[GH-ISSUE #5789] iOS: WireGuard handshake completes successfully but zero data packets sent — one-way connectivity only (all peers unreachable from iPhone) #11080

Closed
opened 2026-08-05 01:28:24 -04:00 by saavagebueno · 1 comment
Owner

Originally created by @nonanonymousanon on GitHub (Apr 2, 2026).
Original GitHub issue: https://github.com/netbirdio/netbird/issues/5789

Describe the problem
On iOS, the NetBird app shows all peers as "connected" and WireGuard handshakes complete successfully, but the iPhone sends zero data packets through the tunnel. Other peers can reach the iPhone (one-way connectivity), but the iPhone cannot reach any peers. This occurs on both WiFi and cellular, with both P2P and forced relay, and persists across all troubleshooting attempts.

To Reproduce

  1. Install NetBird iOS app on iPhone
  2. Connect to a self-hosted NetBird instance
  3. Observe peers show as "connected" in the app
  4. Attempt to ping any peer by NetBird IP from the iOS ping tool
  5. Observe 100% packet loss in both directions from the iPhone
  6. Confirm from a Linux/macOS peer that zero packets are received from the iPhone's NetBird IP (tcpdump -i any host 100.81.213.209 -n)
  7. Confirm WireGuard shows 0 bytes transferred from iPhone (wg show)

Expected behavior
The iPhone should be able to send and receive data packets through the NetBird tunnel, allowing bidirectional communication with all peers.

Troubleshooting steps already attempted

All of the following were tried and the issue persisted after each:

  1. Disabled Rosenpass — original logs showed Rosenpass was enabled in strict mode (rosenpass is enabled, running rosenpass in strict mode). All peers reported remote peer does not support rosenpass. Disabled Rosenpass entirely — issue persisted.

  2. Switched Rosenpass from strict to permissive — issue persisted.

  3. Enabled Force Relay (NB_FORCE_RELAY: true) — confirmed active in logs. All peers connected via relay with successful WireGuard handshakes (peer connection metrics [selfhosted, relay, initial]). Still zero packets sent from iPhone.

  4. Verified ACL policies — Default bidirectional policy (All → All, all protocols, all ports) is active. iPhone is confirmed to be in the All group.

  5. Checked for stale/duplicate peer registrations — none found via GET /api/peers.

  6. Confirmed DNS is not the issue — removed custom upstream nameserver configuration. DNS resolves correctly (immich.netbird.selfhosted → 100.81.0.244).

  7. Pinged by NetBird IP directly — bypassed DNS entirely by pinging 100.81.0.244 directly. Still 100% packet loss.

  8. Tested on both WiFi and cellular — issue identical on both networks.

What the logs show

The tunnel negotiation completes perfectly:

  • ICE succeeds with direct P2P paths and low RTTs (4–16ms)
  • WireGuard handshakes complete for all peers in both P2P and relay modes
  • DNS resolves correctly
  • No errors after Rosenpass and custom DNS were removed

However, tcpdump on peer machines confirms zero packets ever arrive from 100.81.213.209 (the iPhone's NetBird IP), and wg show confirms 0 bytes.

A recurring error present in all log sessions:

client/iface/configurer/usp.go:316: failed to open uapi listener: 
mkdir /var/run/wireguard: operation not permitted

This appears at every startup. While iOS cannot create /var/run/wireguard due to sandbox restrictions, it is unclear whether this causes the data plane failure or is expected and handled by the iOS-specific code path.

Also present at every startup:

failed to handle message: wrongly addressed message y9TsYrI4vzWR9qAP9PuoiGnCVLO+wirUz+X7a7bAs3Y=
failed to handle message: wrongly addressed message HTVF+yglC9ndl0E0VPk76A/qxgy79FQnTAfn3DXzsyo=

Are you using NetBird Cloud?
Self-hosted, combined container (netbirdio/netbird-server:latest, version 0.67.1), installed via getting-started.sh with Nginx Proxy Manager as external reverse proxy.

NetBird version

  • Server: 0.67.2 (netbirdio/netbird-server:latest)
  • iOS app: 0.67.1 (ios/arm64)
  • MacBook peer: 0.67.2
  • Linux peers: 0.67.2

NetBird status -d output
Not directly available from iOS. From a Linux peer, the iPhone peer shows:

  • Status: Connected
  • Connection type: Relayed (with force relay) / P2P (without)
  • Last WireGuard handshake: recent and updating
  • Transfer status (received/sent): X KiB received / 0 B sent

Screenshots
Ping tool in iOS NetBird app showing 100% packet loss to 100.81.0.244 (peer NetBird IP) with force relay enabled.

