TailRelay

A SOCKS5 exit.
Inside your Tailnet.

Give a Tailscale exit node one explicit upstream. TailRelay carries client TCP and intercepted DNS through your authenticated SOCKS5 proxy.

Set up a relay Read the docs

Built for Linux servers. Each instance has its own Tailscale identity.

Routing concept
One instance, one upstream A Tailscale client connects to TailRelay, which forwards client traffic through an authenticated SOCKS5 proxy to the public internet. A failed proxy stops forwarding. Your devices Tailscale TailRelay One device identity SOCKS5 Your upstream Internet

Client TCP follows the selected relay and its SOCKS5 upstream to the internet.

Illustration only. These controls do not change your network.

A deliberately
narrow path.

The upstream is a choice you make once per instance. Forwarding stays on that path.

One relay, one upstream
Each instance pairs a Tailscale device with a SOCKS5 proxy, its own credentials, and persistent device state. Select a different exit node to use a different upstream.
DNS follows the exit
TCP and UDP queries on port 53 are intercepted and sent as TLS-verified DNS-over-HTTPS through the same proxy. There is no local DNS fallback.
Failure stops client forwarding
If proxy authentication or an upstream connection fails, the connection fails. TailRelay never falls back to a direct host connection or another provider.

The boundary: fail-closed behavior applies to forwarded client traffic. Tailscale control connections and tunnel transport still use the host network.

Bring your
own upstream.

Start with a Linux host, a Tailnet you administer, and a SOCKS5 provider that requires a username and password.

Open the setup guide

Open source under GPL-3.0-or-later. Public releases include Linux and macOS builds for amd64 and arm64.

  1. Install the latest release.

    The installer detects your platform and verifies SHA-256. Linux uses a Debian package when available; macOS and user-local installs use a CLI archive. Browse all releases for manual downloads.

    curl -fsSL https://raw.githubusercontent.com/idy/tailrelay/main/install.sh | sh

    Installation leaves device enrollment and instance configuration to you. For a user-local install, replace the final sh with sh -s -- --no-sudo.

  2. Configure one instance.

    Use the example configuration as a starting point. Set your upstream, keep credentials separate, and preserve the instance’s device state.

  3. Authorize, approve, select.

    Authorize the device in your Tailnet, approve its exit-node routes, and select it on a client. Your Tailnet policy must allow that client to use the exit.

Prefer to build from source?

With Go 1.26.2 or later, run this in your tailrelay checkout. The Makefile includes the required build tags.

make test check linux

A few practical details.

Does it take over the server’s network?

The default service embeds userspace Tailscale and can run as an ordinary user. It does not create a host TUN or change the host’s default route, system DNS, IP forwarding, or firewall. An explicit local-TUN option is available for a separate Linux network namespace; it has its own setup and permission requirements.

Can several exits share one host?

Yes. Run one process per upstream, with a distinct hostname, state directory, and credentials. Keep device state across restarts, and never copy the same active device identity between simultaneous instances.

What should I test before using it?

Verify a new TCP connection and an uncached DNS query through the selected exit. Then verify that both fail when its upstream is unavailable. External ping is not a health check for this service because ICMP forwarding is refused. IPv6 destinations also require IPv6 support at your SOCKS5 upstream.

Choosing routes on your Mac?

Meet TailSplit