DYNR/netbird
2
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-08-05 00:15:26 -04:00
Code Issues 23.5k Packages Projects Releases 10 Wiki Activity

[PR #1459] Add support for IPv6 networks (on Linux clients) #17075

New Issue
Open
opened 2026-08-05 04:06:54 -04:00 by saavagebueno · 0 comments
saavagebueno commented 2026-08-05 04:06:54 -04:00
Owner
Copy Link

Original Pull Request: https://github.com/netbirdio/netbird/pull/1459

State: closed
Merged: Yes

Describe your changes

This PR adds some initial support for assigning IPv6 addresses to hosts inside of the wireguard network.
For now, only Linux using the kernel module and nftables as the firewall implementation is supported.

Note for reviewers:
I have been working on this on and off for a couple of months and had to merge in a lot of upstream changes, it's probably easier to review the final version instead of going through each commit separately. 😅

Notes on address assignment

On network creation (or assignment of the first IPv6 address for existing networks), a random /64 prefix in the ULA range is generated, which will be used for devices on the network.
On enabling IPv6 on supported hosts, a random address will be generated for the host.
Disabling and then re-enabling IPv6 results in a new IPv6 address being generated.

Testing

I have tested this PR on the following clients:

  • Linux (both using kernel wireguard, which supports IPv6, and tun, which does not)
  • Windows (which does not support IPv6)
  • Version 0.25.2 on linux combined with the management server built from this branch

Unfortunately, I don't have the environment set up and/or lack the devices to test other operating systems.

How to test:

  1. Spin up an instance of the management server from this branch, as well as an instance of the frontend with the necessary changes (see the corresponding PR in the dashboard repository).
  2. Build and run the netbird client from this branch, add it to the management server.
  3. Open the frontend, and enable ipv6 in the peer settings.
    grafik
  4. Alternatively, leave the peer IPv6 setting at "Inherit from Groups" (the default) and instead enable IPv6 for all hosts in a group in the group settings.
    grafik
  5. Look at the Wireguard interface/firewall/route configuration on the clients, test pinging the devices using IPv6, etc.

Known issues and TODOs

  • Update dashboard changes to work with new dashboard versions
  • Integrate with Groups (allow enabling IPv6 for an entire Group at once)
  • During development, i have seen problems when updating a peer from a non-IPv6-supported version to an IPv6-supported version (other peers do not establish connections properly until they are restarted)
    • unsure if this is still the case or if other changes i made fixed that by now haven't seen this problem during my testing anymore
  • When the nftables-backend is used but IPv6 is disabled by the management server, we still create an (empty) firewall table
    • maybe problematic if the peer does not support IPv6 at all (disabled kernel support, etc.)
  • Improve handling of IPv6 routes
    • Prevent creation of IPv6 routes with routing peers or groups that have IPv6 disabled
      • Disabling for groups might be too inflexible, you might actually want to use an existing group with IPv6 disabled for an IPv6 route, if some of the hosts have IPv6 enabled through other means.
    • Disallow disabling IPv6 for peer if it is acting as a routing peer for an IPv6 route
      • I instead opted for the approach listed in the next bullet point
    • Automatically disable all IPv6 routes if IPv6 is disabled for a peer.
      • The "Inherit from Groups" setting should be renamed to "Auto" and also automatically enable IPv6 if peer is IPv6 routing peer.
    • Disable routing peers/groups if they no longer support IPv6 (e.g. because of a downgrade)
    • Ensure that only IPv6-enabled group members are distributed as routing peers if group is used as routing peer
      • (unsure if this is already the case)
  • Improve handling of IPv6 Nameservers
    • Distribute IPv6 Nameserver IPs to IPv6 enabled peers only
  • Fix compilation issues on non-linux targets caused by my last changes
  • Write some more test cases, make sure the existing ones all pass
    • Fix existing test cases
    • Write test cases for client
    • Write test cases for management server
  • Documentation

Adding support for other operating systems/Linux with iptables/uspfilter is probably something better suited for a separate PR, considering the current size of this one.
I have done some preliminary testing with enabling IPv6 on Windows in one of the older commits - assignment of IPv6 addresses is pretty trivial. However, due to some issue (probably routing), I wasn't able to ping other peers, which is why I did not include it for this PR.

