Skip to content

exitfleet

exitfleet is a distributed exit-node network for rotating source IPs during authorized penetration testing engagements. You run your tools from a single operator station, and each outbound connection exits through a different node's public IP across diverse autonomous systems.

It is the successor to ProxyCannon-NG, rebuilt on WireGuard, IPIP tunnels, hardened NixOS nodes, and multi-provider ASN diversity. It is not a proxy - it forwards at the IP layer, so raw sockets, SYN scans, and UDP all work unmodified.

The shape of it

N Operator Stations ──WireGuard──► 1 Gateway ──ECMP──► N Exit Nodes ──MASQUERADE──► Target
                                       │
                                       ├── ipip-10 → Node 10 (ASN 53667) → target
                                       ├── ipip-11 → Node 11 (ASN 24940) → target
                                       └── ...      → Node N  (ASN XXXXX) → target
  1. The operator station connects to the gateway over WireGuard.
  2. The gateway holds an IPIP point-to-point tunnel to each exit node, running inside the WireGuard mesh.
  3. Linux ECMP multipath routing spreads connections across those tunnels using an L4 hash of (src_ip, src_port, dst_ip, dst_port).
  4. Each exit node MASQUERADEs the traffic to its own public IP and forwards it to the target.
  5. Return traffic follows conntrack back along the same path with the original source IP preserved.

Each curl ifconfig.me returns a different IP.

Why kernel networking, not an application

The entire data plane is kernel primitives - WireGuard, IPIP, ECMP, nftables, conntrack. There is no custom forwarding code, no agent on the exit nodes, no coordinator API. The exit node is a stateless packet forwarder; the gateway holds no scan data and no durable state beyond its WireGuard config. That is what makes raw-socket tooling work and what keeps the moving parts small enough to reason about.

The only long-running component is exitfleetd, a ~30-second convergence daemon on the gateway that reconciles IPIP tunnels and the ECMP route against the live WireGuard peer set and prunes dead nodes automatically.

What works through it

Tool / technique Works? Notes
nmap SYN scan (-sS) Yes Raw SYN packets forwarded at layer 3
nmap connect scan (-sT) Yes Ordinary TCP connections
nmap UDP scan (-sU) Yes UDP forwarded
masscan Yes Custom TCP stack, raw sockets
curl, wget, custom tools Yes Any TCP/UDP traffic
nmap OS detection (-O) Pin first Needs every probe from one source - use exitfleet pin

Next steps

  • Installation - get the exitfleet command onto the gateway and operator station.
  • Quick Start - from a provisioned VPS to rotating exit IPs in a handful of commands.
  • Operations - the convergence daemon, adding and removing nodes, health monitoring.
  • Pinning & Rotation - force a single exit for same-source operations, then return to rotation.
  • CLI Reference - every subcommand and its arguments.

The full architecture - kernel-level packet-flow traces, the AllowedIPs reasoning, MTU accounting, and the daemon's failure-scenario coverage - lives in the repository's docs/DESIGN.md and docs/IMPLEMENTATION.md.

Authorized use only

exitfleet is penetration-testing tooling. Exit nodes are deployed on your own paid provider accounts for a specific engagement and destroyed afterward. Using it to route traffic against systems you do not own or lack written authorization to test may be illegal. See SECURITY.md.