SVI/netbird
1
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-08-04 19:55:09 -04:00
Code Issues 3.0k Packages Projects Releases 10 Wiki Activity

iOS/iPadOS Client Can't Connect to Peers When Using Non-Permissive Rosenpass #1267

New Issue
Closed
opened 2025-11-20 05:27:11 -05:00 by saavagebueno · 3 comments
saavagebueno commented 2025-11-20 05:27:11 -05:00
Owner
Copy Link

Originally created by @trbutler on GitHub (Sep 22, 2024).

Describe the problem

I was doing a fresh network configuration, so I configured all of my clients to use Rosenpass without the permissive switch. With this arrangement, iOS/iPadOS clients couldn't connect to any peers. They work fine when permissive mode is turned on.

To Reproduce

  1. In the iOS/iPadOS client enable Rosenpass and disable permissive mode.
  2. On other peers disable permissive mode via GUI or command line.
  3. Check Quantum protection status in the iOS/iPadOS client and note that it is false on desktop OS peers that successfully connect using quantum protection to each other.
  4. Attempt (and fail) to connect to those peers from iOS/iPadOS
  5. Switch to "permissive" mode on both peers and note that communication resumes.

Expected behavior

If the iOS/iPadOS client has mirrored non-permissive quantum protection enabled, one would expect it to successfully establish connections with like configured desktop OS peers.

Are you using NetBird Cloud?

Selfhosted.

NetBird version

A mix of 0.28.x - 0.29.4 peers, plus the latest iOS/iPadOS client.

NetBird status -dA output:

From one of the desktop peers the mobile peer couldn't connect to while on non-permissive mode:

Peers detail:
 iphone-admin.anon-uVhPV.domain:
  NetBird IP: 100.68.26.148
  Public key: S+4WdLdmo6im05ndW2ccPhdoQMVa7lvmQ4nXSMvIPHQ=
  Status: Connected
  -- detail --
  Connection type: P2P
  ICE candidate (Local/Remote): srflx/host
  ICE candidate endpoints (Local/Remote): 198.51.100.0:51820/192.168.0.90:51820
  Relay server address: 
  Last connection update: 10 minutes, 27 seconds ago
  Last WireGuard handshake: 46 seconds ago
  Transfer status (received/sent) 1.2 KiB/1.4 KiB
  Quantum resistance: false (remote didn't enable quantum resistance)
  Routes: -
  Latency: 51.378ms

 little-hills-live-stream.anon-uVhPV.domain:
  NetBird IP: 100.68.40.244
  Public key: yBhdVf0uxhuvaAr4tVbFDLUWnTWg/JCOviH5T3KmphM=
  Status: Connected
  -- detail --
  Connection type: P2P
  ICE candidate (Local/Remote): srflx/prflx
  ICE candidate endpoints (Local/Remote): 198.51.100.0:51820/198.51.100.1:51820
  Relay server address: 
  Last connection update: 10 minutes, 25 seconds ago
  Last WireGuard handshake: 1 minute, 34 seconds ago
  Transfer status (received/sent) 1.6 KiB/1.4 KiB
  Quantum resistance: true
  Routes: -
  Latency: 154.732875ms

 franklin.anon-uVhPV.domain:
  NetBird IP: 100.68.104.177
  Public key: v9F8qsB+L4fpvuTv9B8NiD27cx6h6dzVMC0XBwtw4WA=
  Status: Connected
  -- detail --
  Connection type: P2P
  ICE candidate (Local/Remote): srflx/srflx
  ICE candidate endpoints (Local/Remote): 198.51.100.0:51820/198.51.100.2:2184
  Relay server address: rels://sugarmaple.serverforest.com:443
  Last connection update: 10 minutes, 27 seconds ago
  Last WireGuard handshake: 3 seconds ago
  Transfer status (received/sent) 584 B/1.8 KiB
  Quantum resistance: true
  Routes: 192.168.4.0/23
  Latency: 28.132334ms