Issue ticket number and link

Resolves (partially) #1167 and #46

Checklist

  • Is it a bug fix
  • Is a typo/documentation fix
  • Is a feature enhancement
  • It is a refactor
  • Created tests that fail without the change (if possible)
  • Extended the README / documentation, if necessary
**Original Pull Request:** https://github.com/netbirdio/netbird/pull/1459 **State:** closed **Merged:** Yes --- ## Describe your changes This PR adds some initial support for assigning IPv6 addresses to hosts inside of the wireguard network. For now, only Linux using the kernel module and nftables as the firewall implementation is supported. **Note for reviewers:** I have been working on this on and off for a couple of months and had to merge in a lot of upstream changes, it's probably easier to review the final version instead of going through each commit separately. :sweat_smile: ### Notes on address assignment On network creation (or assignment of the first IPv6 address for existing networks), a random /64 prefix in the ULA range is generated, which will be used for devices on the network. On enabling IPv6 on supported hosts, a random address will be generated for the host. Disabling and then re-enabling IPv6 results in a new IPv6 address being generated. ### Testing I have tested this PR on the following clients: - Linux (both using kernel wireguard, which supports IPv6, and tun, which does not) - Windows (which does not support IPv6) - Version 0.25.2 on linux combined with the management server built from this branch Unfortunately, I don't have the environment set up and/or lack the devices to test other operating systems. How to test: 1. Spin up an instance of the management server from this branch, as well as an instance of the frontend with the necessary changes (see the corresponding [PR in the dashboard repository](https://github.com/netbirdio/dashboard/pull/314)). 2. Build and run the netbird client from this branch, add it to the management server. 3. Open the frontend, and enable ipv6 in the peer settings. ![grafik](https://github.com/netbirdio/netbird/assets/13301997/c48f38bf-3461-4c02-bc40-f069f805dd0c) 4. Alternatively, leave the peer IPv6 setting at "Inherit from Groups" (the default) and instead enable IPv6 for all hosts in a group in the group settings. ![grafik](https://github.com/netbirdio/netbird/assets/13301997/7164e5ae-d01d-4df2-86b3-01d9ccb03171) 5. Look at the Wireguard interface/firewall/route configuration on the clients, test pinging the devices using IPv6, etc. ### Known issues and TODOs - [x] Update dashboard changes to work with new dashboard versions - [x] Integrate with Groups (allow enabling IPv6 for an entire Group at once) - [x] During development, i have seen problems when updating a peer from a non-IPv6-supported version to an IPv6-supported version (other peers do not establish connections properly until they are restarted) - ~~unsure if this is still the case or if other changes i made fixed that by now~~ haven't seen this problem during my testing anymore - [x] When the nftables-backend is used but IPv6 is disabled by the management server, we still create an (empty) firewall table - maybe problematic if the peer does not support IPv6 at all (disabled kernel support, etc.) - [x] Improve handling of IPv6 routes - [x] Prevent creation of IPv6 routes with routing peers ~~or groups~~ that have IPv6 disabled - Disabling for groups might be too inflexible, you might actually want to use an existing group with IPv6 disabled for an IPv6 route, if some of the hosts have IPv6 enabled through other means. - [x] ~~Disallow disabling IPv6 for peer if it is acting as a routing peer for an IPv6 route~~ - I instead opted for the approach listed in the next bullet point - [x] Automatically disable all IPv6 routes if IPv6 is disabled for a peer. - [x] The "Inherit from Groups" setting should be renamed to "Auto" and also automatically enable IPv6 if peer is IPv6 routing peer. - [x] Disable routing peers/groups if they no longer support IPv6 (e.g. because of a downgrade) - [x] Ensure that only IPv6-enabled group members are distributed as routing peers if group is used as routing peer - (unsure if this is already the case) - [x] Improve handling of IPv6 Nameservers - [x] Distribute IPv6 Nameserver IPs to IPv6 enabled peers only - [x] Fix compilation issues on non-linux targets caused by my last changes - [x] Write some more test cases, make sure the existing ones all pass - [x] Fix existing test cases - [x] Write test cases for client - Note that due to the [lack of IPv6 support on GitHub Actions