# Exit nodes

> Send a device's internet traffic out through another machine in your network, like a server you trust or a machine at home.

An **exit node** is a machine other devices can send all their internet traffic through. Websites then see the exit node's public address instead of the device's. Use it on untrusted Wi-Fi, or to browse from your home or office address.

## Offer a machine as an exit node

1. On the machine:

   ```bash
   underpass set --advertise-exit-node
   ```

2. In the dashboard, open **Routes** and approve it as an exit node.

## Use an exit node

On the device whose traffic should go out through it, pass the exit node's name or address:

```bash
underpass set --exit-node=home-server
```

To go back to using the device's own internet connection:

```bash
underpass set --exit-node=
```

On Windows you can also pick one from the tray icon's **Exit node** menu, and offer the PC as one with **Run as exit node**.

Offering an exit node works on Linux, macOS and Windows with the default engine. On Linux it needs `nftables`.

## How it behaves

- Traffic only goes through the exit node while it's **online and approved**. If it isn't, the device's traffic goes out directly, and the client says why.
- An exit node can't use another exit node.
- Your private network keeps working: only internet traffic goes through the exit node.

## Access

Exit traffic is named `autogroup:internet` in [access rules](/features/access-controls). A rule with `*` as its destination covers it too.