 ipad-admin.anon-uVhPV.domain:
  NetBird IP: 100.68.119.15
  Public key: oBnIFFtgnPA6SDOJcSHlR1BbIM5h7WudevvgmkDRLzQ=
  Status: Disconnected
  -- detail --
  Connection type: 
  ICE candidate (Local/Remote): -/-
  ICE candidate endpoints (Local/Remote): -/-
  Relay server address: 
  Last connection update: -
  Last WireGuard handshake: -
  Transfer status (received/sent) 0 B/0 B
  Quantum resistance: false (remote didn't enable quantum resistance)
  Routes: -
  Latency: 0s

 independence.anon-uVhPV.domain:
  NetBird IP: 100.68.136.48
  Public key: wwROJuAi9t5d7W8DnF78sdMTm13iDZ9YcrtjjHtIYDM=
  Status: Connected
  -- detail --
  Connection type: P2P
  ICE candidate (Local/Remote): srflx/srflx
  ICE candidate endpoints (Local/Remote): 198.51.100.0:51820/198.51.100.2:3723
  Relay server address: rels://sugarmaple.serverforest.com:443
  Last connection update: 10 minutes, 26 seconds ago
  Last WireGuard handshake: 1 minute, 54 seconds ago
  Transfer status (received/sent) 1.8 KiB/2.9 KiB
  Quantum resistance: true
  Routes: -
  Latency: 28.637042ms

 spruce.anon-uVhPV.domain:
  NetBird IP: 100.68.172.123
  Public key: 0sA1GjrlFs+yPKlh7CARYIoFA/Ydsa4Tq/jnpLw1axk=
  Status: Connected
  -- detail --
  Connection type: P2P
  ICE candidate (Local/Remote): host/prflx
  ICE candidate endpoints (Local/Remote): 192.168.0.48:51820/198.51.100.3:51820
  Relay server address: 
  Last connection update: 10 minutes, 27 seconds ago
  Last WireGuard handshake: 26 seconds ago
  Transfer status (received/sent) 4.0 MiB/325.8 KiB
  Quantum resistance: true
  Routes: -
  Latency: 71.189958ms

 boaz.anon-uVhPV.domain:
  NetBird IP: 100.68.191.18
  Public key: ydFumIBVUwCGBjx5Xh0pZPW1G6kFq2v+8DPNz1XYkRE=
  Status: Connected
  -- detail --
  Connection type: P2P
  ICE candidate (Local/Remote): srflx/srflx
  ICE candidate endpoints (Local/Remote): 198.51.100.0:51820/198.51.100.4:51820
  Relay server address: rels://sugarmaple.serverforest.com:443
  Last connection update: 10 minutes, 25 seconds ago
  Last WireGuard handshake: 47 seconds ago
  Transfer status (received/sent) 1.2 KiB/1.6 KiB
  Quantum resistance: true
  Routes: -
  Latency: 58.120292ms

 mesquite.anon-uVhPV.domain:
  NetBird IP: 100.68.191.220
  Public key: vp6GLJc22GQXj2Ht5deowZp0OA8kG7XJS1kYl3zc6lI=
  Status: Connected
  -- detail --
  Connection type: P2P
  ICE candidate (Local/Remote): srflx/host
  ICE candidate endpoints (Local/Remote): 198.51.100.0:51820/198.51.100.5:51820
  Relay server address: rels://sugarmaple.serverforest.com:443
  Last connection update: 10 minutes, 27 seconds ago
  Last WireGuard handshake: 2 minutes, 2 seconds ago
  Transfer status (received/sent) 492 B/1.8 KiB
  Quantum resistance: true
  Routes: -
  Latency: 118.2895ms

