Nico Delgado_ Pick your service →

Field guide — Grok Bot · Tailscale · exit node · Cloudflare

Grok Bot + Tailscale: exit node past Cloudflare, pull files from your machine.

Each Grok Bot assistant has its own private Linux computer. Cloudflare hates those datacenter IPs. Join the bot to your Tailscale tailnet, exit through your home machine, and the bot's browser looks like you — plus it can reach your skills and files on the same network.

~15 min setup CLI only Residential egress
A Grok Bot computer joins the Tailscale network, exits through a home machine, then reaches the public internet with a residential IP GROK BOT linux box TAILNET wireguard HOME exit node INTERNET looks like you
bot joins your tailnet → egress exits through your machine → Cloudflare sees a residential IP

Why bother

Cloudflare antibot loops, and a bot that can't see your desk

Grok Bot assistants (the Cursor desktop ones) each get a private Linux computer with a browser. Logins persist. That's great — until the box hits a site that hates datacenter IPs. Cloudflare challenges loop forever on places like Upwork. The bot isn't "broken"; the edge just won't trust the IP.

Second problem: skills, notes, and project files live on your machines. The app can connect a computer when you're in-session, but Tailscale covers two jobs the connector doesn't always:

Tested once, kept foreverI ran this exiting through a Mac mini on a Paraguay / Telecel residential IP. Same pattern works anywhere your exit node is approved and awake. This page is CLI steps only — no invented click-paths through the Grok Bot UI.

The steps

Join the bot, exit through home, pull files

Eight steps, roughly fifteen minutes if Tailscale is already on your machine and advertising an exit node. Do this once per assistant — each Grok Bot has its own computer.

What you need#

  • Tailscale on your machine (Mac, Windows, or Linux) with that device advertising an approved exit node in the admin console.
  • Permission to approve a new device on the same tailnet (you'll click a login.tailscale.com URL from the bot).
  • One unique hostname per assistant — e.g. research-box, ops-box. Two bots must not share a name.
  • A shell on the Grok Bot computer (the assistant's private Linux box) with sudo for Tailscale.

Exit node firstIf your home machine isn't already an exit node, enable "Use as exit node" on that device, then approve it under Machines in the admin console. The bot can't route through a node you haven't approved.

Install Tailscale on the Grok Bot computer#

On the bot's Linux shell — same one-liner Tailscale documents for servers:

grok bot — shell
$ curl -fsSL https://tailscale.com/install.sh | sh

That installs the packages. On a normal systemd host, tailscaled may already be running. On restricted assistant boxes, it often isn't — next step covers that.

Start tailscaled manually if systemd is limited#

If tailscale status complains that the daemon isn't running, start it yourself with explicit state and socket paths:

grok bot — shell
$ sudo mkdir -p /var/run/tailscale /var/lib/tailscale && \
sudo tailscaled --state=/var/lib/tailscale/tailscaled.state --socket=/var/run/tailscale/tailscaled.sock &

Keep the socket pathEvery tailscale CLI call below passes --socket=/var/run/tailscale/tailscaled.sock so it talks to this daemon, not a missing system default.

Log the bot into your tailnet#

Replace <assistant-name> with something unique to this bot, then bring the node up:

grok bot — shell
$ sudo tailscale --socket=/var/run/tailscale/tailscaled.sock up \
  --hostname=<assistant-name>-box --accept-dns=false
To authenticate, visit: https://login.tailscale.com/a/xxxxxxxx
  1. Open the printed URL in your browser.
  2. Approve the device into the same tailnet as your exit node.
  3. Confirm it appears under admin → Machines.

Why --accept-dns=falseAssistant boxes are picky about DNS. Letting Tailscale rewrite resolvers can break package mirrors or local tooling. Keep the bot's DNS, use MagicDNS names only where you want them, and fall back to 100.x.x.x addresses when in doubt.

