# Exit nodes and subnets

A device in mesh can pass access further on, to the internet or to a local network.

* An **exit node** routes the internet traffic of other devices through itself. With it, you can go online from the IP address of an office or a server in a specific country.
* **Subnets** open access to the local network behind a device: office printers, NAS, and servers. You don't need to install the client on every host.

Devices on Linux and macOS can share them on the Pro and Legend plans. Any device on any plan and OS can use exit nodes and subnets if the device owner has granted access.

## How to share an exit node

On the device that will carry the traffic, run:

```shell
tuna mesh up --advertise-exit-node

```

The exit node appears right away in **Mesh → Exit nodes** with the **Full** type. The tunad service enables packet forwarding and NAT itself. If Docker, firewalld, or ufw blocks forwarding, tunad tries to allow it, and if it can't, it warns you in the `tuna mesh status` output.

## How to share subnets

List the subnets separated by commas:

```shell
tuna mesh up --advertise-routes=192.168.10.0/24,10.20.0.0/16

```

The subnets must not overlap with mesh addresses. You can't share the whole internet (`0.0.0.0/0`) this way; that's what `--advertise-exit-node` is for. Hosts on the local network see connections coming from the sharing device's address, so you don't need to add a return route on them.

Other devices pick up the subnets automatically, no flags needed. Check the `Subnet routes` line in the `tuna mesh status` output, and then reach the hosts by their local addresses:

```shell
ssh admin@192.168.10.15

```

> **Warning.** Pass the `--advertise-*` flags every time you run `tuna mesh up`. Running it without them, just like `tuna mesh down`, withdraws the advertised exit node and subnets.

## Who can use them

The device owner controls access to the exit node and subnets in **Mesh → Exit nodes → Permissions**. Your own devices can always use them.

![The Exit nodes section: office-gw shares two subnets, prod-db-1 is a full exit node, access is owner only](/docs/img/mesh/exit-nodes.webp)

Others get access like this:

* **Allow the whole team** — any team device can use it;
* **Allow** for a specific device — an individual permission;
* **Deny** for a specific device — the denial applies even when **Allow the whole team** is on.

![The Individual permissions dialog: the Allow the whole team switch and granting a permission or denial to a device](/docs/img/mesh/exit-node-permissions.webp)

The **Withdraw** button removes the exit node or subnets from the device. A team admin can't grant permissions on the owner's behalf but can forcibly withdraw an exit node or subnet in [Team → Exit nodes](https://tuna.am/en/docs/mesh/team.md#routes).

Other members' exit nodes that you have access to are collected on the **Others' exit nodes** tab.

## How to go out through an exit node

Specify the device when you bring the network up:

```shell
tuna mesh up --exit-node=prod-db-1

```

You can use the device name, the name with `.tuna`, or its Mesh IP. If you don't have access, the CLI responds with `exit-node access not granted by owner`. The local network you're on still works directly.

You don't have to route all traffic through the exit node:

| Flag                                    | What it does                                                                                                              |
| --------------------------------------- | ------------------------------------------------------------------------------------------------------------------------- |
| `--exit-node-country-include=ru`        | only traffic to one country goes through the exit node                                                                    |
| `--exit-node-country-exclude=ru`        | traffic to one country goes directly, the rest goes through the exit node                                                 |
| `--exit-node-routes-include=<CIDR,...>` | additional subnets through the exit node                                                                                  |
| `--exit-node-routes-exclude=<CIDR,...>` | subnets that go directly                                                                                                  |
| `--fallback-to-direct`                  | if the exit node is unavailable for longer than the grace period, traffic goes directly and then switches back on its own |
| `--fallback-to-direct-grace=60s`        | the grace period before switching to a direct connection, from 10 seconds to 10 minutes                                   |

The country flags take a single country code and work only together with `--exit-node`. You can't set both of them at once. `tuna mesh countries` lists the codes.

```shell
tuna mesh up --exit-node=prod-db-1 --exit-node-country-exclude=ru --fallback-to-direct

```

[Access rules](https://tuna.am/en/docs/mesh/acl.md) also apply to traffic through an exit node: a rule that denies a subnet closes it through the exit node too.