Proton VPN and Tailscale exit routing

The problem

An exit node is only useful if the VPN tunnel, routes and Tailscale advertisement remain correct after failures or reboots.

What I did

I built a dedicated ProtonProxy system with a Proton WireGuard interface and Tailscale exit-node role.

• Verified tunnel peer reachability and source-interface routing
• Checked systemd timers and journal entries for watchdog execution
• Separated “tunnel is up” from “internet traffic is actually routed”
• Designed recovery checks around route state and tunnel health
• Kept this function separate from normal 3CX traffic

Implementation notes

Representative commands from the way I diagnose and maintain this project. Public examples use placeholders instead of credentials or sensitive addresses.

# Confirm the Proton WireGuard peer is reachable through the tunnel
ping -I proton0 -c 3 10.2.0.1

# Inspect policy routing and the Tailscale advertisement
ip rule show
ip route show table all
tailscale status
tailscale debug prefs | grep -i exit

# Check watchdog execution and recovery history
systemctl list-timers --all | grep -i proton
journalctl -t proton-exit-watchdog --since today --no-pager

Result

The exit route can be diagnosed and recovered methodically rather than relying on a single green connection indicator.