# Reach an external service from a fixed IP

> Send your application's traffic to a specific external service through an exit node in your tailnet, so it arrives from one fixed IP.

## Reach an external service from a fixed IP

Some third-party services (for example a managed database) only accept connections from an allowlisted IP address. Your application's pods do not have a fixed outbound IP, so they cannot be allowlisted directly.

Outbound egress solves this. Your application sends the connection through an **exit node** in your own tailnet, and the third party sees the exit node's fixed IP. Only the connections you choose go this way; everything else your application does is unaffected.

It also works for reaching a service that lives **inside** your tailnet: a target pointed at a tailnet device is reached directly, without the exit node.

### Before you start

- A Tailscale service already added to your application (egress reuses its auth key and tailnet).
- An exit node in your tailnet: a device you control with a stable public IP, advertised and approved as an exit node.
- In your tailnet access controls, the exit node must be allowed to route internet traffic. Grant access to `autogroup:internet` (the default policy already allows this).

### Turn on egress

1. Open your application, open the Private network card, and click **View connections**.
2. In the **Outbound egress** section, switch **Enabled** on.
3. Enter the **exit node** as its Tailscale IP (for example `100.72.53.78`).
4. Add one **target** per external service you want to reach:
   - **name**: a label, for example `partner-db`.
   - **host**: the external address, for example `db.partner.com` (or a tailnet device's Tailscale IP to reach it directly).
   - **port**: the service port, for example `5432`.
5. Click **Save egress**. The egress node updates on its own; there is nothing to redeploy.

### Point your application at it

For each target, the panel shows an address to use, for example `your-app-egress:5432`. Set your application's connection to that address instead of the real host:

```
DB_HOST=your-app-egress
DB_PORT=5432
```

Your application connects to that address, the traffic leaves through the exit node, and the external service sees the exit node's fixed IP (the one you allowlisted).

### Notes

- If two targets use the same port, the first keeps that port and the next uses the following one. The panel always shows the exact address for each target.
- The exit node only carries the targets you add. All other outbound traffic from your application is untouched.
- Egress is free and does not count towards your usage.