Subnet routes

Subnet routes

Reach a whole office or cloud network through one device on your TxNet, without installing TxHub on every printer, server or appliance.

A subnet route lets your TxNet reach a whole network, such as an office LAN or a cloud network, through one device that is on both. That device is called a subnet router. Printers, servers, NAS boxes and other equipment on that network don’t need TxHub installed: your devices reach them through the subnet router.

How it works

  1. A device on the network you want to reach offers a route for it, for example 10.0.0.0/24.
  2. An owner or admin of the TxNet approves the route in the dashboard.
  3. Devices that accept subnet routes send traffic for 10.0.0.0/24 through the encrypted tunnel to the subnet router, which passes it on to the local network.

Equipment on the subnet sees the connections coming from the subnet router’s own address on that network, so it needs no special configuration to reply.

Set up a subnet router

Use a Linux machine that stays on and is connected to the network you want to share. If it goes offline, nobody can reach that network through TxNet.

  1. Turn on IP forwarding, so Linux passes traffic between TxNet and the local network. Save it so it survives a reboot:

    echo 'net.ipv4.ip_forward = 1' | sudo tee /etc/sysctl.d/99-txhub.conf
    echo 'net.ipv6.conf.all.forwarding = 1' | sudo tee -a /etc/sysctl.d/99-txhub.conf
    sudo sysctl -p /etc/sysctl.d/99-txhub.conf

  2. Offer the route. Separate several networks with commas:

    sudo txhub set --advertise-routes=10.0.0.0/24
    # Several networks
    sudo txhub set --advertise-routes=10.0.0.0/24,192.168.10.0/24

    If IP forwarding is still off, txhub set prints a warning that IP forwarding is disabled, and txhub status lists it under health warnings.

  3. Approve the route in the dashboard (see below).
Important
--advertise-routes replaces the whole list each time. To add a network, repeat the ones you already offer. To stop offering subnet routes, run sudo txhub set --advertise-routes=. If the device is also an exit node, that setting is kept.

Approve the route

Only owners and admins of the TxNet can approve routes.

  1. In the dashboard, open Machines. A device with routes waiting for approval has the tag Subnets (pending).
  2. Click the device to open its details.
  3. Under Subnet Routes, click Approve next to each route you want to allow.

When every route the device offers is approved, the tag becomes Subnets. To withdraw a route, click Revoke next to it. Approve only the routes you expect: a route lets TxNet traffic into that network.

Note
Approval is tied to what the device offers. If the device stops offering a route, its approval is removed, and the route has to be approved again if it is offered later.

Use subnet routes on your devices

A device only uses subnet routes if it accepts them. Until then, it can’t reach the shared network, even though the route is approved.

Windows and macOS

Click the TxHub icon and make sure Use subnet routes (on macOS: Use Subnet Routes) is on. On Windows it is on by default. When routes are available but the device isn’t using them, the app shows a prompt: click Use these networks (Windows) or Use (macOS) to turn the setting on.

Linux

Linux devices don’t accept subnet routes by default. Turn it on with:

sudo txhub set --accept-routes

To stop using subnet routes, run sudo txhub set --accept-routes=false. The subnet router itself doesn’t need this setting to share its own network.

Access policy

If your TxNet has no access policy, every device that accepts routes can reach the whole approved subnet. With a policy, add a rule whose destination is the subnet (or a single address in it), optionally with ports:

{
  "action": "accept",
  "src": ["group:office"],
  "dst": ["10.0.0.0/24:*", "10.0.0.15:443"]
}

You can also give an address a name under hosts in the policy and use that name as the destination. Approving a route decides that the network can be reached through TxNet at all; the access policy decides who may reach which parts of it.

Good to know

  • Overlapping routes. Approve a given network on one device only. TxHub doesn’t fail over between two devices offering the same network, so offering it twice doesn’t add redundancy and makes it unclear which device carries the traffic.
  • Same range as your local network. If a device’s own Wi-Fi or LAN uses the same addresses as a subnet route (many home routers use 192.168.0.0/24 or 192.168.1.0/24), traffic to those addresses can end up on the wrong network. Use distinct address ranges for the networks you share.
  • Not for the whole internet. To send all internet traffic through a device, use an exit node. To send only specific websites or services through one, use Applications.
  • Still can’t reach the network? Check that the route shows as approved in the dashboard, that the device accepts subnet routes, that IP forwarding is on at the subnet router, and that your access policy allows the traffic.