Exit nodes — OpenVLAN

Two flavors

Self-hosted exit nodes

Mark any device as an exit node and route traffic through it. Common setups: a VPS in your preferred region, the office gateway while traveling, or a homelab machine with a static IP.

✓Your IP, your logs, your jurisdiction
✓One flag: --advertise-exit-node

Partner exit nodes

Add partner-run exit nodes in 30+ countries for privacy on untrusted networks. Metered by the gigabyte, billed monthly, cancellable anytime.

✓No-logs operation by the partner network
✓Separate terms apply to partner traffic

Partner exit node terms →

Why teams route through an exit

All traffic is encrypted to your exit node before it touches the airport network. Third parties that allow-list your office IP get exactly that IP — from anywhere. And product teams check how the product behaves from the regions their customers live in, without redeploying anything.

Start free Setup guide

egress — current route

vps-fra-01self-hosted · Frankfurt12 msIN USE

office-gwoffice IP allow-lists—STANDBY

partner:tokyoprivacy · no-logs—AVAILABLE

directno exit nodelocal IPOFF

One flag per device — switch exits as often as you like.

Two commands, one honest IP

Advertise an exit from any machine — a VPS, the office gateway, a homelab box. Approve it once in the console, point any device at it, and your laptop starts speaking from the exit's IP instead of the cafe's.

Start free Setup guide

# on the machine that will act as exit node

$ openvlan up --advertise-exit-node

# on your laptop — approve it in the console, then:

$ openvlan up --exit-node=vps-fra-01

$ curl ifconfig.me

162.248.11.7 # the exit node's IP, not yours

What teams use exits for

One primitive, many jobs — from public-wifi privacy to region-true testing.

No-logs partner exits

Partner-run exits in 30+ countries keep no traffic logs. Metered per GB, cancellable anytime.

Untrusted wifi shield

Traffic is encrypted to your exit before it ever touches the airport or hotel network.

Jurisdiction you choose

Egress leaves from the region your regulator prefers — not wherever the laptop sits.

Your IP, your logs

Self-hosted exits mean no third party ever sees your traffic metadata.

Office IP allow-lists

Third parties that trust your office IP get exactly that IP, from anywhere.

Region-true testing

See how the product behaves from the regions customers live in — no redeploy.

Single choke point

Funnel contractor browsing through one recorded exit for observable partner access.

Home as the exit

The same IP your bank already trusts, from any hotel room.

One flag to advertise

Any Linux box becomes an exit with --advertise-exit-node. Nothing to install twice.

Any VPS, anywhere

Spin up exits in your preferred regions; hourly billing fits ephemeral needs.

The office gateway

Traveling? Route back through the office gateway and its existing firewall rules.

Per-device routing

All traffic or internet-bound only — chosen per device, per user, per day.

Questions and answers

Home as the exit — how does that work?

Route travel traffic through your home connection: the same IP your bank already trusts, from any hotel. One flag on the home machine, one flag on the laptop.

What about regional compliance?

Put an exit node in the region your regulator prefers. Data egress leaves from there — not from wherever the laptop happens to be sitting.

Can partner access be funneled through one exit?

Yes — point contractors' browsing through a recorded exit so partner access has a single observable choke point.

Does everything go through the exit?

You choose per device: all traffic, or keep mesh destinations direct and only send internet-bound packets through the exit.

What's the performance cost?

One extra encrypted hop to the exit node — usually a few milliseconds to a nearby VPS. AmneziaWG keeps the overhead negligible.

Exit nodes: your traffic, your rules