[PR #5675] [MERGED] [client] Add IPv6 overlay address support to WireGuard interface and engine #26424

Open
opened 2026-08-05 07:07:20 -04:00 by saavagebueno · 0 comments
Owner

📋 Pull Request Information

Original PR: https://github.com/netbirdio/netbird/pull/5675
Author: @lixmal
Created: 3/24/2026
Status: Merged
Merged: 4/7/2026
Merged by: @lixmal

Base: proto-ipv6-overlayHead: client-ipv6-iface


📝 Commits (10+)

  • b852ce1 Add IPv6 overlay address support to client interface and engine
  • 1a7e835 Fix CodeRabbit findings: hasIPv6Changed restart loop, empty peerIPs panic, v6 validation
  • 878dc45 Fix govet non-constant format string in log.Warnf
  • 71962f8 Add IPv6 reverse DNS and host configurator support
  • d81cd5d Add IPv6 support to SSH server, client config, and netflow logger
  • 3be5a5f Fix CodeRabbit findings: hasIPv6Changed restart loop, empty peerIPs panic, v6 validation
  • 5fcea07 Merge branch 'client-ipv6-iface' into client-ipv6-dns
  • 5a29fa8 Merge branch 'client-ipv6-dns' into client-ipv6-ssh-netflow
  • baf2c03 Fix CodeRabbit findings: hasIPv6Changed restart loop, empty peerIPs panic, v6 validation
  • 641e386 Merge branch 'client-ipv6-iface' into client-ipv6-dns

📊 Changes

77 files changed (+4462 additions, -1731 deletions)

View changed files

📝 .github/workflows/wasm-build-validation.yml (+2 -2)
📝 client/android/client.go (+5 -4)
📝 client/android/peer_notifier.go (+1 -0)
📝 client/android/preferences.go (+18 -0)
📝 client/cmd/status.go (+12 -2)
📝 client/cmd/system.go (+5 -0)
📝 client/cmd/up.go (+12 -0)
📝 client/embed/embed.go (+3 -0)
📝 client/iface/device/device_darwin.go (+21 -12)
📝 client/iface/device/device_ios.go (+5 -2)
📝 client/iface/device/device_kernel_unix.go (+1 -1)
📝 client/iface/device/device_netstack.go (+7 -2)
📝 client/iface/device/device_usp_unix.go (+16 -16)
📝 client/iface/device/device_windows.go (+28 -3)
client/iface/device/kernel_module.go (+0 -8)
client/iface/device/kernel_module_freebsd.go (+0 -18)
client/iface/device/kernel_module_nonlinux.go (+13 -0)
📝 client/iface/device/wg_link_freebsd.go (+14 -13)
📝 client/iface/device/wg_link_linux.go (+29 -12)
📝 client/iface/iface.go (+3 -8)

...and 57 more files

📄 Description

Describe your changes

  • Add addrFamily abstraction encapsulating IPv4/IPv6 header offsets, address lengths, set key types, and ICMP protocol numbers
  • Create parallel ip6 netbird table with its own router and ACL manager when the interface has IPv6
  • Route all firewall operations to the correct table by address family
  • Split UpdateSet prefixes by family for dynamic DNS route sets
  • Add IPv6 interval set tests (TestNftablesCreateIpSet_IPv6) and calculateLastIP tests covering both families
  • MSS clamping uses correct overhead per family (40 for v4, 60 for v6)

Stacked on #5706.

Stack

Checklist

  • Is it a bug fix
  • Is a typo/documentation fix
  • Is a feature enhancement
  • It is a refactor
  • Created tests that fail without the change (if possible)

By submitting this pull request, you confirm that you have read and agree to the terms of the Contributor License Agreement.

Documentation

Select exactly one:

  • I added/updated documentation for this change
  • Documentation is not needed for this change (explain why)

Docs PR URL (required if "docs added" is checked)

Paste the PR link from https://github.com/netbirdio/docs here:

https://github.com/netbirdio/docs/pull/667

Summary by CodeRabbit

  • New Features

    • Added IPv6 firewall support for filtering and routing rules alongside existing IPv4 capabilities.
    • Firewall now independently manages both IPv4 and IPv6 traffic.
  • Tests

