I’ve been running a lot of stuff in my homelab, and one thing kept annoying me: router-level commercial VPN setups work, but switching countries, servers or providers often means uploading new config files to the router or manually changing provider-specific settings.
So I built ExitLane.
The idea is to bring the “pick a country and let the app handle the rest” experience of native VPN apps to a router/VLAN-based homelab setup.
ExitLane is a Linux-based self-hosted egress appliance. Your router, VLAN or selected clients (depending on your network setup) keep one permanent WireGuard tunnel to ExitLane. ExitLane then manages the outbound VPN connection.
At the moment it supports both NordVPN and Mullvad, but in two slightly different ways:
- NordVPN is managed through the official NordVPN Linux client
- Mullvad uses a direct WireGuard tunnel managed by ExitLane itself
Both providers can remain configured at the same time, while ExitLane makes sure only one provider is used for active egress.
The router stays provider-independent. It only knows about its permanent WireGuard peer to ExitLane. Switching provider, changing country or reconnecting all happens on the ExitLane side.
What it currently does:
- Web UI for VPN status, provider selection, country switching, latency comparison and reconnects
- NordVPN support through the official Linux client
- Direct Mullvad WireGuard egress
- Multiple configured providers with one active egress provider
- WireGuard ingress from a router or selected client network
- VPN killswitch protection for routed client traffic
- Dashboard with appliance, VPN, WireGuard and system status
- Connection diagnostics: Device -> ExitLane -> VPN -> Internet
- Explicit ping, DNS, external IP and Speedtest checks
- Local admin auth, MFA, recovery codes and session management
- Encrypted backup/restore
- Upgrade flow with recovery snapshot and rollback protection
- Integrated version-matched admin documentation
- English and Dutch UI
The supported target right now is Debian 13 (amd64). I mainly run and test it in a privileged Proxmox LXC with /dev/net/tun and the required WireGuard, routing and nftables permissions.
Docker is not supported…yet.
This is not meant to replace OPNsense, pfSense, UniFi or OpenWrt. It complements them. The router only needs to know about the WireGuard tunnel to ExitLane; ExitLane handles the commercial VPN provider side.
The current release is v0.3.0-rc.2. It’s still a release candidate while I test the multi-provider setup and switching/recovery behaviour on real networks before calling 0.3 final.
Roadmap:
More provider hardening, broader relay testing, IPv6 egress for Mullvad, installation/appliance polish, and eventually qualification of additional deployment options and container configurations.
Repo:
https://github.com/kevindraai/exitlane
Current release:
https://github.com/kevindraai/exitlane/releases/tag/v0.3.0-rc.2
AI disclosure: this project was built with extensive AI assistance for implementation, automated tests, documentation, review and iteration. The project idea, architecture direction, validation, release decisions and final technical responsibility remained human-controlled.
I’m especially interested in how other homelabbers would approach the provider abstraction. Would you keep NordVPN and Mullvad behind a dedicated appliance like this, or would you rather terminate each provider directly on the router?
https://www.reddit.com/gallery/1wq7pou
Source: r/homelab · by /u/kevindee