Exit nodes

An exit node is a device on your TxNet that other devices can send their internet traffic through. Websites and services then see the exit node’s public address instead of the address of the network you are on. A typical use is an always-on machine in the office, so staff on hotel or café Wi-Fi browse as if they were at their desk.

Using an exit node takes three things: someone offers a device as an exit node, an admin approves it in the dashboard, and each person who wants to use it picks it in the TxHub app or on the command line.

How it works#

A device that offers itself as an exit node asks TxHub to route “all internet addresses” through it. Nothing changes until an owner or admin of the TxNet approves that request. Once approved, the exit node shows up in every device’s exit node list. A device that selects it sends its internet traffic through an encrypted tunnel to the exit node, which passes it on to the internet from its own connection.

Selecting an exit node only changes where internet traffic goes:

Offer a device as an exit node#

Pick a device that stays on and connected, with a good internet connection. If it sleeps or goes offline, everyone using it loses internet access until they choose another exit node or turn it off.

Windows and macOS

1. Click the TxHub icon in the system tray (Windows) or menu bar (macOS).
2. Under Network, turn on Run as exit node (on macOS: Run as Exit Node).
3. The line under the toggle says Waiting for admin approval. Once an admin approves it, it changes to Other devices can route through this one.

A device can’t use an exit node and be one at the same time. Turning this on stops using any exit node.

Linux

Linux has to be allowed to forward traffic between network interfaces first. Turn on IP forwarding for IPv4 and IPv6, and save it so it survives a reboot:

$ echo 'net.ipv4.ip_forward = 1' | sudo tee /etc/sysctl.d/99-txhub.conf
$ echo 'net.ipv6.conf.all.forwarding = 1' | sudo tee -a /etc/sysctl.d/99-txhub.conf
$ sudo sysctl -p /etc/sysctl.d/99-txhub.conf

Then offer the device as an exit node:

$ sudo txhub set --advertise-exit-node

If forwarding is still off, txhub set prints a warning that IP forwarding is disabled, and txhub status lists it under health warnings. To stop offering the device, run sudo txhub set --advertise-exit-node=false. Any subnet routes the device offers are kept either way.

Approve the exit node#

Only owners and admins of the TxNet can approve an exit node.

1. In the dashboard, open Machines. A device that is waiting has the tag Exit Node (pending).
2. Click the device to open its details.
3. Under Subnet Routes you see Exit Node (pending approval). Click Enable Exit Node.

The section now says Exit Node Active and the tag in the machine list becomes Exit Node. To withdraw the approval, open the device again and click Disable Exit Node.

Use an exit node#

Windows and macOS

1. Click the TxHub icon in the system tray or menu bar.
2. Under Network, open the Exit Node picker. It lists the approved exit nodes; offline ones are greyed out.
3. Choose an exit node. To go back to your normal connection, choose None.

On macOS the picker only appears when at least one exit node is available to you.

Linux and the command line

List the exit nodes you can use, then select one by its name or TxNet IP address:

$ txhub exit-node list
$ sudo txhub set --exit-node=office-gateway
# Stop using the exit node
$ sudo txhub set --exit-node=

While an exit node is in use, your own local network is not reachable. If you need your printer or a local file server at the same time, allow local network access:

$ sudo txhub set --exit-node=office-gateway --exit-node-allow-lan-access

Access policy#

If your TxNet has no access policy, every device may use an approved exit node. Once you have a policy, a device can only send internet traffic through an exit node if a rule allows it. Use autogroup:internet as the destination, for example:

{
  "action": "accept",
  "src": ["group:staff"],
  "dst": ["autogroup:internet:*"]
}

autogroup:internet means public internet addresses only. It never grants access to devices on your TxNet or to private ranges such as 10.0.0.0/8 or 192.168.0.0/16.

Good to know#

• Everything you do online is seen as coming from the exit node’s network. Choose exit nodes your organization is comfortable vouching for.
• The exit node’s upload and download speed limits everyone using it. Connections are also slower when the exit node is far away.
• If the exit node goes offline, internet traffic stops working on the devices that use it. Choose None or another exit node to get back online.
• An exit node on Windows or macOS needs no extra setup beyond the toggle. On Linux, IP forwarding must be on (see above).