Exit nodes

An exit node is a peer that forwards other devices' internet traffic. Pick one in a café and you leave the internet from your own server.

Make a peer an exit node

1. The peer needs to be a Linux machine with IP forwarding allowed (a server or a container with NET_ADMIN). Your control-plane VPS works, but a separate small VPS keeps roles clean.
2. In Peers, open the row menu of that peer and choose Set Up Exit Node. This publishes the default route 0.0.0.0/0 through it, with masquerading, for the groups you pick (all devices by default).

The same thing by API, useful in automation:

POST /api/routes
{"network_id":"exit-eu","network":"0.0.0.0/0","peer":"<peer-id>","masquerade":true,
 "metric":9999,"enabled":true,"groups":["<group-id>"],"description":"exit node"}

Let a device volunteer

Instead of you nominating a machine, the machine can offer itself. Run it with the offer flag, or turn on Run Exit Node in the desktop app's Exit Node menu:

sudo tzxmesh down && sudo tzxmesh up --offer-exit-node
sudo tzxmesh down && sudo tzxmesh up --offer-exit-node=false   # withdraw

The reconnect is needed because settings apply when the client connects; the desktop app does it for you. An offer routes nothing. The device appears in Peers with an exit-node offer waiting, and it stays inert until you open that device and press Accept, which creates the same default route as above and shares it with everyone in the account. Stop removes it. Every step is an audit event: offered, withdrawn, enabled, disabled.

Withdrawing the offer does not switch off a running exit node, on purpose: once you have accepted a machine, whether it keeps carrying traffic is your decision, not the machine's.

Use it from a device

Exit nodes are opt-in per device. Desktop apps show the available exit nodes in their menu; on the command line:

tzxmesh routes list
tzxmesh routes select exit-eu      # start using it
tzxmesh routes deselect exit-eu    # stop

Check with a service that echoes your address, for example curl https://1.1.1.1/cdn-cgi/trace: the ip= line should show the exit node's public address.

Notes

• Traffic to other mesh peers still goes directly; only internet-bound traffic uses the exit node.
• A device that is waiting for approval cannot use or be an exit node; it has no routes at all.
• If the exit node sits behind NAT itself (a container on a bridge network, a home machine), its own connection may be relayed. That works, but a peer with a public address gives direct paths.
• Several exit nodes in different places: publish each with its own network ID and let devices choose.