From 442cefda842403ff7e3c0051a52245e970d31f3a Mon Sep 17 00:00:00 2001
From: Owen <owen@txv.io>
Date: Fri, 21 Aug 2026 12:25:14 -0400
Subject: [PATCH] Dont allow clients to connect to remote nodes quite yet

---
 server/lib/exitNodes/exitNodes.ts                      | 5 ++++-
 server/private/lib/exitNodes/exitNodes.ts              | 7 +++++--
 server/routers/olm/handleOlmExitNodesRequestMessage.ts | 3 ++-
 3 files changed, 11 insertions(+), 4 deletions(-)

diff --git a/server/lib/exitNodes/exitNodes.ts b/server/lib/exitNodes/exitNodes.ts
index 823fdde97..12947c1d5 100644
--- a/server/lib/exitNodes/exitNodes.ts
+++ b/server/lib/exitNodes/exitNodes.ts
@@ -22,7 +22,10 @@ export async function listExitNodes(
     // Accepted for parity with the enterprise implementation (used there for
     // site-label filtering of remote exit nodes). The OSS build has no remote
     // exit nodes, so it is unused here.
-    siteId?: number
+    siteId?: number,
+    // Same as above: accepted for parity, unused since the OSS build has no
+    // remote exit nodes to exclude.
+    noRemote = false
 ) {
     // TODO: pick which nodes to send and ping better than just all of them that are not remote
     const allExitNodes = await db
diff --git a/server/private/lib/exitNodes/exitNodes.ts b/server/private/lib/exitNodes/exitNodes.ts
index 976f52cff..7298b32d4 100644
--- a/server/private/lib/exitNodes/exitNodes.ts
+++ b/server/private/lib/exitNodes/exitNodes.ts
@@ -153,7 +153,8 @@ export async function listExitNodes(
     orgId: string,
     filterOnline = false,
     noCloud = false,
-    siteId?: number
+    siteId?: number,
+    noRemote = false
 ) {
     const allExitNodes = await db
         .select({
@@ -242,7 +243,9 @@ export async function listExitNodes(
 
     let remoteExitNodesList = allExitNodes.filter(
         (node) =>
-            node.type === "remoteExitNode" && (!filterOnline || node.online)
+            node.type === "remoteExitNode" &&
+            !noRemote &&
+            (!filterOnline || node.online)
     );
     const gerbilExitNodes = allExitNodes.filter(
         (node) =>
diff --git a/server/routers/olm/handleOlmExitNodesRequestMessage.ts b/server/routers/olm/handleOlmExitNodesRequestMessage.ts
index bb8c7a48f..efaaae470 100644
--- a/server/routers/olm/handleOlmExitNodesRequestMessage.ts
+++ b/server/routers/olm/handleOlmExitNodesRequestMessage.ts
@@ -42,7 +42,8 @@ export const handleOlmExitNodesRequestMessage: MessageHandler = async (
         client.orgId,
         true,
         noCloud || false,
-        olm.clientId
+        olm.clientId,
+        true // don't select remote exit nodes for clients
     ); // filter for only the online ones
 
     let lastExitNodeId = null;