Any way to run only a specific program to an exit node?

What I want: The ability to say “Only X program runs through TS” Or “Everything but X runs through TS”.
Is that a thing I can do with only 1 NIC?

Normally it would be host based, not program based - i.e. ‘Only access this host through tailscale’.
It would depend on the program you’re wanting to do this with, but you’d probably be looking at finding a ‘trick’ to make it work, rather than it being an actual feature.
Possibly something with ACLs on ports and failing back to another route, or setting a proxy server on a tailscale host and telling just the program in question to use that.

More details would help someone give you a better clue.

@Spidge is right that most options are host based.

If it is a Linux based host I’d start exploring (googling) the following:

e.g. for “Only X program runs through TS” - I see some possible options

e.g. for “Everything but X runs through TS” its the reverse of some of the options above.

  • run X program in a container with Tailscale as a sidecar (like documented here Using Tailscale with Docker or elsewhere in this forum) and the container has its own IP address on the one NIC (NAT), etc.
  • run X program in a separate network namespace separated from the rest of the system - gets its own IP address, routing etc…
  • run X program in a VM - just a different level of separation from the base system than a network namespace.

All of the above is from memory and reading over the years - so YMMV. :grinning:
I hope it inspires you to explore your use cases…