Exit nodes

An exit node is a peer that forwards other devices' internet traffic. Pick one in a café and you leave the internet from your own server.

Make a peer an exit node

1. The peer needs to be a Linux machine with IP forwarding allowed (a server or a container with NET_ADMIN). Your control-plane VPS works, but a separate small VPS keeps roles clean.
2. In Peers, open the row menu of that peer and choose Set Up Exit Node. This publishes the default route 0.0.0.0/0 through it, with masquerading, for the groups you pick (all devices by default).

The same thing by API, useful in automation:

POST /api/routes
{"network_id":"exit-eu","network":"0.0.0.0/0","peer":"<peer-id>","masquerade":true,
 "metric":9999,"enabled":true,"groups":["<group-id>"],"description":"exit node"}

Use it from a device

Exit nodes are opt-in per device. Desktop apps show the available exit nodes in their menu; on the command line:

netbird routes list
netbird routes select exit-eu      # start using it
netbird routes deselect exit-eu    # stop

Check with a service that echoes your address, for example curl https://1.1.1.1/cdn-cgi/trace: the ip= line should show the exit node's public address.

Notes

• Traffic to other mesh peers still goes directly; only internet-bound traffic uses the exit node.
• A device that is waiting for approval cannot use or be an exit node; it has no routes at all.
• If the exit node sits behind NAT itself (a container on a bridge network, a home machine), its own connection may be relayed. That works, but a peer with a public address gives direct paths.
• Several exit nodes in different places: publish each with its own network ID and let devices choose.