SVI/netbird
1
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-05-10 18:22:12 -04:00
Code Issues 3.0k Packages Projects Releases 10 Wiki Activity

Exit node should not proxy traffic to Netbird peers - Windows 11 #1309

New Issue
Closed
opened 2025-11-20 05:28:00 -05:00 by saavagebueno · 2 comments
saavagebueno commented 2025-11-20 05:28:00 -05:00
Owner
Copy Link

Originally created by @alexcupertme on GitHub (Oct 6, 2024).

Describe the problem

Platform: win11/x64 22H2 build 22621.4249
Netbird version 0.29.4

I think this maybe more than one bug so i'll try to show whole picture and chronology
At first, we have encountered a problem that peer on Windows using exit node, cannot connect to SSH. It just gets stuck on message

debug1: kex: algorithm: curve25519-sha256
debug1: kex: host key algorithm: ssh-rsa
debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC: <implicit                                                                                                                                                             > compression: none
debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC: <implicit                                                                                                                                                             > compression: none
debug3: send packet: type 30
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY

There were also problems with SSL connection to peers. If we execute CURL on our peer webserver via HTTPS,

curl https://peer.website.mt.net --verbose
* Host peer.website.mt.net:443 was resolved.
* IPv6: (none)
* IPv4: 100.120.85.83
*   Trying 100.120.85.83:443...
* Connected to peer.website.mt.net (100.120.85.83) port 443
* schannel: disabled automatic use of client certificate
* ALPN: curl offers http/1.1
* <stuck forever>

We tried to investigate and debug these issues and it was really tight because Netbird client is offering "plug and play" experience, which overall is great, but it misses usecases when something doesnt work and we need to configure Wireguard interface etc.

For example, we've found out that this issue happens when MTU of the client and router mismatched and client's is higher, and we cant change MTU via netbird config

We tried to change the MTU on user hosts in network interfaces directly. It helped, but all MTU settings disappeared after restarting the wt0 tunnel.

Also we noticed that problem happens only on peers with public IPs - they always have P2P connection and can be world accessible. So if we using Exit node and connect to the public server, exit node proxies traffic to the peer and our request gets stuck. Relayed servers, on other hand, dont have this problem because exit node not acting in this connection.

I think Wireguard running in Userspace may influence this problem -- Windows doesn't support Kernel mode. With Linux we didnt have problem

The workaround we ended with, creating systemd service dependent on netbird.service, which changes wt0 MTU to 1420. You don't have to change MTU on user machines, only exit nodes you use ase VPN:

root@jumphost:~# cat /etc/systemd/system/netbird-fix-mtu.service
[Unit]
Description=Start service when wt0 is up
Wants=network-online.target
After=network-online.target
BindsTo=sys-subsystem-net-devices-wt0.device
After=sys-subsystem-net-devices-wt0.device

[Service]
Type=oneshot
ExecStart=/sbin/ip link set dev wt0 mtu 1420
RemainAfterExit=yes

[Install]
WantedBy=sys-subsystem-net-devices-wt0.device

root@jumphost:~# cat /etc/udev/rules.d/99-net-interface-up.rules
ACTION=="add", SUBSYSTEM=="net", KERNEL=="wt0", TAG+="systemd", ENV{SYSTEMD_WANTS}="netbird-fix-mtu.service"
ACTION=="bind", SUBSYSTEM=="net", KERNEL=="wt0", TAG+="systemd", ENV{SYSTEMD_WANTS}="netbird-fix-mtu.service"

root@jumphost:~# sudo systemctl daemon-reload && sudo udevadm control --reload-rules && sudo systemctl enable netbird-fix-mtu.service

