DYNR/netbird
2
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-08-05 00:15:26 -04:00
Code Issues 23.5k Packages Projects Releases 10 Wiki Activity

[GH-ISSUE #3591] Port WireGuard hooks to netbird #7542

New Issue
Open
opened 2026-08-05 01:13:26 -04:00 by saavagebueno · 5 comments
saavagebueno commented 2026-08-05 01:13:26 -04:00
Owner
Copy Link

Originally created by @gslongo on GitHub (Mar 27, 2025).
Original GitHub issue: https://github.com/netbirdio/netbird/issues/3591

Is your feature request related to a problem? Please describe.
We are trying to build complex network use case and take benefits of Netbird. However we are facing to some lack of features compared to a "Standard" wireguard setup. Especially with hook commands:

  • PreUp
  • PostUp
  • PreDown
  • PostDown

Describe the solution you'd like
Add an option to run hook commands when setting up a tunnel (or shutting down)

Describe alternatives you've considered
Do not use Netbird, use raw wireguard implementation

Additional context
The context here is to allow L2 packets inside the tunnel by creating an additional tunnel over wireguard like L2TP, VXLAN,...

Originally created by @gslongo on GitHub (Mar 27, 2025). Original GitHub issue: https://github.com/netbirdio/netbird/issues/3591 **Is your feature request related to a problem? Please describe.** We are trying to build complex network use case and take benefits of Netbird. However we are facing to some lack of features compared to a "Standard" wireguard setup. Especially with hook commands: - PreUp - PostUp - PreDown - PostDown **Describe the solution you'd like** Add an option to run hook commands when setting up a tunnel (or shutting down) **Describe alternatives you've considered** Do not use Netbird, use raw wireguard implementation **Additional context** The context here is to allow L2 packets inside the tunnel by creating an additional tunnel over wireguard like L2TP, VXLAN,...
saavagebueno added the feature-request label 2026-08-05 01:13:26 -04:00
saavagebueno commented 2026-08-05 01:13:26 -04:00
Author
Owner
Copy Link

@nazarewk commented on GitHub (Mar 27, 2025):

Actually, few hours ago I brought up this (almost) exact topic for tomorrow's roadmap planning, it was met with enthusiasm: "we already had similar thoughts on plugins/webassembly support".

In summary, we should be able to relatively easily plug in external scripts to the following events:

  • (dis)connecting to management
  • (dis)connecting to peer
    • possibly changing peer’s
  • adding/deleting/reconfiguring networks
  • adding/deleting/reconfiguring nameservers

Still I cannot guarantee or commit to making it happen anytime soon.

<!-- gh-comment-id:2758460682 --> @nazarewk commented on GitHub (Mar 27, 2025): Actually, few hours ago I brought up this (almost) exact topic for tomorrow's roadmap planning, it was met with enthusiasm: "we already had similar thoughts on plugins/webassembly support". In summary, we should be able to relatively easily plug in external scripts to the following events: - (dis)connecting to management - (dis)connecting to peer - possibly changing peer’s - adding/deleting/reconfiguring networks - adding/deleting/reconfiguring nameservers Still I cannot guarantee or commit to making it happen anytime soon.
saavagebueno commented 2026-08-05 01:13:27 -04:00
Author
Owner
Copy Link

@gslongo commented on GitHub (Mar 28, 2025):

Actually, few hours ago I brought up this (almost) exact topic for tomorrow's roadmap planning, it was met with enthusiasm: "we already had similar thoughts on plugins/webassembly support".

In summary, we should be able to relatively easily plug in external scripts to the following events:

* (dis)connecting to management

* (dis)connecting to peer
  
  * possibly changing peer’s

* adding/deleting/reconfiguring networks

* adding/deleting/reconfiguring nameservers

Still I cannot guarantee or commit to making it happen anytime soon.

Thank you for you answer :-) I would appreciate if you let me know the outcome of your proposal to the roadmap (accepted or rejected). Have a good day !

