Skip to content

docs: gate a Routes exit node with a posture check on the peer policy - #976

Open
SunsetDrifter wants to merge 1 commit into
mainfrom
cc/exit-node-office-posture
Open

SunsetDrifter wants to merge 1 commit into
mainfrom
cc/exit-node-office-posture

Conversation

@SunsetDrifter

@SunsetDrifter SunsetDrifter commented Sep 13, 2026

Copy link
Copy Markdown
Contributor

Summary

The Geo-Based Exit Node Routing section on the exit-nodes page told readers to build the exit node as a 0.0.0.0/0 Network resource, with a note that adding a posture check to an exit node created as a Route "does not work". That note is only true when the check sits on the route's Access Control Groups: the default route then still installs and the device loses internet.

Placed on the access policy between the users group and the exit node group, the check gates the route itself. NetBird distributes a route only from a routing peer the device is allowed to connect to, so a failing check removes the exit node peer from the device's peer list and the default route with it. Verified against NetBird Cloud with client 0.78.1: the route is withdrawn about 10 seconds after the check applies and returns, with Auto Apply reactivating it, about 7 seconds after it stops matching.

This keeps exit nodes in their native home (Add Exit Node on the peer, Auto Apply toggle, dashboard exit node view) instead of steering readers to a Networks workaround that has none of those.

Changes

  • Rewrite the geo section around the page's own configuration steps: posture check, exit node with Auto Apply, one policy from the users group to the exit node group carrying the check.
  • Replace the "does not work" note with a warning about the wrong placement (route Access Control Groups) and what happens there.
  • Name the second mistake: another policy that also connects the users to the exit node peer keeps the route arriving.
  • Add "Switching the Exit Node Off Inside the Office": the same shape with a Peer Network Range check on the office subnet, plus the re-evaluation caveat (Windows and macOS reconnect on network change on their own, Linux needs --network-monitor=true, Android cannot report local ranges).
  • Remove the Network resource and API-defaults steps that no longer apply.

Prompted by a support ticket asking exactly for the office case.

Summary by CodeRabbit

  • Documentation
    • Updated the geo-based routing guide to configure posture checks directly on access policies.
    • Revised exit-node setup to use a direct remote-workers to exit-nodes policy and Auto Apply configuration.
    • Added guidance on keeping route-level access groups empty and avoiding blocked internet traffic.
    • Documented exit-node verification, posture-driven route withdrawal and reconvergence, network changes, and disabling exit nodes within an office.

@vercel

vercel Bot commented Sep 13, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
docs Ready Ready Preview Sep 13, 2026 2:51pm UTC

Request Review

@coderabbitai

coderabbitai Bot commented Sep 13, 2026

Copy link
Copy Markdown
Contributor

Review Change StackReview Change Stack

Warning

Review limit reached

Next included review available in 15 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 86de1a06-1805-4e7e-b38d-fd7e05a31732

📥 Commits

Reviewing files that changed from the base of the PR and between 2fa21d1 and b6d17a8.

📒 Files selected for processing (1)
  • src/pages/use-cases/remote-access/exit-nodes.mdx

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 9edd6bfc-d292-4ee2-92fb-a18fe9b1cc91

📥 Commits

Reviewing files that changed from the base of the PR and between 2323871 and 2fa21d1.

📒 Files selected for processing (1)
  • src/pages/use-cases/remote-access/exit-nodes.mdx

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.


📝 Walkthrough

Walkthrough

The guide now uses direct exit-node access policies with posture checks. It documents route withdrawal, reconvergence, office-network behavior, platform limitations, and updated verification steps.

Changes

Exit-node posture routing

Layer / File(s) Summary
Direct exit-node policy configuration
src/pages/use-cases/remote-access/exit-nodes.mdx
The guide replaces Network resource selection with an Auto Apply exit node and a direct remote-workers to exit-nodes policy. Route access-control groups remain empty.
Posture-based withdrawal and verification
src/pages/use-cases/remote-access/exit-nodes.mdx
The guide explains how posture checks withdraw or restore exit-node access. Verification checks exit-node selection, public egress IP, internal access, network changes, and platform limitations.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to 2fa21

The updated guide correctly documents posture-based exit-node route withdrawal and restoration and is ready to merge.

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly and concisely describes the main documentation change: using a posture check on the peer policy to gate a Routes exit node.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch cc/exit-node-office-posture

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

A rabbit checks the routes at dawn
The exit node appears, then moves on
Posture guards the tunnel wide
Office networks turn it aside
Split paths remain where needed
Clean guidance hops ahead

Comment @coderabbitai help to get the list of available commands.

The geo section told readers to build a 0.0.0.0/0 Network resource
because a posture check on a Route exit node "does not work". That is
only true when the check sits on the route's access control groups.
Placed on the policy between the users group and the exit node group,
the check withdraws the default route entirely, because routes are only
distributed from peers the device is allowed to connect to. Rewrite the
section around the exit node's native Routes setup, name the wrong
placement, and add the office-subnet variant with a Peer Network Range
check.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant