[PR #1667] [MERGED] Feature/exit nodes - Linux support #14139

Closed
opened 2026-08-05 02:09:29 -04:00 by saavagebueno · 0 comments
Owner

📋 Pull Request Information

Original PR: https://github.com/netbirdio/netbird/pull/1667
Author: @lixmal
Created: 3/5/2024
Status: Merged
Merged: 3/21/2024
Merged by: @lixmal

Base: mainHead: feature/exit-nodes


📝 Commits (10+)

  • d667bcf Make gRPC dialers use fwmark
  • bec57e5 Improve error handling
  • a806218 Add fwmark to wireguard interface
  • 38751f9 Add fwmark to ICE connections
  • c1781c6 Remove prefix length restriction
  • c5d4a24 Make routing operations table-aware and add new operations
  • 82433fb Mark missing sockets without fwmark and streamline existing markings
  • 0f71870 Add default route handling
  • d60f1ed Improve socket error handling
  • 20c57b5 Rename and move packages

📊 Changes

41 files changed (+1632 additions, -352 deletions)

View changed files

📝 .github/workflows/golang-test-linux.yml (+10 -6)
📝 .github/workflows/golangci-lint.yml (+1 -1)
📝 client/internal/engine.go (+13 -9)
📝 client/internal/relay/relay.go (+20 -4)
📝 client/internal/routemanager/client.go (+36 -27)
📝 client/internal/routemanager/manager.go (+45 -7)
📝 client/internal/routemanager/manager_test.go (+18 -10)
📝 client/internal/routemanager/mock.go (+4 -0)
📝 client/internal/routemanager/server_nonandroid.go (+37 -14)
📝 client/internal/routemanager/systemops_android.go (+2 -2)
📝 client/internal/routemanager/systemops_bsd.go (+0 -1)
client/internal/routemanager/systemops_bsd_nonios.go (+13 -0)
📝 client/internal/routemanager/systemops_ios.go (+2 -4)
📝 client/internal/routemanager/systemops_linux.go (+370 -77)
client/internal/routemanager/systemops_linux_test.go (+469 -0)
📝 client/internal/routemanager/systemops_nonandroid.go (+83 -55)
📝 client/internal/routemanager/systemops_nonandroid_test.go (+68 -74)
📝 client/internal/routemanager/systemops_nonlinux.go (+4 -23)
client/internal/routemanager/systemops_nonlinux_test.go (+80 -0)
📝 client/internal/routemanager/systemops_windows.go (+13 -2)

...and 21 more files

📄 Description

This PR adds client default route support for Linux clients:

  • Route Management: Establishes routes, including the default route, in a dedicated routing table, enabling VPN traffic to be correctly routed through the VPN tunnel while maintaining access to local and management networks.
  • Routing Rules: Implements several routing rules to ensure management traffic always uses the physical interface. It prioritizes existing local routes over VPN routes and directs all unmatched routes to the VPN routing table.
  • Custom fwmark applications: Applies a custom fwmark to all management network connections, including gRPC for signal and management servers, the eBPF proxy, ICE (STUN/TURN) connections, the shared socket, and the WireGuard interface. This marking system effectively excludes these connections from being routed through the VPN.
  • Enhanced Error Handling and Cleanup: Improves error reporting and handling. It also introduces a comprehensive cleanup routine to revert all changes made to the routing rules and the custom routing table, ensuring no residual configurations that might affect system networking.

The update also includes renaming and reorganizing packages for better clarity and maintenance.

Updates https://github.com/netbirdio/netbird/issues/289

Checklist

  • Is it a bug fix
  • Is a typo/documentation fix
  • Is a feature enhancement
  • It is a refactor
  • Created tests that fail without the change (if possible)
  • Extended the README / documentation, if necessary