<!-- gh-comment-id:2760451532 --> @gslongo commented on GitHub (Mar 28, 2025): > Actually, few hours ago I brought up this (almost) exact topic for tomorrow's roadmap planning, it was met with enthusiasm: "we already had similar thoughts on plugins/webassembly support". > > In summary, we should be able to relatively easily plug in external scripts to the following events: > > * (dis)connecting to management > > * (dis)connecting to peer > > * possibly changing peer’s > > * adding/deleting/reconfiguring networks > > * adding/deleting/reconfiguring nameservers > > > Still I cannot guarantee or commit to making it happen anytime soon. Thank you for you answer :-) I would appreciate if you let me know the outcome of your proposal to the roadmap (accepted or rejected). Have a good day !
saavagebueno commented 2026-08-05 01:13:27 -04:00
Author
Owner
Copy Link

@gslongo commented on GitHub (Apr 9, 2025):

Hi @nazarewk ! :-)
Could you tell me if it has been included in the roadmap ?

Thanks !

<!-- gh-comment-id:2788816763 --> @gslongo commented on GitHub (Apr 9, 2025): Hi @nazarewk ! :-) Could you tell me if it has been included in the roadmap ? Thanks !
saavagebueno commented 2026-08-05 01:13:27 -04:00
Author
Owner
Copy Link

@nazarewk commented on GitHub (Apr 9, 2025):

Could you tell me if it has been included in the roadmap ?

Yes, it is planned for the second half of 2025 if it gains any traction.

We are considering 2 approaches to the problem:

  1. Signed & verified (trusted) plugins that the client would execute directly: WebAssembly, Go or some other embedded language.
  2. Local stream of events that the user/system administrator could listen to and react to asynchronously (without blocking further handling). It could take the form of a log file (JSON event per line) or some other interface.

The team veers towards secure plugins, while I personally prefer the second approach.
It would put all the responsibility on the user (after all, we wouldn't be executing anything ourselves), but it would be significantly simpler to implement and maintain.

What do you think? Maybe you'd have other ideas?

<!-- gh-comment-id:2789391009 --> @nazarewk commented on GitHub (Apr 9, 2025): > Could you tell me if it has been included in the roadmap ? Yes, it is planned for the second half of 2025 if it gains any traction. We are considering 2 approaches to the problem: 1. Signed & verified (trusted) plugins that the client would execute directly: WebAssembly, Go or some other embedded language. 2. Local stream of events that the user/system administrator could listen to and react to asynchronously (without blocking further handling). It could take the form of a log file (JSON event per line) or some other interface. The team veers towards secure plugins, while I personally prefer the second approach. It would put all the responsibility on the user (after all, we wouldn't be executing anything ourselves), but it would be significantly simpler to implement and maintain. What do you think? Maybe you'd have other ideas?
saavagebueno commented 2026-08-05 01:13:27 -04:00
Author
Owner
Copy Link

@gslongo commented on GitHub (Apr 10, 2025):

Thank you for answer @nazarewk. I appreciate.

The first option seems too heavy to implement and maintain with regard to the use case of these plugins (probably very simple actions).
I would consider a variant of the second option, KISS. For instance, enabling the configuration of scripts triggered by events could be a compelling approach. This could involve maintaining a dedicated folder for each event type, where scripts or binaries can be placed and executed with the aid of environment variables. It's a straightforward, easy to implement, effortless to maintain, and universally compatible across platforms

/etc/netbird/hooks/pre-up.d/01_script.sh
/etc/netbird/hooks/pre-up.d/05_script.py
/etc/netbird/hooks/post-up.d/02_bin_software
/etc/netbird/hooks/post-down.d/05_shutdown_tunnel.py

What do you think ?

Thank you very much !

On another note, do you know if there's any plan to work on this feature request https://github.com/netbirdio/netbird/issues/1633 ? It's also a big concern in our project, because we could have to manage huge number of peers.

