Exit nodes

How it works #

Normally a device goes online from wherever it is. With an exit node, it first sends its internet traffic through the tunnel to another member of your network, which sends it on. Websites then see the exit node’s address, and the café’s network sees only encrypted traffic.

A device becomes an exit node in two steps. First an admin gives it the role exit. Then the device’s operator agrees by running juist exit serve on it.

Each device decides for itself whether to use an exit node. Nothing changes on a device until you run juist exit use on it.

Setting up an exit node #

juist grant vps exit

juist exit serve

juist exit use vps

Back on your own network, juist exit off sends the traffic directly again and prints internet direct.

What goes through the exit node #

• Traffic to public internet addresses goes through the exit node.
• DNS goes through it too, unless juist set --dns=false turned it off. Where systemd-resolved runs, names in the LAN’s own domain, such as your router’s, are still resolved on the LAN.
• Traffic to your LAN and to the network’s devices stays direct.
• Replies to connections from the internet, such as an ssh session to this device, also stay direct, so the device stays reachable at its own address.
• juist exit use vps --isolate sends those replies through the exit node as well. It refuses if that would end the ssh session you run it in.

When the exit node is unavailable #

If the exit node you chose cannot be used, internet traffic is blocked, not sent directly. This happens when the exit node is offline, has stopped serving or has lost its role, or when this device’s view of the network is stale. DNS lookups then go nowhere rather than to the LAN. Going direct is your decision: run juist exit off.

When juistd stops cleanly, it lifts the block, so traffic goes direct for a moment while the service restarts.

Good to know #

• juist exit lists the exit nodes, whether each is serving, and which one is in use.
• juist exit use vps --force chooses vps even if it is not serving yet, or if the choice would end your ssh session.
• juist exit serve --stop stops serving and undoes the setup. On an admin’s device, juist revoke vps exit takes the role away.
• A device that uses an exit node cannot be one itself. A device in several networks sends its internet traffic through only one of them.
• Without an access policy, every member may use an exit node. With one, a device can use only the exit nodes that a rule such as pass from laptop to internet via vps allows, and the exit node forwards only that traffic.
• If you configured the exit node’s firewall by hand, it must allow UDP and TCP 41646 on juist0, where the exit node answers its members’ DNS queries (Relays, ports and firewalls).
• If the exit node also runs Tailscale, it answers its members’ DNS through the host’s regular DNS servers, never through Tailscale’s resolver.
• On FreeBSD, exit nodes work with pf, and DNS goes through resolvconf.

Troubleshooting #

After internet refused:, the status gives the reason, such as it cannot be reached, its operator has not agreed to serve or the network has not made it an exit node.