[GH-ISSUE #4619] Traffic inspection with Zenarmor on OPNsense #9884

Closed
opened 2026-08-05 01:23:51 -04:00 by saavagebueno · 6 comments
Owner

Originally created by @on-nightingale on GitHub (Oct 10, 2025).
Original GitHub issue: https://github.com/netbirdio/netbird/issues/4619

Describe the problem

Zenarmor is a next-generation firewall extension for OPNsense and we are using it to inspect traffic and enforce web filtering. Zenarmor is also able to inspect traffic on Wireguard interfaces.

Using the os-netbird plugin we can successful configure and establish a connection to our self-hosted netbird setup, also other peers can connect with the OPNsense instance. The netbird peer on OPNsense is set up as Exit-Node.

But Zenarmor is not able to see the traffic on the netbird created wireguard interface (wt0).

The only difference I could spot right now is that netbird is running in "userspace" and other Wireguard solutions are running in kernel mode.

To Reproduce

Steps to reproduce the behavior:

  1. Install os-netbird plugin
  2. Set up netbird to connect to self-hosted netbird setup
  3. Go to Interfaces -> Assignments and assign the netbird interface (wt0) with the name netbird
  4. Go to Interfaces -> [netbird] and enable the interface
  5. Go to Zenarmor -> Settings -> Configuration -> Please choose interfaces to protect and select wt0
  6. Save Zenarmor configuration and restart the service
  7. Go to Zenarmor -> Live Sessions -> Connections and observe the connections. No traffic from wt0 will show up.

Expected behavior

Zenarmor should be able to inspect the traffic on Wireguard interfaces created by netbird.

Are you using NetBird Cloud?

  • self-host NetBird's control plane.

NetBird version

  • Netbird 0.59.1
  • OPNsense 25.7.5
  • Zenarmor 2.1

Is any other VPN software installed?

If yes, which one?

  • Wireguard
  • OpenVPN
  • IPsec
  • Defguard

Debug output

To help us resolve the problem, please attach the following anonymized status output

# netbird status -dA
Peers detail:
 nb-peer1.netbird.selfhosted:
  NetBird IP: 100.108.10.100
  Public key: [removed]
  Status: Connecting
  -- detail --
  Connection type: P2P
  ICE candidate (Local/Remote): -/-
  ICE candidate endpoints (Local/Remote): -/-
  Relay server address: 
  Last connection update: 20 minutes, 36 seconds ago
  Last WireGuard handshake: -
  Transfer status (received/sent) 0 B/0 B
  Quantum resistance: false
  Networks: -
  Latency: 0s

Events:
  [INFO] SYSTEM (4340e543-83ee-40d6-b801-94a5a757e570)
    Message: Network map updated
    Time: 20 minutes, 36 seconds ago
OS: freebsd/amd64
Daemon version: 0.59.1
CLI version: 0.59.1
Profile: default
Management: Connected to https://poc-nb.anon-Bh96S.domain:444
Signal: Connected to https://poc-nb.anon-Bh96S.domain:446
Relays: 
  [stun:poc-nb.anon-Bh96S.domain:3478] is Unavailable, reason: stun request: context deadline exceeded
  [turn:poc-nb.anon-Bh96S.domain:3478?transport=udp] is Unavailable, reason: allocate: all retransmissions failed for WbBJ9AJYW2mtBZYZ
  [rels://poc-nb.anon-Bh96S.domain:443/relay] is Available
Nameservers: 
  [192.168.200.10:53] for [.] is Available
FQDN: opn01.netbird.selfhosted
NetBird IP: 100.108.10.50/16
Interface type: Userspace
Quantum resistance: false
Lazy connection: false
Networks: -
Forwarding rules: 0
Peers count: 0/1 Connected

Additional context

Add any other context about the problem here.

Have you tried these troubleshooting steps?