 touchstone.anon-uVhPV.domain:
  NetBird IP: 100.68.218.63
  Public key: PAzQjGnO5xftL4rgeX9SdkajCjEJA3A+iViMbXoPgXE=
  Status: Connected
  -- detail --
  Connection type: P2P
  ICE candidate (Local/Remote): host/srflx
  ICE candidate endpoints (Local/Remote): 192.168.0.48:51820/198.51.100.2:51820
  Relay server address: rels://sugarmaple.serverforest.com:443
  Last connection update: 10 minutes, 26 seconds ago
  Last WireGuard handshake: 3 seconds ago
  Transfer status (received/sent) 552 B/1.8 KiB
  Quantum resistance: true
  Routes: -
  Latency: 36.93425ms

 rahab.anon-uVhPV.domain:
  NetBird IP: 100.68.228.94
  Public key: hxczQ9TIXjpDAFHDVzwjH6aDPlC5l5GcTj0LEmhgfRQ=
  Status: Connected
  -- detail --
  Connection type: P2P
  ICE candidate (Local/Remote): srflx/srflx
  ICE candidate endpoints (Local/Remote): 198.51.100.0:51820/198.51.100.4:2911
  Relay server address: rels://sugarmaple.serverforest.com:443
  Last connection update: 10 minutes, 27 seconds ago
  Last WireGuard handshake: 3 seconds ago
  Transfer status (received/sent) 552 B/1.8 KiB
  Quantum resistance: true
  Routes: -
  Latency: 22.512375ms

 rosalind.anon-uVhPV.domain:
  NetBird IP: 100.68.249.136
  Public key: 8ulzaG4yTm9RqIYMwRQXkw4LB7LDdhXy1ocdNCuEqBA=
  Status: Connected
  -- detail --
  Connection type: P2P
  ICE candidate (Local/Remote): srflx/prflx
  ICE candidate endpoints (Local/Remote): 198.51.100.0:51820/198.51.100.6:51820
  Relay server address: 
  Last connection update: 10 minutes, 26 seconds ago
  Last WireGuard handshake: 19 seconds ago
  Transfer status (received/sent) 3.9 MiB/313.0 KiB
  Quantum resistance: true
  Routes: -
  Latency: 75.569041ms

OS: darwin/arm64
Daemon version: 0.29.4
CLI version: 0.29.4
Management: Connected to https://sugarmaple.anon-4I0sh.domain:443
Signal: Connected to https://sugarmaple.anon-4I0sh.domain:443
Relays: 
  [stun:sugarmaple.anon-4I0sh.domain:3478] is Available
  [turn:sugarmaple.anon-4I0sh.domain:3478?transport=udp] is Available
  [rels://sugarmaple.anon-4I0sh.domain:443] is Available
Nameservers: 
FQDN: falstaff.anon-uVhPV.domain
NetBird IP: 100.68.36.98/16
Interface type: Userspace
Quantum resistance: true 
Routes: -
Peers count: 10/11 Connected

Do you face any (non-mobile) client issues?

No.

