Exit routing

Exit routing sends the traffic for chosen domains out through one of your own nodes, or through a VPN on a node, instead of your local internet connection. Your router forwards those domains to the node, and TLS stays end to end.

Exit routing gives chosen domains a different way out to the internet. Instead of leaving through your origin's own connection, their traffic leaves through an exit: one of your nodes, or a VPN connection on one of your nodes. Everything else on your network is unaffected.

Common uses:

• A fixed outbound address. Reach a service that only accepts known IP addresses, such as a client's API, an admin panel or a payment gateway, from a home or office connection whose address changes.
• Privacy for chosen services. Send some domains through a VPN provider while the rest of your network stays direct.
• Travelling. Reach your own services and subscriptions from your home region while you are away.
• Regional testing. Check how your site, app or CDN behaves from another location.

How it works#

1. Your router forwards the chosen domains (for example api.example.net) to the resolver on your node. The resolver listens on the node's tunnel address for your origin, such as 100.64.0.1, so only your origin can use it.
2. The resolver asks the exit to resolve the name, then answers with the origin node's own tunnel address.
3. Your device connects to that address on port 443 or 80. The node reads the server name from the TLS handshake (or the HTTP Host header) and relays the connection over the mesh to the exit, which connects to the real destination.

The node never decrypts the traffic: TLS runs from your device to the service.

Set it up#

1. Exits: in the panel, open Exit routing and add an exit: a node and its location. Optionally, give the exit a WireGuard config from a VPN provider so its traffic leaves through the VPN instead of the node's own address.
2. Services: add a service with the domains to route, or pick one from the catalog, and choose its exit.
3. Your router: forward each domain to the resolver addresses the panel shows for your origin, one per node the origin is attached to. Most routers call this conditional forwarding or a DNS forward zone.

Details#

• AAAA and HTTPS records are suppressed for routed names, so devices use IPv4 through the relay.
• Answers are cached and served stale for up to 24 hours if the exit can't resolve, and lookups fail closed rather than leaking to your normal DNS.
• The node checks where each exit's traffic appears to come from, so you can see when a VPN provider places it somewhere unexpected.
• In config.yaml and the CLI, exit routing is configured under smartdns.

Check it#

$ ingressd smartdns status
$ ingressd smartdns recent -n 20

status shows exits, mesh peers, relay usage and the location checks. recent lists recent lookups through the resolver: point a device at it, open the service, and use the list to find domains you have not routed yet.

Relay traffic is metered per service and shown on the panel's Usage page.