Mandatory exit nodes
Mandatory exit nodes are available for Premium and Enterprise plans, or customers who have purchased the Mullvad add-on.
Mandatory exit nodes require that the Tailscale client run Tailscale v1.69.3 or later.
You can mandate always-on exit nodes using mobile device management (MDM) tools. To do so, specify a single exit node to use as the always-on exit node, or use auto exit nodes across your entire fleet of devices.
Mandating exit nodes requires an MDM solution to set the relevant system policies. This can be useful in hybrid or remote working environments where employees must route network traffic through corporate or branch offices.
To enable a single exit node in an always-on fashion, configure the ExitNodeID policy to that of the mandatory exit node.
Set the ExitNodeID policy to auto:any to require an automatically selected exit node. To limit the choices, set AllowedSuggestedExitNodes to a list of permitted exit nodes. If this policy is unset, Tailscale can select any exit node. If it is set but empty, Tailscale cannot select any exit node.
Mandating exit nodes in an always-on fashion can cause service disruptions when exit nodes lose connectivity or during captive portal workflows (such as when needing to authenticate to Tailscale). Use caution if combining mandatory exit nodes with a policy that prevents disconnecting the Tailscale client.