Originally created by @trbutler on GitHub (Sep 22, 2024). **Describe the problem** I was doing a fresh network configuration, so I configured all of my clients to use Rosenpass _without_ the permissive switch. With this arrangement, iOS/iPadOS clients couldn't connect to any peers. They work fine when permissive mode is turned on. **To Reproduce** 1. In the iOS/iPadOS client enable Rosenpass and disable permissive mode. 2. On other peers disable permissive mode via GUI or command line. 3. Check Quantum protection status in the iOS/iPadOS client and note that it is false on desktop OS peers that successfully connect using quantum protection to each other. 4. Attempt (and fail) to connect to those peers from iOS/iPadOS 5. Switch to "permissive" mode on both peers and note that communication resumes. **Expected behavior** If the iOS/iPadOS client has mirrored non-permissive quantum protection enabled, one would expect it to successfully establish connections with like configured desktop OS peers. **Are you using NetBird Cloud?** Selfhosted. **NetBird version** A mix of 0.28.x - 0.29.4 peers, plus the latest iOS/iPadOS client. **NetBird status -dA output:** From one of the desktop peers the mobile peer couldn't connect to while on non-permissive mode: ``` Peers detail: iphone-admin.anon-uVhPV.domain: NetBird IP: 100.68.26.148 Public key: S+4WdLdmo6im05ndW2ccPhdoQMVa7lvmQ4nXSMvIPHQ= Status: Connected -- detail -- Connection type: P2P ICE candidate (Local/Remote): srflx/host ICE candidate endpoints (Local/Remote): 198.51.100.0:51820/192.168.0.90:51820 Relay server address: Last connection update: 10 minutes, 27 seconds ago Last WireGuard handshake: 46 seconds ago Transfer status (received/sent) 1.2 KiB/1.4 KiB Quantum resistance: false (remote didn't enable quantum resistance) Routes: - Latency: 51.378ms little-hills-live-stream.anon-uVhPV.domain: NetBird IP: 100.68.40.244 Public key: yBhdVf0uxhuvaAr4tVbFDLUWnTWg/JCOviH5T3KmphM= Status: Connected -- detail -- Connection type: P2P ICE candidate (Local/Remote): srflx/prflx ICE candidate endpoints (Local/Remote): 198.51.100.0:51820/198.51.100.1:51820 Relay server address: Last connection update: 10 minutes, 25 seconds ago Last WireGuard handshake: 1 minute, 34 seconds ago Transfer status (received/sent) 1.6 KiB/1.4 KiB Quantum resistance: true Routes: - Latency: 154.732875ms franklin.anon-uVhPV.domain: NetBird IP: 100.68.104.177 Public key: v9F8qsB+L4fpvuTv9B8NiD27cx6h6dzVMC0XBwtw4WA= Status: Connected -- detail -- Connection type: P2P ICE candidate (Local/Remote): srflx/srflx ICE candidate endpoints (Local/Remote): 198.51.100.0:51820/198.51.100.2:2184 Relay server address: rels://sugarmaple.serverforest.com:443 Last connection update: 10 minutes, 27 seconds ago Last WireGuard handshake: 3 seconds ago Transfer status (received/sent) 584 B/1.8 KiB Quantum resistance: true Routes: 192.168.4.0/23 Latency: 28.132334ms ipad-admin.anon-uVhPV.domain: NetBird IP: 100.68.119.15 Public key: oBnIFFtgnPA6SDOJcSHlR1BbIM5h7WudevvgmkDRLzQ= Status: Disconnected -- detail -- Connection type: ICE candidate (Local/Remote): -/- ICE candidate endpoints (Local/Remote): -/- Relay server address: Last connection update: - Last WireGuard handshake: - Transfer status (received/sent) 0 B/0 B Quantum resistance: false (remote didn't enable quantum resistance) Routes: - Latency: 0s independence.anon-uVhPV.domain: NetBird IP: 100.68.136.48 Public key: wwROJuAi9t5d7W8DnF78sdMTm13iDZ9YcrtjjHtIYDM= Status: Connected -- detail -- Connection type: P2P ICE candidate (Local/Remote): srflx/srflx ICE candidate endpoints (Local/Remote): 198.51.100.0:51820/198.51.100.2:3723 Relay server address: rels://sugarmaple.serverforest.com:443 Last connection update: 10 minutes, 26 seconds ago Last WireGuard handshake: 1 minute, 54 seconds ago Transfer status (received/sent) 1.8 KiB/2.9 KiB Quantum resistance: true Routes: - Latency: 28.637042ms