Additional context

  • The MacBook peer running 0.67.2 works perfectly — bidirectional connectivity to all peers
  • Other peers can ping the iPhone successfully (inbound works, outbound does not)
  • The issue is not network-specific — identical behavior on home WiFi and cellular data
  • The client/iface/device/device_ios.go code path is used (Tunnel uses interface: utun10)
  • The userspace proxy factory confirms: WireGuard Proxy Factory will produce bind proxy
  • All peers on the network are running 0.67.1 or 0.67.2 server-side — no version mismatch
  • No other VPN software running on the iPhone
  • iOS Network Extension background restrictions were considered but ruled out since the issue also occurs with the app in the foreground
  • The issue appears to be in the iOS userspace WireGuard data plane — the control plane (handshake, ICE, relay signaling) works correctly, but no data packets are ever injected into or read from the utun10 interface by the app
Originally created by @nonanonymousanon on GitHub (Apr 2, 2026). Original GitHub issue: https://github.com/netbirdio/netbird/issues/5789 **Describe the problem** On iOS, the NetBird app shows all peers as "connected" and WireGuard handshakes complete successfully, but the iPhone sends zero data packets through the tunnel. Other peers can reach the iPhone (one-way connectivity), but the iPhone cannot reach any peers. This occurs on both WiFi and cellular, with both P2P and forced relay, and persists across all troubleshooting attempts. **To Reproduce** 1. Install NetBird iOS app on iPhone 2. Connect to a self-hosted NetBird instance 3. Observe peers show as "connected" in the app 4. Attempt to ping any peer by NetBird IP from the iOS ping tool 5. Observe 100% packet loss in both directions from the iPhone 6. Confirm from a Linux/macOS peer that zero packets are received from the iPhone's NetBird IP (`tcpdump -i any host 100.81.213.209 -n`) 7. Confirm WireGuard shows 0 bytes transferred from iPhone (`wg show`) **Expected behavior** The iPhone should be able to send and receive data packets through the NetBird tunnel, allowing bidirectional communication with all peers. **Troubleshooting steps already attempted** All of the following were tried and the issue persisted after each: 1. **Disabled Rosenpass** — original logs showed Rosenpass was enabled in strict mode (`rosenpass is enabled`, `running rosenpass in strict mode`). All peers reported `remote peer does not support rosenpass`. Disabled Rosenpass entirely — issue persisted. 2. **Switched Rosenpass from strict to permissive** — issue persisted. 3. **Enabled Force Relay** (`NB_FORCE_RELAY: true`) — confirmed active in logs. All peers connected via relay with successful WireGuard handshakes (`peer connection metrics [selfhosted, relay, initial]`). Still zero packets sent from iPhone. 4. **Verified ACL policies** — Default bidirectional policy (`All → All`, all protocols, all ports) is active. iPhone is confirmed to be in the `All` group. 5. **Checked for stale/duplicate peer registrations** — none found via `GET /api/peers`. 6. **Confirmed DNS is not the issue** — removed custom upstream nameserver configuration. DNS resolves correctly (`immich.netbird.selfhosted → 100.81.0.244`). 7. **Pinged by NetBird IP directly** — bypassed DNS entirely by pinging `100.81.0.244` directly. Still 100% packet loss. 8. **Tested on both WiFi and cellular** — issue identical on both networks. **What the logs show** The tunnel negotiation completes perfectly: - ICE succeeds with direct P2P paths and low RTTs (4–16ms) - WireGuard handshakes complete for all peers in both P2P and relay modes - DNS resolves correctly - No errors after Rosenpass and custom DNS were removed However, `tcpdump` on peer machines confirms zero packets ever arrive from `100.81.213.209` (the iPhone's NetBird IP), and `wg show` confirms 0 bytes. A recurring error present in all log sessions: ``` client/iface/configurer/usp.go:316: failed to open uapi listener: mkdir /var/run/wireguard: operation not permitted ``` This appears at every startup. While iOS cannot create `/var/run/wireguard` due to sandbox restrictions, it is unclear whether this causes the data plane failure or is expected and handled by the iOS-specific code path. Also present at every startup: ``` failed to handle message: wrongly addressed message y9TsYrI4vzWR9qAP9PuoiGnCVLO+wirUz+X7a7bAs3Y= failed to handle message: wrongly addressed message HTVF+yglC9ndl0E0VPk76A/qxgy79FQnTAfn3DXzsyo= ``` **Are you using NetBird Cloud?** Self-hosted, combined container (`netbirdio/netbird-server:latest`, version `0.67.1`), installed via `getting-started.sh` with Nginx Proxy Manager as external reverse proxy. **NetBird version** - Server: `0.67.2` (`netbirdio/netbird-server:latest`) - iOS app: `0.67.1` (`ios/arm64`) - MacBook peer: `0.67.2` - Linux peers: `0.67.2` **NetBird status -d output** Not directly available from iOS. From a Linux peer, the iPhone peer shows: - Status: Connected - Connection type: Relayed (with force relay) / P2P (without) - Last WireGuard handshake: recent and updating - Transfer status (received/sent): X KiB received / **0 B sent** **Screenshots** Ping tool in iOS NetBird app showing 100% packet loss to `100.81.0.244` (peer NetBird IP) with force relay enabled. **Additional context** - The MacBook peer running `0.67.2` works perfectly — bidirectional connectivity to all peers - Other peers can ping the iPhone successfully (inbound works, outbound does not) - The issue is not network-specific — identical behavior on home WiFi and cellular data - The `client/iface/device/device_ios.go` code path is used (`Tunnel uses interface: utun10`) - The userspace proxy factory confirms: `WireGuard Proxy Factory will produce bind proxy` - All peers on the network are running `0.67.1` or `0.67.2` server-side — no version mismatch - No other VPN software running on the iPhone - iOS Network Extension background restrictions were considered but ruled out since the issue also occurs with the app in the foreground - The issue appears to be in the iOS userspace WireGuard data plane — the control plane (handshake, ICE, relay signaling) works correctly, but no data packets are ever injected into or read from the `utun10` interface by the app
saavagebueno added the triage-needed label 2026-08-05 01:28:24 -04:00
Author
Owner

@nonanonymousanon commented on GitHub (Apr 5, 2026):

This is resolved after updating all unix clients to v0.67.4 and management to v0.67.4. IOS client is still limited to 0.67.1.

<!-- gh-comment-id:4189515966 --> @nonanonymousanon commented on GitHub (Apr 5, 2026): This is resolved after updating all unix clients to v0.67.4 and management to v0.67.4. IOS client is still limited to 0.67.1.
Sign in to join this conversation.
No Label triage-needed
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: DYNR/netbird#11080