  • Reviewed client troubleshooting (if applicable)
  • Checked for newer NetBird versions
  • Searched for similar issues on GitHub (including closed ones)
  • Restarted the NetBird client
  • Disabled other VPN software
  • Checked firewall settings
Originally created by @on-nightingale on GitHub (Oct 10, 2025). Original GitHub issue: https://github.com/netbirdio/netbird/issues/4619 **Describe the problem** Zenarmor is a next-generation firewall extension for OPNsense and we are using it to inspect traffic and enforce web filtering. Zenarmor is also able to inspect traffic on Wireguard interfaces. Using the os-netbird plugin we can successful configure and establish a connection to our self-hosted netbird setup, also other peers can connect with the OPNsense instance. The netbird peer on OPNsense is set up as Exit-Node. But Zenarmor is not able to see the traffic on the netbird created wireguard interface (wt0). The only difference I could spot right now is that netbird is running in "userspace" and other Wireguard solutions are running in kernel mode. **To Reproduce** Steps to reproduce the behavior: 1. Install os-netbird plugin 2. Set up netbird to connect to self-hosted netbird setup 3. Go to `Interfaces` -> `Assignments` and assign the netbird interface (wt0) with the name `netbird` 4. Go to `Interfaces` -> `[netbird]` and enable the interface 5. Go to `Zenarmor` -> `Settings` -> `Configuration` -> `Please choose interfaces to protect` and select `wt0` 6. Save Zenarmor configuration and restart the service 7. Go to `Zenarmor` -> `Live Sessions` -> `Connections` and observe the connections. No traffic from wt0 will show up. **Expected behavior** Zenarmor should be able to inspect the traffic on Wireguard interfaces created by netbird. **Are you using NetBird Cloud?** - self-host NetBird's control plane. **NetBird version** - Netbird `0.59.1` - OPNsense `25.7.5` - Zenarmor `2.1` **Is any other VPN software installed?** If yes, which one? - Wireguard - OpenVPN - IPsec - Defguard **Debug output** To help us resolve the problem, please attach the following anonymized status output ``` # netbird status -dA Peers detail: nb-peer1.netbird.selfhosted: NetBird IP: 100.108.10.100 Public key: [removed] Status: Connecting -- detail -- Connection type: P2P ICE candidate (Local/Remote): -/- ICE candidate endpoints (Local/Remote): -/- Relay server address: Last connection update: 20 minutes, 36 seconds ago Last WireGuard handshake: - Transfer status (received/sent) 0 B/0 B Quantum resistance: false Networks: - Latency: 0s Events: [INFO] SYSTEM (4340e543-83ee-40d6-b801-94a5a757e570) Message: Network map updated Time: 20 minutes, 36 seconds ago OS: freebsd/amd64 Daemon version: 0.59.1 CLI version: 0.59.1 Profile: default Management: Connected to https://poc-nb.anon-Bh96S.domain:444 Signal: Connected to https://poc-nb.anon-Bh96S.domain:446 Relays: [stun:poc-nb.anon-Bh96S.domain:3478] is Unavailable, reason: stun request: context deadline exceeded [turn:poc-nb.anon-Bh96S.domain:3478?transport=udp] is Unavailable, reason: allocate: all retransmissions failed for WbBJ9AJYW2mtBZYZ [rels://poc-nb.anon-Bh96S.domain:443/relay] is Available Nameservers: [192.168.200.10:53] for [.] is Available FQDN: opn01.netbird.selfhosted NetBird IP: 100.108.10.50/16 Interface type: Userspace Quantum resistance: false Lazy connection: false Networks: - Forwarding rules: 0 Peers count: 0/1 Connected ``` **Additional context** Add any other context about the problem here. **Have you tried these troubleshooting steps?** - [x] Reviewed [client troubleshooting](https://docs.netbird.io/how-to/troubleshooting-client) (if applicable) - [x] Checked for newer NetBird versions - [x] Searched for similar issues on GitHub (including closed ones) - [x] Restarted the NetBird client - [ ] Disabled other VPN software - [x] Checked firewall settings
saavagebueno added the triage-needed label 2026-08-05 01:23:51 -04:00
Author
Owner

@lixmal commented on GitHub (Oct 10, 2025):

Can you try disabling the netbird firewall via the UI checkbox?

<!-- gh-comment-id:3390098582 --> @lixmal commented on GitHub (Oct 10, 2025): Can you try disabling the netbird firewall via the UI checkbox?
Author
Owner

@on-nightingale commented on GitHub (Oct 10, 2025):

Yes, I disabled this setting, saved and restarted the netbird plugin. But still no luck with Zenarmor.

Image
<!-- gh-comment-id:3390153879 --> @on-nightingale commented on GitHub (Oct 10, 2025): Yes, I disabled this setting, saved and restarted the netbird plugin. But still no luck with Zenarmor. <img width="1358" height="120" alt="Image" src="https://github.com/user-attachments/assets/33a51b84-bbfd-4c3d-b1da-3e19901034a1" />
Author
Owner

@on-nightingale commented on GitHub (Oct 10, 2025):

Is there a way to force the netbird interface into kernel mode? I would like to test if this already resolves the issue.

<!-- gh-comment-id:3390179146 --> @on-nightingale commented on GitHub (Oct 10, 2025): Is there a way to force the netbird interface into kernel mode? I would like to test if this already resolves the issue.
Author
Owner

@lixmal commented on GitHub (Oct 10, 2025):

I don't know how Zenarmor works, but there is nothing special about NetBird's wt0 interface, whether running in kernel or userspace mode.
Note that NetBird on FreeBSD currently doesn't support kernel mode (it requires significant development effort to make all features available).

Have you opened a request with Zenarmor?

<!-- gh-comment-id:3390295877 --> @lixmal commented on GitHub (Oct 10, 2025): I don't know how Zenarmor works, but there is nothing special about NetBird's wt0 interface, whether running in kernel or userspace mode. Note that NetBird on FreeBSD currently doesn't support kernel mode (it requires significant development effort to make all features available). Have you opened a request with Zenarmor?
Author
Owner

@on-nightingale commented on GitHub (Oct 10, 2025):

Thanks for the clarification. My next step then is to open a request with Zenarmor.
But I'm pretty sure that this is also a Zenarmor limitation. When OPNsense also had a GO plugin for Wireguard (userspace implementation) this also didn't work with Zenarmor.

<!-- gh-comment-id:3390311134 --> @on-nightingale commented on GitHub (Oct 10, 2025): Thanks for the clarification. My next step then is to open a request with Zenarmor. But I'm pretty sure that this is also a Zenarmor limitation. When OPNsense also had a GO plugin for Wireguard (userspace implementation) this also didn't work with Zenarmor.
Author
Owner

@on-nightingale commented on GitHub (Oct 10, 2025):

I just got the confirmation from Zenarmor that these interfaces can not be inspected. So I'm going to close this issue. Thanks for the support.

<!-- gh-comment-id:3390585337 --> @on-nightingale commented on GitHub (Oct 10, 2025): I just got the confirmation from Zenarmor that these interfaces can not be inspected. So I'm going to close this issue. Thanks for the support.
Sign in to join this conversation.
No Label triage-needed
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: DYNR/netbird#9884