spruce.anon-uVhPV.domain: NetBird IP: 100.68.172.123 Public key: 0sA1GjrlFs+yPKlh7CARYIoFA/Ydsa4Tq/jnpLw1axk= Status: Connected -- detail -- Connection type: P2P ICE candidate (Local/Remote): host/prflx ICE candidate endpoints (Local/Remote): 192.168.0.48:51820/198.51.100.3:51820 Relay server address: Last connection update: 10 minutes, 27 seconds ago Last WireGuard handshake: 26 seconds ago Transfer status (received/sent) 4.0 MiB/325.8 KiB Quantum resistance: true Routes: - Latency: 71.189958ms boaz.anon-uVhPV.domain: NetBird IP: 100.68.191.18 Public key: ydFumIBVUwCGBjx5Xh0pZPW1G6kFq2v+8DPNz1XYkRE= Status: Connected -- detail -- Connection type: P2P ICE candidate (Local/Remote): srflx/srflx ICE candidate endpoints (Local/Remote): 198.51.100.0:51820/198.51.100.4:51820 Relay server address: rels://sugarmaple.serverforest.com:443 Last connection update: 10 minutes, 25 seconds ago Last WireGuard handshake: 47 seconds ago Transfer status (received/sent) 1.2 KiB/1.6 KiB Quantum resistance: true Routes: - Latency: 58.120292ms mesquite.anon-uVhPV.domain: NetBird IP: 100.68.191.220 Public key: vp6GLJc22GQXj2Ht5deowZp0OA8kG7XJS1kYl3zc6lI= Status: Connected -- detail -- Connection type: P2P ICE candidate (Local/Remote): srflx/host ICE candidate endpoints (Local/Remote): 198.51.100.0:51820/198.51.100.5:51820 Relay server address: rels://sugarmaple.serverforest.com:443 Last connection update: 10 minutes, 27 seconds ago Last WireGuard handshake: 2 minutes, 2 seconds ago Transfer status (received/sent) 492 B/1.8 KiB Quantum resistance: true Routes: - Latency: 118.2895ms touchstone.anon-uVhPV.domain: NetBird IP: 100.68.218.63 Public key: PAzQjGnO5xftL4rgeX9SdkajCjEJA3A+iViMbXoPgXE= Status: Connected -- detail -- Connection type: P2P ICE candidate (Local/Remote): host/srflx ICE candidate endpoints (Local/Remote): 192.168.0.48:51820/198.51.100.2:51820 Relay server address: rels://sugarmaple.serverforest.com:443 Last connection update: 10 minutes, 26 seconds ago Last WireGuard handshake: 3 seconds ago Transfer status (received/sent) 552 B/1.8 KiB Quantum resistance: true Routes: - Latency: 36.93425ms rahab.anon-uVhPV.domain: NetBird IP: 100.68.228.94 Public key: hxczQ9TIXjpDAFHDVzwjH6aDPlC5l5GcTj0LEmhgfRQ= Status: Connected -- detail -- Connection type: P2P ICE candidate (Local/Remote): srflx/srflx ICE candidate endpoints (Local/Remote): 198.51.100.0:51820/198.51.100.4:2911 Relay server address: rels://sugarmaple.serverforest.com:443 Last connection update: 10 minutes, 27 seconds ago Last WireGuard handshake: 3 seconds ago Transfer status (received/sent) 552 B/1.8 KiB Quantum resistance: true Routes: - Latency: 22.512375ms rosalind.anon-uVhPV.domain: NetBird IP: 100.68.249.136 Public key: 8ulzaG4yTm9RqIYMwRQXkw4LB7LDdhXy1ocdNCuEqBA= Status: Connected -- detail -- Connection type: P2P ICE candidate (Local/Remote): srflx/prflx ICE candidate endpoints (Local/Remote): 198.51.100.0:51820/198.51.100.6:51820 Relay server address: Last connection update: 10 minutes, 26 seconds ago Last WireGuard handshake: 19 seconds ago Transfer status (received/sent) 3.9 MiB/313.0 KiB Quantum resistance: true Routes: - Latency: 75.569041ms OS: darwin/arm64 Daemon version: 0.29.4 CLI version: 0.29.4 Management: Connected to https://sugarmaple.anon-4I0sh.domain:443 Signal: Connected to https://sugarmaple.anon-4I0sh.domain:443 Relays: [stun:sugarmaple.anon-4I0sh.domain:3478] is Available [turn:sugarmaple.anon-4I0sh.domain:3478?transport=udp] is Available [rels://sugarmaple.anon-4I0sh.domain:443] is Available Nameservers: FQDN: falstaff.anon-uVhPV.domain NetBird IP: 100.68.36.98/16 Interface type: Userspace Quantum resistance: true Routes: - Peers count: 10/11 Connected ``` **Do you face any (non-mobile) client issues?** No.
saavagebueno added the waiting-feedbacktriage-needed labels 2025-11-20 05:27:11 -05:00
saavagebueno commented 2025-11-20 05:27:12 -05:00
Author
Owner
Copy Link