<!-- gh-comment-id:2791745360 --> @gslongo commented on GitHub (Apr 10, 2025): Thank you for answer @nazarewk. I appreciate. The first option seems too heavy to implement and maintain with regard to the use case of these plugins (probably very simple actions). I would consider a variant of the second option, KISS. For instance, enabling the configuration of scripts triggered by events could be a compelling approach. This could involve maintaining a dedicated folder for each event type, where scripts or binaries can be placed and executed with the aid of environment variables. It's a straightforward, easy to implement, effortless to maintain, and universally compatible across platforms ``` /etc/netbird/hooks/pre-up.d/01_script.sh /etc/netbird/hooks/pre-up.d/05_script.py /etc/netbird/hooks/post-up.d/02_bin_software /etc/netbird/hooks/post-down.d/05_shutdown_tunnel.py ``` What do you think ? Thank you very much ! On another note, do you know if there's any plan to work on this feature request https://github.com/netbirdio/netbird/issues/1633 ? It's also a big concern in our project, because we could have to manage huge number of peers.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
2021 Q4
2021 Q4
2021 Q4
2022 Q1
2022 Q1
2022 Q1
2022 Q1
2022 Q1
2022 Q1
accessibility
accessibility
accessibility
acl
acl
acl
agent
agent
agent
agent
agent
agent
Android
Android
Android
Android
Android
Android
api
api
api
authentik
authentik
authentik
automation
automation
automation
azure
azure
azure
battery-usage
battery-usage
battery-usage
bug
cache
cache
cache
client
client
client
client-ui
client-ui
client-ui
cloud
cloud
cloud
cloud-only
cloud-only
cloud-only
cloudflare
cloudflare
cloudflare
community
community
community
compatibility
compatibility
compatibility
config-idp
config-idp
config-idp
config-issue
config-issue
config-issue
connection
connection
connection
contribution
contribution
contribution
coturn
coturn
coturn
cross-vpn
cross-vpn
cross-vpn
dashboard
dashboard
dashboard
data-usage
data-usage
data-usage
distribution
distribution
distribution
dns
dns
dns
docker
docker
docker
documentation
documentation
documentation
duplicate
duplicate
duplicate
enhancement
enhancement
event-stream
event-stream
event-stream
feature-request
feature-request
feature-request
freebsd
freebsd
freebsd
getting-started
getting-started
getting-started
go
go
go
good first issue
good first issue
good first issue
gui
gui
gui
help wanted
help wanted
help wanted
home-assistant
home-assistant
home-assistant
idp
idp
idp
inconsistency
inconsistency
inconsistency
integration
integration
integration
integrations
integrations
integrations
ios
ios
ios
ipv6
ipv6
ipv6
jwt
jwt
jwt
k8s
k8s
k8s
keycloak
keycloak
keycloak
linux
linux
linux
login
login
login
macos
macos
macos
management-service
management-service
management-service
Medium
Medium
Medium
missing-docs
missing-docs
missing-docs
mobile
mobile
mobile
moved-internal
moved-internal
moved-internal
needs-review
needs-review
needs-review
netbird-ui
netbird-ui
netbird-ui
networking
networking
networking
new-platform
new-platform
new-platform
nginx
nginx
nginx
notification
notification
notification
okta
okta
okta
openwrt
openwrt
openwrt
P2
P2
P2
packaging
packaging
packaging
peer-management
peer-management
peer-management
peer-management
peer-management
peer-management
peer-management
peer-management
peer-management
performance
performance
performance
postgres
postgres
postgres
posture-checks
posture-checks
posture-checks
psk
psk
psk
pull-request
Mirrored from GitHub Pull Request
 question
question
question
refactor
refactor
refactor
relay
relay
relay
release
release
release
rfc
rfc
rfc
routes
routes
routes
security
security
security
security-improvement
security-improvement
security-improvement
security-related
security-related
security-related
self-hosting
self-hosting
self-hosting
server
server
server
signal
signal
signal
sleep-issue
sleep-issue
sleep-issue
ssh
ssh
ssh
ssl
ssl
ssl
status
status
status
store
store
store
synology
synology
synology
system-compatibility-issue
system-compatibility-issue
system-compatibility-issue
test-suite
test-suite
test-suite
third-party-integration
third-party-integration
third-party-integration
triage
triage
triage
triage
triage
triage
triage-needed
triage-needed
triage-needed
troubleshooting
troubleshooting
troubleshooting
UX
UX
UX
waiting-feedback
waiting-feedback
waiting-feedback
windows
windows
windows
wontfix
wontfix
wontfix
zitadel
zitadel
zitadel
No Label feature-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
dynr-servers saavagebueno
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: DYNR/netbird#7542
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?