Exit nodes

An exit node is a device in your network that other devices can send their internet traffic through. While you use one, websites and services see the exit node's public IP address instead of yours, and everything between your device and the exit node travels inside Nardeboon's encrypted, obfuscated tunnel.

The device advertises itself as an exit node, an admin approves it, and then other devices can choose it.

Typical uses

• A trusted server abroad. Install Nardeboon on a server you control in another country, such as hetzner in Germany, and reach the internet from there. The tunnel to the server works even on networks that filter or inspect traffic, because every Nardeboon connection is obfuscated.
• Untrusted Wi-Fi. On a hotel or café network, your traffic leaves the tunnel only at a device you trust.
• A fixed address. Services that allow only known IP addresses see the exit node's address, wherever you are.

Set up an exit node

1. Enable IP forwarding

   An exit node forwards other devices' packets to the internet, so Linux must allow IP forwarding on it:

   echo 'net.ipv4.ip_forward = 1' | sudo tee /etc/sysctl.d/99-ip-forward.conf
   echo 'net.ipv6.conf.all.forwarding = 1' | sudo tee -a /etc/sysctl.d/99-ip-forward.conf
   sudo sysctl -p /etc/sysctl.d/99-ip-forward.conf

   Nardeboon never changes this setting itself. If forwarding is off on an approved exit node, nardeboon status there says so.

   Many cloud servers take their IPv6 route from router advertisements: ip -6 route show default ends in proto ra. Linux ignores those while IPv6 forwarding is on, and the server loses IPv6 when its route expires. On such a server, leave out the IPv6 line (the exit node then carries IPv4 only), or keep accepting them on that interface first, with its name in place of eth0:

   echo 'net.ipv6.conf.eth0.accept_ra = 2' | sudo tee -a /etc/sysctl.d/99-ip-forward.conf

2. Advertise the exit node

   On the device that will carry the traffic, for example hetzner:

   sudo nardeboon up --advertise-exit-node

   Running up again changes only the flags you pass, so the device keeps its other settings. sudo nardeboon set advertise-exit-node on does the same without connecting or disconnecting it.

3. Approve it in the dashboard

   An admin approves the exit node on the device's page in the dashboard. Until then, no device can use it.

The exit node translates the addresses of the traffic it carries (masquerading), in an nftables table of its own, nardeboon-snat, so it needs nft (the nftables package). It lets through only traffic for the internet: devices that use it can't reach the exit node's own local network through it, unless it's also a subnet router for that network.

Use an exit node

On your device, list the exit nodes you can use:

nardeboon exit-node list

NAME     ADDRESS      STATUS
gateway  100.88.3.17  online
hetzner  100.83.20.5  online

Pick one:

sudo nardeboon exit-node set hetzner

Or pick it while you bring the connection up:

sudo nardeboon up --exit-node=hetzner

To go back to using your own internet connection directly:

sudo nardeboon exit-node clear

exit-node list then says in use beside the one you chose. The choice applies only to the device where you make it. A device can't use an exit node while it offers to be one itself.

On Windows, choose it in the app, under Exit node, or run the same commands in any terminal, without sudo.

Your local network

While you use an exit node, everything goes through it, including traffic for the local network you're on: on a hotel or café network, other devices there can't reach you, and you don't reach them. To keep reaching your own router, printer or NAS directly, allow it:

sudo nardeboon set exit-node-allow-lan-access on

up --exit-node-allow-lan-access does the same. Your internet traffic still goes through the exit node. On Windows, the app's Reach the local network switch, under the exit node, does it too.

DNS

While you use an exit node, names that aren't your devices' are looked up by the exit node's own resolver, through the tunnel, so the local network and your internet provider can't see your lookups or change their answers. If your network has nameservers of its own in the dashboard, those answer instead, still through the tunnel. See DNS and device names.

If the exit node goes offline

Your device's internet traffic never quietly goes out through your own connection instead. If the exit node stops answering, or stops being an approved exit node, your device's internet traffic stops. If only its connection to the control plane drops while it still answers, traffic keeps going through it. Your Nardeboon connection and your other devices keep working, and nardeboon status says what happened:

Connected to network home as mypc (100.101.12.4)
  Exit node: hetzner (100.83.20.5), offline for the control plane
  ! The exit node hetzner is offline for the control plane: this device's internet traffic still goes only to it, and is blocked while it doesn't answer, or until you choose another (`nardeboon exit-node set <name>`) or none (`nardeboon exit-node clear`).

Traffic flows again as soon as the exit node answers. The same holds when your device restarts: it starts with internet traffic blocked until it reaches the exit node. nardeboon down turns the tunnel off, and the exit node with it: the device uses its own connection until nardeboon up.

Check that it works

nardeboon status shows the exit node in use:

nardeboon status

Connected to network home as mypc (100.101.12.4)
  Exit node: hetzner (100.83.20.5)

PEER     ADDRESS       OS     STATUS
gateway  100.88.3.17   linux  online
hetzner  100.83.20.5   linux  active, 2s ago
laptop   100.101.40.7  linux  online

nardeboon ping reaches internet addresses through it, and says so:

pong from 1.1.1.1 (1.1.1.1): via hetzner (exit node), direct 203.0.113.7:41641, nb-udp, 41.6 ms

Then look up your public IP address on any "what is my IP" website: it should be the exit node's.

The tunnel to the exit node is an ordinary Nardeboon connection, so it takes the best path available, direct or through a relay, over the best transport your network allows. To see that path, run nardeboon path status. For the full reasoning behind it, run nardeboon path explain hetzner. See Paths and relays.

Who can use an exit node

Exit nodes follow your access policy. A grant to everything (*), like the one every network starts with, lets everyone use approved exit nodes. To narrow it, grant access to internet instead: only that grant's sources can use exit nodes to reach the internet. The exit node enforces this itself, so a device the policy leaves out can't use it even if it tries.