Use an exit point

An exit point is a device that forwards other devices' internet traffic out through its own connection. Use one to give laptops a fixed public address (for an IP-allowlisted service, for example) or to send traffic out from a particular location.

Setting one up takes three steps, by three parties:

1. The exit device offers itself.
2. An admin approves the offer.
3. An admin allows devices to use it, and they choose to use it, or a policy requires them to.

Platforms

1. Offer a device as an exit point

On the device that will carry the traffic:

peerlify exit-point advertise on

On macOS this is refused: Serving as an exit point is not supported on this operating system yet.

2. Approve it

On the console's Devices page, the device shows an exit point — needs approval badge. Open its ⋯ menu and choose Approve as exit point. Requires the Owner, Admin or IT admin role. The badge changes to exit point.

Once approved, the device turns on IP forwarding and NAT:

• Linux: sets net.ipv4.ip_forward=1 and adds an nftables masquerade rule (or iptables if nftables isn't available). When it stops serving, the NAT rules are removed but forwarding stays enabled.
• Windows: enables forwarding and creates a NAT named Peerlify-ExitPoint. This needs the Windows NAT service. When it stops serving, the NAT is removed, but forwarding on the physical adapter stays enabled.

Approving doesn't change the network's policy. Until you add a rule for it on Access → Exit points, the exit point allows nobody; the Devices page reminds you: Approved. Nobody can use it yet — add a rule on Access → Exit points. Revoking approval, or removing the device from the network, deletes any rule you saved for it, so approving it again starts from nobody.

peerlify exit-point status on the exit device shows Advertising: yes — serving as an exit point for this network when it's working.

3. Allow devices to use it

Open Access → Exit points. There is one card per exit-point rule, showing the exit point's address, whether it's serving, and who may use it: EVERYONE, NOBODY, or a list. Approved exit points that have no rule are named under the list as Not used by anyone.

1. Click Add exit-point rule and pick the exit point. The picker offers only approved exit points that don't have a rule yet. The new rule allows nobody.
2. Click the card and edit Who may use it. Use the same selectors as access rules: devices (client:), tags, groups, roles, people (email:), or * for every device in the network. Leave it empty to allow nobody.
3. Click Save exit-point rules.

To take the access away, remove the rule (the trash icon on the card) and save: an exit point without a rule allows nobody. Changes reach devices within about 10 seconds. Requires the Owner, Admin or Network admin role; referring to a tag also requires being one of its managers.

A rule can only name an approved exit point; a rule for a device that stops being one is removed. The access rules don't affect who may use an exit point, in either direction: a rule allowing * to * doesn't grant it, and a device on the list may use the exit point even if no rule lets it reach that device otherwise. In the policy file, the list is the exit_points section; see Policy file reference.

4. Use it

peerlify exit-point list
peerlify exit-point use office-gw
peerlify exit-point status

use accepts the device's name, its address, or its device ID. It doesn't accept the full name (office-gw.k3x9q2m7pa.peerlify.net) that list prints; use the part before the first dot.

Using:      office-gw (100.100.0.30)
Local net:  stays on the local connection
Advertising: no

The choice is kept across restarts. To stop:

peerlify exit-point off

On macOS, the menu-bar app's Exit Node menu does the same.

What changes on a device using an exit point

• IPv4 internet traffic goes through the exit point, if you're allowed to use it. peerlify exit-point list only shows exit points this device may use, and use refuses others. The exit point forwards only to public addresses.
• Your local network stays reachable directly: networks your device is attached to, and networks it has a more specific route to (for example, routes added by another VPN). Private networks reached only through your default gateway, such as another office subnet behind your router, are sent to the exit point, which drops them.
• IPv6 traffic isn't routed through the exit point. On a network with IPv6, it leaves directly.
• DNS settings aren't changed. Name lookups go to your usual DNS servers, through the exit point if those servers are on the internet.
• If the exit point goes offline, internet traffic stops until it comes back or you run peerlify exit-point off.

Traffic to the internet is encrypted only between your device and the exit point. The exit point forwards it like any router.

Require an exit point

On Business and Enterprise plans, admins can require devices to use a specific exit point. Open Settings → Exit points and click Add rule. Requires the Owner, Admin or IT admin role.

Each rule names one approved exit point and the devices it applies to: everyone, or devices with given tags. Rules are checked by Priority, lowest number first; the first that matches a device wins. A device that is itself a working exit point is never sent through another.

Allow direct internet if the exit point is down decides what happens when the exit point can't be reached:

• Off (default): internet traffic is dropped until the exit point is back.
• On: the device uses its own connection until the exit point is back.

On a device covered by a rule, peerlify exit-point use and off are refused with A network policy requires this device to use a specific exit point. Ask an administrator to change the policy. The macOS menu shows Set by your network.

Devices a rule covers may use its exit point even if they aren't on its list under Access → Exit points. The card shows them as Also allowed: devices required by policy «name». This stops when the rule is turned off, points elsewhere, or the plan drops below Business.

Practical notes

• Throughput is limited by the slower of the two connections and the path between them. Latency increases by roughly the round trip to the exit point.
• Hotel and airport sign-in pages may not load while an exit point is in use. Run peerlify exit-point off while you sign in (not possible under a required exit point).
• Activity logs don't record the internet traffic a device sends through an exit point. On the exit point itself, replies may appear as flows to the device using it.

Next steps

• Access control
• CLI reference: exit-point