@pascal-fischer commented on GitHub (Sep 23, 2024):

Hi @trbutler.
I just tested on my iPhone and I reproduced that status on the iPhone is shown wrong. When I check my desktop peer though it shows quantum resistance true and the connection is fine.
Can you share some logs from the iPhone when connected?

@pascal-fischer commented on GitHub (Sep 23, 2024): Hi @trbutler. I just tested on my iPhone and I reproduced that status on the iPhone is shown wrong. When I check my desktop peer though it shows quantum resistance true and the connection is fine. Can you share some logs from the iPhone when connected?
saavagebueno commented 2025-11-20 05:27:12 -05:00
Author
Owner
Copy Link

@nazarewk commented on GitHub (Apr 28, 2025):

Hello @trbutler,

We're currently reviewing our open issues and would like to verify if this problem still exists in the latest NetBird version.

Could you please confirm if the issue is still there?

We may close this issue temporarily if we don't hear back from you within 2 weeks, but feel free to reopen it with updated information.

Thanks for your contribution to improving the project!

@nazarewk commented on GitHub (Apr 28, 2025): Hello @trbutler, We're currently reviewing our open issues and would like to verify if this problem still exists in the [latest NetBird version](https://github.com/netbirdio/netbird/releases). Could you please confirm if the issue is still there? We may close this issue temporarily if we don't hear back from you within **2 weeks**, but feel free to reopen it with updated information. Thanks for your contribution to improving the project!
saavagebueno commented 2025-11-20 05:27:12 -05:00
Author
Owner
Copy Link

@mlsmaycon commented on GitHub (Jun 1, 2025):

closing issue due to no recent feedback. Feel free to open a new one if the issue persist or reopen if this was a feature request.

@mlsmaycon commented on GitHub (Jun 1, 2025): closing issue due to no recent feedback. Feel free to open a new one if the issue persist or reopen if this was a feature request.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
2021 Q4
2022 Q1
2022 Q1
accessibility
acl
agent
agent
Android
Android
api
authentik
automation
azure
battery-usage
bug
cache
client
client-ui
cloud
cloud-only
cloudflare
community
compatibility
config-idp
config-issue
connection
contribution
coturn
cross-vpn
dashboard
data-usage
distribution
dns
docker
documentation
duplicate
enhancement
enhancement
event-stream
feature-request
freebsd
getting-started
go
good first issue
gui
help wanted
home-assistant
idp
inconsistency
integration
integrations
ios
ipv6
jwt
k8s
keycloak
linux
login
macos
management-service
missing-docs
mobile
moved-internal
needs-review
netbird-ui
networking
new-platform
nginx
notification
okta
openwrt
packaging
peer-management
peer-management
peer-management
performance
postgres
posture-checks
psk
pull-request
Mirrored from GitHub Pull Request
 question
refactor
relay
release
rfc
routes
security
security-related
self-hosting
server
signal
sleep-issue
ssh
ssl
status
store
synology
system-compatibility-issue
test-suite
third-party-integration
triage
triage-needed
troubleshooting
UX
waiting-feedback
windows
wontfix
zitadel
No Label triage-needed waiting-feedback
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
saavagebueno
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: SVI/netbird#1267
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?