    • Comprehensive IPv6 test coverage for IP set creation, address calculations, and protocol handling.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/netbirdio/netbird/pull/5675 **Author:** [@lixmal](https://github.com/lixmal) **Created:** 3/24/2026 **Status:** ✅ Merged **Merged:** 4/7/2026 **Merged by:** [@lixmal](https://github.com/lixmal) **Base:** `proto-ipv6-overlay` ← **Head:** `client-ipv6-iface` --- ### 📝 Commits (10+) - [`b852ce1`](https://github.com/netbirdio/netbird/commit/b852ce1a99a2ceff190290f629ae8b8706dc6e84) Add IPv6 overlay address support to client interface and engine - [`1a7e835`](https://github.com/netbirdio/netbird/commit/1a7e8359499e0cdb72f7afa855cf9abbf67c9700) Fix CodeRabbit findings: hasIPv6Changed restart loop, empty peerIPs panic, v6 validation - [`878dc45`](https://github.com/netbirdio/netbird/commit/878dc45abf5e0269ed36dd7ce3ba019205e23197) Fix govet non-constant format string in log.Warnf - [`71962f8`](https://github.com/netbirdio/netbird/commit/71962f88f8b71c01c046015d038a9d95b40dbdbc) Add IPv6 reverse DNS and host configurator support - [`d81cd5d`](https://github.com/netbirdio/netbird/commit/d81cd5d154c67d47b6e0864f32e39d973d3a5761) Add IPv6 support to SSH server, client config, and netflow logger - [`3be5a5f`](https://github.com/netbirdio/netbird/commit/3be5a5f230f18416407d43b646c58e66eb17dc26) Fix CodeRabbit findings: hasIPv6Changed restart loop, empty peerIPs panic, v6 validation - [`5fcea07`](https://github.com/netbirdio/netbird/commit/5fcea071813ca962e77cdeda28abd1e8fdb3ef30) Merge branch 'client-ipv6-iface' into client-ipv6-dns - [`5a29fa8`](https://github.com/netbirdio/netbird/commit/5a29fa8432a4a504b435bbe1e401fc17e3724b1a) Merge branch 'client-ipv6-dns' into client-ipv6-ssh-netflow - [`baf2c03`](https://github.com/netbirdio/netbird/commit/baf2c035085abd1856efa4d237ba2a730c1c7bf4) Fix CodeRabbit findings: hasIPv6Changed restart loop, empty peerIPs panic, v6 validation - [`641e386`](https://github.com/netbirdio/netbird/commit/641e3861c11b4c62137a71d1658c1fc721ae5dcb) Merge branch 'client-ipv6-iface' into client-ipv6-dns ### 📊 Changes **77 files changed** (+4462 additions, -1731 deletions) <details> <summary>View changed files</summary> 📝 `.github/workflows/wasm-build-validation.yml` (+2 -2) 📝 `client/android/client.go` (+5 -4) 📝 `client/android/peer_notifier.go` (+1 -0) 📝 `client/android/preferences.go` (+18 -0) 📝 `client/cmd/status.go` (+12 -2) 📝 `client/cmd/system.go` (+5 -0) 📝 `client/cmd/up.go` (+12 -0) 📝 `client/embed/embed.go` (+3 -0) 📝 `client/iface/device/device_darwin.go` (+21 -12) 📝 `client/iface/device/device_ios.go` (+5 -2) 📝 `client/iface/device/device_kernel_unix.go` (+1 -1) 📝 `client/iface/device/device_netstack.go` (+7 -2) 📝 `client/iface/device/device_usp_unix.go` (+16 -16) 📝 `client/iface/device/device_windows.go` (+28 -3) ➖ `client/iface/device/kernel_module.go` (+0 -8) ➖ `client/iface/device/kernel_module_freebsd.go` (+0 -18) ➕ `client/iface/device/kernel_module_nonlinux.go` (+13 -0) 📝 `client/iface/device/wg_link_freebsd.go` (+14 -13) 📝 `client/iface/device/wg_link_linux.go` (+29 -12) 📝 `client/iface/iface.go` (+3 -8) _...and 57 more files_ </details> ### 📄 Description ## Describe your changes - Add `addrFamily` abstraction encapsulating IPv4/IPv6 header offsets, address lengths, set key types, and ICMP protocol numbers - Create parallel `ip6 netbird` table with its own router and ACL manager when the interface has IPv6 - Route all firewall operations to the correct table by address family - Split `UpdateSet` prefixes by family for dynamic DNS route sets - Add IPv6 interval set tests (`TestNftablesCreateIpSet_IPv6`) and `calculateLastIP` tests covering both families - MSS clamping uses correct overhead per family (40 for v4, 60 for v6) Stacked on #5706. ## Issue ticket number and link ## Stack - #5631 - #5675 :point_left: - #5686 - #5687 - #5688 - #5706 - #5707 - #5708 ### Checklist - [ ] Is it a bug fix - [ ] Is a typo/documentation fix - [x] Is a feature enhancement - [ ] It is a refactor - [x] Created tests that fail without the change (if possible) > By submitting this pull request, you confirm that you have read and agree to the terms of the [Contributor License Agreement](https://github.com/netbirdio/netbird/blob/main/CONTRIBUTOR_LICENSE_AGREEMENT.md). ## Documentation Select exactly one: - [x] I added/updated documentation for this change - [ ] Documentation is **not needed** for this change (explain why) ### Docs PR URL (required if "docs added" is checked) Paste the PR link from https://github.com/netbirdio/docs here: https://github.com/netbirdio/docs/pull/667 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added IPv6 firewall support for filtering and routing rules alongside existing IPv4 capabilities. * Firewall now independently manages both IPv4 and IPv6 traffic. * **Tests** * Comprehensive IPv6 test coverage for IP set creation, address calculations, and protocol handling. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
saavagebueno added the pull-request label 2026-08-05 07:07:20 -04:00
Sign in to join this conversation.
No Label pull-request
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: DYNR/netbird#26424