I use Tailscale WireGuard VPN on part of my network. You don’t need to set up port forwarding; installation and configuration is quite easy.
After installing the Tailscale add-on for Home Assistant, I noticed that it wants to become an exit node (after approval). Since I definitely do not want this, I checked the configuration but there was no way to turn of the “Pending approval” warning.
It turns out that there is a way, but it is very well hidden.
I had to go to Settings -> Add-ons -> Tailscale -> Configuration tab, then click the triple-dot (overflow) menu to “Edit in YAML”. Ensure that the below settings are configured.
accept_routes: false
advertise_exit_node: false
advertise_routes: [ ]
Note that the “advertise_routes” option needs to be set to “[ ]”, so with a space between the square brackets. Otherwise, Home Assistant will not accept it. Strangely enough, if you save and then review those same settings, the space is no longer shown…