Windows Egress

Summary

Extend Netmaker egress gateway support to Windows so a Windows netclient can route overlay traffic to local/external networks (LAN, office, VPC-adjacent ranges).

Problem

Egress gateways are currently supported on Linux (and Docker). Many edge and office environments are Windows-only, forcing customers to deploy an extra Linux box or use manual static WireGuard + routing/NAT workarounds.

Goals

• Allow Windows netclient hosts to be configured as egress gateways in the UI/API
• Automatically manage Windows routing and NAT/forwarding for configured egress ranges
• Support the same egress use cases as Linux: LAN access, site ranges, selective CIDRs, and ACL-controlled access to egress resources
• Keep behavior consistent with existing egress features (ranges, virtual ranges, egress ACLs, presets where applicable)

Scope (initial)

• Windows netclient egress gateway mode (enable/disable, range management)
• Host networking on Windows: IP forwarding, routes, and NAT/masquerade equivalent for egress traffic
• Server/UI support to select Windows nodes as egress gateways
• Compatibility with existing egress ACLs and peer route advertisement
• Docs for Windows firewall, interface selection, and common office/LAN setups

Success criteria

• A Windows netclient can be set as an egress gateway and advertise reachable ranges to the network
• Authorized peers can reach configured egress CIDRs via the Windows gateway
• Egress ACLs correctly allow/deny access to Windows-hosted egress ranges
• Setup works without manual static WireGuard config or hand-written Windows route/NAT scripts