runners](https://github.com/actions/runner-images/issues/668#issuecomment-624080758), the IPv6 tests will be skipped there. Make sure to run them locally in order to verify that they pass. - [x] Write test cases for management server - [x] Documentation - can be found in netbirdio/docs#165 Adding support for other operating systems/Linux with iptables/uspfilter is probably something better suited for a separate PR, considering the current size of this one. I have done some preliminary testing with enabling IPv6 on Windows in one of the older commits - assignment of IPv6 addresses is pretty trivial. However, due to some issue (probably routing), I wasn't able to ping other peers, which is why I did not include it for this PR. ## Issue ticket number and link Resolves (partially) #1167 and #46 ### Checklist - [ ] ~~Is it a bug fix~~ - [ ] ~~Is a typo/documentation fix~~ - [x] Is a feature enhancement - [ ] ~~It is a refactor~~ - [x] Created tests that fail without the change (if possible) - [x] Extended the README / documentation, if necessary
saavagebueno added the pull-request label 2026-08-05 04:06:54 -04:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
2021 Q4
2021 Q4
2021 Q4
2022 Q1
2022 Q1
2022 Q1
2022 Q1
2022 Q1
2022 Q1
accessibility
accessibility
accessibility
acl
acl
acl
agent
agent
agent
agent
agent
agent
Android
Android
Android
Android
Android
Android
api
api
api
authentik
authentik
authentik
automation
automation
automation
azure
azure
azure
battery-usage
battery-usage
battery-usage
bug
cache
cache
cache
client
client
client
client-ui
client-ui
client-ui
cloud
cloud
cloud
cloud-only
cloud-only
cloud-only
cloudflare
cloudflare
cloudflare
community
community
community
compatibility
compatibility
compatibility
config-idp
config-idp
config-idp
config-issue
config-issue
config-issue
connection
connection
connection
contribution
contribution
contribution
coturn
coturn
coturn
cross-vpn
cross-vpn
cross-vpn
dashboard
dashboard
dashboard
data-usage
data-usage
data-usage
distribution
distribution
distribution
dns
dns
dns
docker
docker
docker
documentation
documentation
documentation
duplicate
duplicate
duplicate
enhancement
enhancement
event-stream
event-stream
event-stream
feature-request
feature-request
feature-request
freebsd
freebsd
freebsd
getting-started
getting-started
getting-started
go
go
go
good first issue
good first issue
good first issue
gui
gui
gui
help wanted
help wanted
help wanted
home-assistant
home-assistant
home-assistant
idp
idp
idp
inconsistency
inconsistency
inconsistency
integration
integration
integration
integrations
integrations
integrations
ios
ios
ios
ipv6
ipv6
ipv6
jwt
jwt
jwt
k8s
k8s
k8s
keycloak
keycloak
keycloak
linux
linux
linux
login
login
login
macos
macos
macos
management-service
management-service
management-service
Medium
Medium
Medium
missing-docs
missing-docs
missing-docs
mobile
mobile
mobile
moved-internal
moved-internal
moved-internal
needs-review
needs-review
needs-review
netbird-ui
netbird-ui
netbird-ui
networking
networking
networking
new-platform
new-platform
new-platform
nginx
nginx
nginx
notification
notification
notification
okta
okta
okta
openwrt
openwrt
openwrt
P2
P2
P2
packaging
packaging
packaging
peer-management
peer-management
peer-management
peer-management
peer-management
peer-management
peer-management
peer-management
peer-management
performance
performance
performance
postgres
postgres
postgres
posture-checks
posture-checks
posture-checks
psk
psk
psk
pull-request
Mirrored from GitHub Pull Request
 question
question
question
refactor
refactor
refactor
relay
relay
relay
release
release
release
rfc
rfc
rfc
routes
routes
routes
security
security
security
security-improvement
security-improvement
security-improvement
security-related
security-related
security-related
self-hosting
self-hosting
self-hosting
server
server
server
signal
signal
signal
sleep-issue
sleep-issue
sleep-issue
ssh
ssh
ssh
ssl
ssl
ssl
status
status
status
store
store
store
synology
synology
synology
system-compatibility-issue
system-compatibility-issue
system-compatibility-issue
test-suite
test-suite
test-suite
third-party-integration
third-party-integration
third-party-integration
triage
triage
triage
triage
triage
triage
triage-needed
triage-needed
triage-needed
troubleshooting
troubleshooting
troubleshooting
UX
UX
UX
waiting-feedback
waiting-feedback
waiting-feedback
windows
windows
windows
wontfix
wontfix
wontfix
zitadel
zitadel
zitadel
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
dynr-servers saavagebueno
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: DYNR/netbird#17075
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?