Route Cloud through your own computer

What you need

• A computer that stays on and awake while runs use it.
• Tailscale installed on that computer and signed in.

Set it up

The easiest way is Sign in with Tailscale: no key to copy and no policy to edit.

1. Turn on Run Exit Node. On the computer, open Tailscale and turn on Exit Node → Run Exit Node. On Linux or a Raspberry Pi, turn on IP forwarding as Tailscale's exit node guide shows, then run sudo tailscale set --advertise-exit-node.
2. Approve it as an exit node. In the Tailscale admin console, open Machines → that computer → Edit route settings (or Edit exit node) → Use as exit node.
3. Sign in from Cloud. In Cloud, open Routing below the prompt → Add a proxy or Tailscale tunnel → Tailscale. Press Sign in with Tailscale and approve the rtrvr device in the window that opens.
4. Pick it as your route. If that computer is your only exit node online, rtrvr picks it and this chat goes out through it right away. Otherwise, pick the computer under Routing → Tailscale tunnels. To use it for every run, choose it as Default proxy in Cloud Settings → Proxy Config and save settings.

You can also start from Cloud Settings → Proxy Config → Add Proxy → Tailscale. Added there, the tunnel becomes your default rather than one chat's route. If your tailnet holds new devices for approval, approve the rtrvr device under Machines too.

What sites see

• Your IP and time zone. Sites see the public IP of that computer's connection, and the cloud browser's time zone and language follow its location.
• Not your home network. The cloud browser can't open your router, printers or other devices on your network or tailnet. Only public sites go through the tunnel.
• No WebRTC leak. WebRTC stays in the tunnel, so it can't reveal the cloud server's address.

Pair it with Cookie Sync and the cloud browser arrives signed in to your sites, from your own IP.

Good to know

• One run at a time. A signed-in tunnel carries one run. A second run on it is refused until the first ends. For parallel runs, use an OAuth client.
• Offline means no run. If the computer is off or Tailscale is not running, the run fails before it starts. It never falls back to another route.
• Speed follows your upload. Pages travel through that computer's connection, so a slow upload means slower runs.
• Schedules keep the route. A schedule made from a run that used the tunnel keeps going out through it.
• The sign-in expires with the device key. The sign-in is kept encrypted and lasts until the rtrvr device's key expires (180 days by default) or you remove the device. To keep it, turn off key expiry for the rtrvr device in the Tailscale admin console. After it expires, edit the tunnel in Routing and sign in again.
• Remove it in both places. Removing the tunnel in rtrvr does not remove the device from your tailnet. Also remove the rtrvr-cloud-… machine in the Tailscale admin console.

Run several tasks at once (OAuth client)

For runs in parallel, choose OAuth client instead of Sign in with Tailscale in the same dialog. The dialog walks you through these:

• An approved exit node (steps 1 and 2 above).
• A policy that lets tag:rtrvr reach autogroup:internet. The dialog has the entries to copy into Access controls.
• An OAuth client with the Auth Keys (write) scope and the tag:rtrvr tag.

Paste the client secret, press Connect, pick the exit node, and save.

• The secret (or an auth key) goes to an encrypted vault, never to your settings, and is not shown again.
• Each run joins your tailnet with a single-use key made from it and leaves when the run ends.

Use it from the API and MCP

A tunnel is a saved proxy. Your default route applies to API and MCP runs too. To pick a tunnel for one call, pass its exact name (case-sensitive) or ID:

{
  "settings": {
    "proxyConfig": {
      "mode": "custom",
      "selectedProxyName": "My home computer"
    }
  }
}

See Use a saved proxy from MCP or the API for where settings goes in each call.

Troubleshooting

• “Your exit node … is offline”: Wake the computer, check that Tailscale is running and connected, then run again.
• “…carries one run at a time, and another run is using it now”: Wait for that run to end, or set the tunnel up with an OAuth client to run several at once.
• “…is not offered as an exit node”: Turn on Run Exit Node on the computer and approve it under Edit route settings. With an OAuth client, also allow tag:rtrvr to use autogroup:internet.
• “…is not in your tailnet any more”: Pick the computer again under Routing → Tailscale tunnels.
• “The Tailscale sign-in for this tunnel has expired”: Edit the tunnel under Routing and press Sign in with Tailscale again.
• “Tailscale rejected the saved key”: Check that the OAuth client secret has the Auth Keys (write) scope, or create a new one, then connect again.
• “Tailscale refused the tag”: Add tag:rtrvr to tagOwners in your tailnet policy and to the OAuth client's tags.