alexiaamber

I think the cleanest way is to separate the two jobs rather than make Tailscale itself an exit node. Have Tailscale handle the remote connection to Unraid/services, and let PIA handle outbound internet traffic. If PIA is running as a full-tunnel VPN on the Unraid host, though, it can interfere with Tailscale's routing because both are trying to control the network paths. Tailscale also documents that it can conflict with other VPNs, particularly when they both manipulate routing. If you're using PIA specifically for downloads/containers, I'd be inclined to keep PIA inside a Gluetun container and put only the containers that actually need PIA behind it. Leave the Unraid host itself on the normal LAN connection with Tailscale running normally. That way your Tailscale traffic isn't competing with the PIA tunnel. If you really want all Unraid host traffic to go through PIA while still using Tailscale, that's where it gets more complicated. An exit node is designed to route all non-Tailscale traffic through the exit device, but stacking another VPN on that same routing path can easily result in the slow/broken behavior you're seeing. So IMO I'd avoid the Ubuntu VM/exit-node route unless you specifically need the entire Unraid host behind PIA. For normal browsing/download containers, Gluetun + PIA with Tailscale left on the host should be much easier to maintain.