List and set the exit node#

See which machines are allowed as exit nodes, then point the bot at yours:

grok bot — shell
$ sudo tailscale --socket=/var/run/tailscale/tailscaled.sock exit-node list
hostname          ip             status
mac-mini          100.x.x.x      -        # ← pick this one

$ sudo tailscale --socket=/var/run/tailscale/tailscaled.sock set \
  --exit-node=<hostname> --exit-node-allow-lan-access=false

<hostname> is the exit node's Tailscale name (or its 100.x IP). --exit-node-allow-lan-access=false keeps the bot from also hairpinning into your home LAN unless you explicitly want that later.

Verify the public IP looks like home#

This is the load-bearing check. From the bot:

grok bot — shell
$ curl -s ifconfig.me
190.x.x.x          # your residential public IP
$ curl -s ipinfo.io
"org": "... Telecel ..."   # ISP / city should match home, not a cloud ASN

If you still see AWS, GCP, or another datacenter ASN, the exit node isn't active — re-check approval in the admin console and re-run the set --exit-node=… command.

✓ Bot browser egress now exits through your residential IP.

IP clean ≠ Cloudflare happyA residential exit node fixes the ASN. It does not fix automation fingerprints. If Grok Bot drives the page with normal AI browser control (DOM refs, Playwright-style clicks, "browserUse"), Cloudflare can still challenge or loop. Tell the bot to use computer clicks — real desktop mouse/keyboard against the browser window ("computerUse"). Exit node gets you the IP; the interaction surface has to look human too.

Pull skills and files over the same tailnet#

Once the bot is on your tailnet, it can reach any machine that is too — by Tailscale IP or MagicDNS name. Typical pulls:

grok bot — shell
# interactive shell on your Mac / VPS
$ ssh <user>@<mac-or-vps-magicdns>

# copy a skills folder (or any tree) onto the bot
$ scp -r <user>@<host>:~/skills ./skills
$ rsync -avz <user>@<host>:~/project/ ./project/
  • SSH / scp / rsync — fine if the target already has SSH open on the tailnet (same pattern as the iPhone SSH guide).
  • HTTP share — temporary python3 -m http.server on the home machine, then curl from the bot to the 100.x address.
  • App connector still helps. When the Grok Bot app is connected to your computer, its built-in link is useful for local work. Tailscale especially unlocks browser egress that looks like you, and reachability to machines that connector doesn't cover.

Caveats & cheat sheet#

Things that bite

CaveatWhat to remember
One bot ≠ all botsEach assistant has its own Linux computer. Installing Tailscale on one does not cover the others — repeat the hostname + login per assistant.
connmark / iptables warningsRestricted containers sometimes print connmark or iptables noise while bringing the node up. Exit node can still work — trust curl ifconfig.me, not a quiet log.
DNSPrefer --accept-dns=false. If names break, use the 100.x.x.x address from exit-node list / tailscale status.
State can vanishNode state lives under /var/lib/tailscale. If the box is wiped or reprovisioned, you re-auth — keep a hostname convention so Machines stays readable.
Exit node approvalYour home machine must advertise an exit node and that role must be approved in the admin console. Without both, set --exit-node is a no-op for public egress.
DOM automation still trips CFResidential IP is necessary, not sufficient. Prefer computer/desktop clicks ("computerUse") over page-level browser automation when a site keeps challenging.

Cheat sheet

grok bot — all of it
$ curl -fsSL https://tailscale.com/install.sh | sh
$ sudo mkdir -p /var/run/tailscale /var/lib/tailscale && \
sudo tailscaled --state=/var/lib/tailscale/tailscaled.state --socket=/var/run/tailscale/tailscaled.sock &
$ sudo tailscale --socket=/var/run/tailscale/tailscaled.sock up \
  --hostname=<assistant-name>-box --accept-dns=false
$ sudo tailscale --socket=/var/run/tailscale/tailscaled.sock exit-node list
$ sudo tailscale --socket=/var/run/tailscale/tailscaled.sock set \
  --exit-node=<hostname> --exit-node-allow-lan-access=false
$ curl -s ifconfig.me

Who wrote this

I build, grow and automate products.

I'm a one-person product studio: custom apps, growth for apps that already shipped, and business automation with AI. Same person designs it, writes it and ships it. Pick the service that fits — an assistant will walk you through it in a few minutes and I'll read every word.

Pick your service →