Skip to content
The Gateway

The Gateway vs a Tailscale exit node

Short answer

Section titled “Short answer”

A Tailscale exit node is the simpler choice when a Tailscale-enrolled device only needs to send all internet traffic through another node. The Gateway is for enforcing different network policies for LAN devices, including devices that do not run Tailscale.

The Gateway can use Tailscale or Headscale for inter-node connectivity; the products are often complementary.

Choose a Tailscale exit node when

Section titled “Choose a Tailscale exit node when”
  • Every relevant endpoint can run the Tailscale client.
  • One selected exit is enough.
  • You primarily need remote access or a flat mesh.
  • You do not need gateway-level DNS filtering, multi-provider tunnels, or per-device LAN policy.

Choose The Gateway when

Section titled “Choose The Gateway when”
  • TVs, consoles, IoT devices, or guests need policy without installing a client.
  • Different device groups need different exits or a direct path.
  • A tunnel failure must block protected traffic rather than fall back.
  • You need domain-aware routing, DNS leak prevention, bridges, or traffic splitting.

Use them together

Section titled “Use them together”

Use Tailscale or Headscale as the private transport between gateways, then let The Gateway apply routing policy at each LAN edge. This separates mesh connectivity from policy enforcement.

Important trade-off

Section titled “Important trade-off”

Tailscale is easier for endpoint-to-endpoint access and has a mature multi-OS client experience. The Gateway requires an operated Linux network appliance and is appropriate only when that central enforcement point is useful.

Sources and next steps

Section titled “Sources and next steps”