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/netbirdio/netbird/pull/1667 **Author:** [@lixmal](https://github.com/lixmal) **Created:** 3/5/2024 **Status:** ✅ Merged **Merged:** 3/21/2024 **Merged by:** [@lixmal](https://github.com/lixmal) **Base:** `main` ← **Head:** `feature/exit-nodes` --- ### 📝 Commits (10+) - [`d667bcf`](https://github.com/netbirdio/netbird/commit/d667bcf5f4cfbd2d7c7a6d36739c3409e521bf50) Make gRPC dialers use fwmark - [`bec57e5`](https://github.com/netbirdio/netbird/commit/bec57e539340c77a8eb413b3cb0f2faaa2c1a986) Improve error handling - [`a806218`](https://github.com/netbirdio/netbird/commit/a806218489e63c17df2a518ee46f7df293784ecb) Add fwmark to wireguard interface - [`38751f9`](https://github.com/netbirdio/netbird/commit/38751f93cf6e90f84e533e23f610a3307f352332) Add fwmark to ICE connections - [`c1781c6`](https://github.com/netbirdio/netbird/commit/c1781c6912a3182df7cd5f715afc4505e4795861) Remove prefix length restriction - [`c5d4a24`](https://github.com/netbirdio/netbird/commit/c5d4a24ee4dc7fd18ab49ed6c7ae4a5d44396934) Make routing operations table-aware and add new operations - [`82433fb`](https://github.com/netbirdio/netbird/commit/82433fbc8e5e4650ca027b0f51605c736eb97e7c) Mark missing sockets without fwmark and streamline existing markings - [`0f71870`](https://github.com/netbirdio/netbird/commit/0f71870887fc5469bf6d0a1de9708f47f0dc587d) Add default route handling - [`d60f1ed`](https://github.com/netbirdio/netbird/commit/d60f1ed075acbacaa134356c5686e92cfd1bd05a) Improve socket error handling - [`20c57b5`](https://github.com/netbirdio/netbird/commit/20c57b506ca9fad6f00c3877c159a2115d676002) Rename and move packages ### 📊 Changes **41 files changed** (+1632 additions, -352 deletions) <details> <summary>View changed files</summary> 📝 `.github/workflows/golang-test-linux.yml` (+10 -6) 📝 `.github/workflows/golangci-lint.yml` (+1 -1) 📝 `client/internal/engine.go` (+13 -9) 📝 `client/internal/relay/relay.go` (+20 -4) 📝 `client/internal/routemanager/client.go` (+36 -27) 📝 `client/internal/routemanager/manager.go` (+45 -7) 📝 `client/internal/routemanager/manager_test.go` (+18 -10) 📝 `client/internal/routemanager/mock.go` (+4 -0) 📝 `client/internal/routemanager/server_nonandroid.go` (+37 -14) 📝 `client/internal/routemanager/systemops_android.go` (+2 -2) 📝 `client/internal/routemanager/systemops_bsd.go` (+0 -1) ➕ `client/internal/routemanager/systemops_bsd_nonios.go` (+13 -0) 📝 `client/internal/routemanager/systemops_ios.go` (+2 -4) 📝 `client/internal/routemanager/systemops_linux.go` (+370 -77) ➕ `client/internal/routemanager/systemops_linux_test.go` (+469 -0) 📝 `client/internal/routemanager/systemops_nonandroid.go` (+83 -55) 📝 `client/internal/routemanager/systemops_nonandroid_test.go` (+68 -74) 📝 `client/internal/routemanager/systemops_nonlinux.go` (+4 -23) ➕ `client/internal/routemanager/systemops_nonlinux_test.go` (+80 -0) 📝 `client/internal/routemanager/systemops_windows.go` (+13 -2) _...and 21 more files_ </details> ### 📄 Description This PR adds client default route support for Linux clients: - **Route Management:** Establishes routes, including the default route, in a dedicated routing table, enabling VPN traffic to be correctly routed through the VPN tunnel while maintaining access to local and management networks. - **Routing Rules:** Implements several routing rules to ensure management traffic always uses the physical interface. It prioritizes existing local routes over VPN routes and directs all unmatched routes to the VPN routing table. - **Custom fwmark applications:** Applies a custom fwmark to all management network connections, including gRPC for signal and management servers, the eBPF proxy, ICE (STUN/TURN) connections, the shared socket, and the WireGuard interface. This marking system effectively excludes these connections from being routed through the VPN. - **Enhanced Error Handling and Cleanup:** Improves error reporting and handling. It also introduces a comprehensive cleanup routine to revert all changes made to the routing rules and the custom routing table, ensuring no residual configurations that might affect system networking. The update also includes renaming and reorganizing packages for better clarity and maintenance. ## Issue ticket number and link Updates https://github.com/netbirdio/netbird/issues/289 ### Checklist - [ ] Is it a bug fix - [ ] Is a typo/documentation fix - [x] Is a feature enhancement - [ ] It is a refactor - [x] Created tests that fail without the change (if possible) - [ ] Extended the README / documentation, if necessary --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
saavagebueno added the pull-request label 2026-08-05 02:09:29 -04:00
Sign in to join this conversation.
No Label pull-request
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: DYNR/netbird#14139