From 5615545b2af8ef1ebb7579192a1d433085b40d78 Mon Sep 17 00:00:00 2001 From: Jack Carter <128555021+SunsetDrifter@users.noreply.github.com> Date: Thu, 20 Aug 2026 11:48:03 +0200 Subject: [PATCH] docs: surface exit nodes under Routes and document broad-access mitigations Exit nodes previously lived only under Use Cases. Add them to the Routes sidebar group and mention them on the Routes overview. Document that a default route grants access to everything the routing peer can reach, with Block LAN access and network isolation as mitigations, and link How Routing Peers Work back to the exit nodes guide. --- src/components/NavigationDocs.jsx | 4 ++++ src/pages/manage/network-routes/index.mdx | 2 ++ src/pages/manage/networks/how-routing-peers-work.mdx | 3 +++ src/pages/use-cases/remote-access/exit-nodes.mdx | 11 +++++++++++ 4 files changed, 20 insertions(+) diff --git a/src/components/NavigationDocs.jsx b/src/components/NavigationDocs.jsx index a0b299d51..a7cf7eef7 100644 --- a/src/components/NavigationDocs.jsx +++ b/src/components/NavigationDocs.jsx @@ -227,6 +227,10 @@ export const docsNavigation = [ title: 'Site-to-Site (legacy)', href: '/manage/network-routes/use-cases/site-to-site', }, + { + title: 'Exit Nodes', + href: '/use-cases/remote-access/exit-nodes', + }, { title: 'Access Control', href: '/manage/network-routes/access-control', diff --git a/src/pages/manage/network-routes/index.mdx b/src/pages/manage/network-routes/index.mdx index 4d986cc59..ff63493f0 100644 --- a/src/pages/manage/network-routes/index.mdx +++ b/src/pages/manage/network-routes/index.mdx @@ -9,6 +9,8 @@ Routes are deprecated. Every use case except [exit nodes](/use-cases/remote-acce Routes let you route traffic from NetBird peers to private networks without installing the NetBird client on every device. A routing peer forwards packets between your NetBird mesh network and your internal networks (LANs, VPCs, data centers). +Routes also power [exit nodes](/use-cases/remote-access/exit-nodes): a default route (`0.0.0.0/0`) that sends all internet traffic from peers in its distribution groups through a routing peer. That route grants access to any network the routing peer can reach; see the [exit nodes guide](/use-cases/remote-access/exit-nodes#routing-peer) for how to limit this with **Block LAN access**. +

Routes diagram

diff --git a/src/pages/manage/networks/how-routing-peers-work.mdx b/src/pages/manage/networks/how-routing-peers-work.mdx index 4b48c3e16..f4e1b6154 100644 --- a/src/pages/manage/networks/how-routing-peers-work.mdx +++ b/src/pages/manage/networks/how-routing-peers-work.mdx @@ -216,6 +216,9 @@ Specifics: - The minimum policy for an exit node to function is ICMP from source group to the routing peer group. - Auto Apply controls whether clients use the exit node automatically (v0.55.0+) or only when manually selected. - Set a DNS server with match domain `ALL` to prevent DNS-based location leaks. Local DNS servers may not be reachable from the exit node in any case. +- The `0.0.0.0/0` route exposes any network the exit node can reach, including its local LAN, not just the internet. + +For setup steps and ways to limit what the exit node exposes (Block LAN access, network isolation), see [Configuring Exit Nodes for Internet Traffic](/use-cases/remote-access/exit-nodes#routing-peer). ## Observability and troubleshooting diff --git a/src/pages/use-cases/remote-access/exit-nodes.mdx b/src/pages/use-cases/remote-access/exit-nodes.mdx index f6973983b..979f3333f 100644 --- a/src/pages/use-cases/remote-access/exit-nodes.mdx +++ b/src/pages/use-cases/remote-access/exit-nodes.mdx @@ -18,6 +18,17 @@ When [IPv6 overlay addressing](#ipv6-support) is enabled for the peer, the manag The routing peer acts as the exit node for internet traffic. It applies masquerading so that traffic appears to originate from the routing peer's public IP address. + +An exit node route (`0.0.0.0/0`) matches all traffic, not just internet-bound traffic. Peers using the exit node can reach any network the routing peer can reach, including its local LAN. + + +You can limit this in two ways: + +- Enable **Block LAN access** on the routing peer (in the peer's settings, or with `netbird up --block-lan-access`) to block forwarded traffic to its local networks. It breaks site-to-site or LAN routes served by the same peer, so enable it only on a dedicated exit node. It does not restrict remote networks reachable through the exit node's upstream gateway. +- Place the exit node on an isolated network segment (a DMZ or dedicated VLAN) that can only reach the internet. This enforces the restriction outside the peer and also covers upstream networks. + +Both options assume the exit node does nothing else. If peers also need to reach resources on that site's LAN, serve those through a separate routing peer using a [Network](/manage/networks) with scoped access policies instead of the exit node's broad route. + For the mental model — see [How Routing Peers Work — Exit node mode](/manage/networks/how-routing-peers-work#exit-node-mode).