Pull the ethernet on the exit box and sit there with the laptop. If traffic continues, your “VPN” was a suggestion. Some clients have a stay-off-the-internet-until-the-exit-is-back option. Use it if your threat cares about fail-open. Accept that you will have no internet during homelab maintenance. That trade is honest.

Keep a commercial VPN profile you can enable without Tailscale. Overlays break. Control planes have bad days. A second tunnel is not paranoia if your job assumes you are not on raw hotel Wi-Fi. Nested tunnels are possible and usually miserable. Prefer one tunnel that matches the documented threat, not two that fight over the default route.

The leak you cannot route away

None of this changes account login, browser fingerprint, or the fact that payment cards have addresses. An exit node vs a commercial VPN is an argument about which network operator sees IP-level destinations and DNS. It is not an anonymity system. If you need that, you are in Tor-and-opsec territory and you should not be shopping for either product as a shortcut.

For everyone else, the honest split is simple. Tailscale exit nodes are a home-network extension that can also carry a default route. Commercial VPNs are a rented egress and a rented observer. Your cafe ISP sees a tunnel in both cases. Your home ISP sees your browsing if the exit node is at home. The VPN company sees your browsing if you pay them to.

Pick the observer on purpose. Then test DNS, IPv6, and the day the exit box reboots. The badge that says “exit node” is not a leak report. It is a route. Routes fail in the direction you did not document.