My Orange Pi Zero 3 already had remote access through Tailscale. I could reach its dashboard, Pi-hole, music library, and the Plex Media Server without opening anything on the router.

This time I wanted one more thing: route a phone or laptop through my home internet connection while away from home.

In other words, turn the little DietPi server into a personal VPN exit node.

The small change

The earlier Tailscale setup was already doing most of the work. I only had to enable IP forwarding on Linux and let the existing Tailscale node advertise itself as an exit node:

sudo sysctl -w net.ipv4.ip_forward=1
sudo sysctl -w net.ipv6.conf.all.forwarding=1
sudo tailscale set --advertise-exit-node

I made the forwarding settings persistent in /etc/sysctl.d/99-tailscale.conf, approved dietpi as an exit node in the Tailscale admin console, and disabled key expiry because this is a trusted always-on server.

On a client, using it is just a matter of selecting dietpi from the Exit Node menu.

Did the server notice?

Not really.

After setup, the Orange Pi was using about 473 MiB of its 1.5 GiB RAM, with roughly 1 GiB still available. The load average sat around 0.04, and the CPU temperature was about 46°C.

That is with Pi-hole, Navidrome, Transmission, Plex, the tiny DietPi dashboard, and several other services already running. The exit node did not add another heavy daemon; it extended the Tailscale service that was already there.

The satisfying test

I enabled the exit node on my Mac and checked the public address:

curl -s https://ifconfig.me

The address changed to the public IP of my home connection. I disabled the exit node, checked again, and the original address returned.

So the path was real: Mac → Tailscale → Orange Pi → home internet.

This is not a fully self-hosted VPN control plane, and it is not anonymity magic. Tailscale still handles coordination, and my home ISP remains the final internet provider. But for safer browsing on public Wi-Fi, reaching services from a familiar home address, and giving two or three personal devices a simple encrypted route home, it is exactly enough.

No new router ports. No dynamic DNS. No separate VPN server to babysit.

One more quiet job for the Orange Pi.