VeilNet

Subnets, Exits and Uplink

Make a machine a subnet router or an exit node, or link two machines over a serial cable.

Subnet Routers

A subnet router makes a private network that it is attached to reachable from the rest of the realm. Hosts on that network need nothing installed, so printers, cameras, PLCs and other devices that cannot run conflux become reachable too.

To make a machine a subnet router, pass --subnet to up or proxy, once for each entry.

0 of 3 done

  1. $ sudo conflux up --subnet 192.168.1.0/24

    In a container, or on a machine without CAP_NET_ADMIN, run the router in proxy mode. It needs no port specs:

    $ sudo conflux proxy --subnet '*'

Each entry takes one of these forms:

EntryOffers
192.168.1.0/24That private prefix. It must have no host bits set
eth1The private networks on that interface, followed as they change, including through DHCP
'*'Every private network on every interface. The quotes stop the shell from expanding it.
192.168.1.0/24@officeThat prefix, offered only to peers whose taints are compatible with {office}
eth1@office+labThat interface, offered only to peers compatible with {office, lab}

Entries follow these rules:

  • A private network is one in 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 100.64.0.0/10 or fc00::/7. For the public internet, use an exit node.
  • After @, name only taints that this machine carries.
  • A list holds at most 64 entries of up to 255 bytes each. Together, the entries can use at most 16 distinct sets of taints.
  • If an entry matches no network the machine is attached to, the anchor stops instead of advertising it. Conflux retries, so it picks up an interface that comes up later.
  • To stop forwarding, pass --no-subnet.

Refused entries

MessageWhat to do
subnet 192.168.1.7/24 has host bits set; did you mean 192.168.1.0/24Write the network, not an address in it.
subnet 8.8.8.0/24 is not a private networkAnchor forwards private networks only. For the internet, use an exit node.
subnet "a,b" contains a commaPass --subnet once for each entry.
subnet "X@lab" is bound to "lab", which this machine is not inName only taints this machine carries. The message lists them.
N subnets, and anchor serves at most 64Use fewer entries, or an interface name that covers several networks.

Host Setup

A proxy machine needs no host setup. The anchor forwards traffic from its own process, so the destination sees this host's address.

A TUN machine forwards through the host, and the setup depends on the platform:

  • Linux. Anchor sets up the host when it starts and undoes the changes when it stops. It turns on IP forwarding, adds NAT for traffic from the realm, clamps the TCP MSS and lets its interface through a firewall that drops forwarded traffic. This needs nft on kernel 5.2 or later, or iptables with ipset and ip6tables, and a writable /proc/sys.
  • macOS, the BSDs, Windows. Anchor changes nothing. When it starts, it prints the commands for that host: forwarding, a NAT rule and MSS clamping. On macOS and the BSDs, the NAT rule and the clamping go in pf.conf.

Subnet Orders

On a sovereign network, a member with the subnets power can replace a router's list while the router runs. The guardian's root node, its own anchor in the realm, is one such member.

The most recent list takes effect, and anchor keeps it across every restart and reboot. It stays in force until you run up or proxy with --subnet or --no-subnet. Conflux tells you when that happens.

sudo conflux status shows whose list is in force:

  forwarding   10.9.0.0/24@lab — set by an order from anchor… at 2026-10-06T09:00:00Z, in place of conflux.json's; --subnet or --no-subnet sets it again

To send the order, see the CLI Reference.

Exit Nodes

An exit node lets the rest of the realm send internet traffic through its connection. Serve an exit from a machine with a connection you trust. Use an exit on a machine whose own internet traffic should leave through it:

$ sudo conflux up --serve-exit      # be a way out to the internet for the realm
$ sudo conflux up --use-exit        # send this machine's own internet over the overlay

sudo conflux status and the output of up show an exit row only when the machine serves or uses an exit:

  exit         serving a way out to the public internet for the realm
  exit         sending this machine's internet traffic over the overlay

Exits follow these rules:

  • A machine can serve an exit or use one, but not both. Neither is on until you ask for it. If you ask for both, conflux refuses and suggests --no-use-exit or --no-serve-exit.
  • Both settings also work with proxy. In proxy mode, --use-exit covers only the anchor's own traffic, because nothing else on the host can see the overlay.
  • Conflux never takes either setting from a manifest, so a file alone cannot make a machine an exit node. To turn the settings off, pass --no-serve-exit or --no-use-exit.
  • On Linux in TUN mode, anchor sets up the host for forwarding, as for a subnet router. See Host Setup.