NetBird version

netbird version
0.29.4

Originally created by @alexcupertme on GitHub (Oct 6, 2024). **Describe the problem** Platform: win11/x64 22H2 build 22621.4249 Netbird version 0.29.4 I think this maybe more than one bug so i'll try to show whole picture and chronology At first, we have encountered a problem that peer on Windows using exit node, cannot connect to SSH. It just gets stuck on message ``` debug1: kex: algorithm: curve25519-sha256 debug1: kex: host key algorithm: ssh-rsa debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC: <implicit > compression: none debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC: <implicit > compression: none debug3: send packet: type 30 debug1: expecting SSH2_MSG_KEX_ECDH_REPLY ``` There were also problems with SSL connection to peers. If we execute CURL on our peer webserver via HTTPS, ``` curl https://peer.website.mt.net --verbose * Host peer.website.mt.net:443 was resolved. * IPv6: (none) * IPv4: 100.120.85.83 * Trying 100.120.85.83:443... * Connected to peer.website.mt.net (100.120.85.83) port 443 * schannel: disabled automatic use of client certificate * ALPN: curl offers http/1.1 * <stuck forever> ``` We tried to investigate and debug these issues and it was really tight because Netbird client is offering "plug and play" experience, which overall is great, but it misses usecases when something doesnt work and we need to configure Wireguard interface etc. For example, we've found out that this issue happens when MTU of the client and router mismatched and client's is higher, and we cant change MTU via netbird config We tried to change the MTU on user hosts in network interfaces directly. It helped, but all MTU settings disappeared after restarting the wt0 tunnel. Also we noticed that **problem happens only on peers with public IPs** - they always have P2P connection and can be world accessible. So if we using Exit node and connect to the public server, exit node proxies traffic to the peer and our request gets stuck. Relayed servers, on other hand, dont have this problem because exit node not acting in this connection. I think Wireguard running in Userspace may influence this problem -- Windows doesn't support Kernel mode. With Linux we didnt have problem **The workaround we ended with, creating systemd service dependent on netbird.service, which changes wt0 MTU to 1420. You don't have to change MTU on user machines, only exit nodes you use ase VPN:** ``` root@jumphost:~# cat /etc/systemd/system/netbird-fix-mtu.service [Unit] Description=Start service when wt0 is up Wants=network-online.target After=network-online.target BindsTo=sys-subsystem-net-devices-wt0.device After=sys-subsystem-net-devices-wt0.device [Service] Type=oneshot ExecStart=/sbin/ip link set dev wt0 mtu 1420 RemainAfterExit=yes [Install] WantedBy=sys-subsystem-net-devices-wt0.device root@jumphost:~# cat /etc/udev/rules.d/99-net-interface-up.rules ACTION=="add", SUBSYSTEM=="net", KERNEL=="wt0", TAG+="systemd", ENV{SYSTEMD_WANTS}="netbird-fix-mtu.service" ACTION=="bind", SUBSYSTEM=="net", KERNEL=="wt0", TAG+="systemd", ENV{SYSTEMD_WANTS}="netbird-fix-mtu.service" root@jumphost:~# sudo systemctl daemon-reload && sudo udevadm control --reload-rules && sudo systemctl enable netbird-fix-mtu.service ``` **NetBird version** `netbird version` 0.29.4
saavagebueno added the waiting-feedbacktriage-needed labels 2025-11-20 05:28:00 -05:00
saavagebueno commented 2025-11-20 05:28:00 -05:00
Author
Owner
Copy Link

@nazarewk commented on GitHub (Apr 28, 2025):

Hello @alexcupertme,

We're currently reviewing our open issues and would like to verify if this problem still exists in the latest NetBird version.

Could you please confirm if the issue is still there?

We may close this issue temporarily if we don't hear back from you within 2 weeks, but feel free to reopen it with updated information.

Thanks for your contribution to improving the project!

@nazarewk commented on GitHub (Apr 28, 2025): Hello @alexcupertme, We're currently reviewing our open issues and would like to verify if this problem still exists in the [latest NetBird version](https://github.com/netbirdio/netbird/releases). Could you please confirm if the issue is still there? We may close this issue temporarily if we don't hear back from you within **2 weeks**, but feel free to reopen it with updated information. Thanks for your contribution to improving the project!
saavagebueno commented 2025-11-20 05:28:01 -05:00
Author
Owner
Copy Link

@mlsmaycon commented on GitHub (Jun 1, 2025):

closing issue due to no recent feedback. Feel free to open a new one if the issue persist or reopen if this was a feature request.

@mlsmaycon commented on GitHub (Jun 1, 2025): closing issue due to no recent feedback. Feel free to open a new one if the issue persist or reopen if this was a feature request.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
2021 Q4
2022 Q1
2022 Q1
accessibility
acl
agent
agent
Android
Android
api
authentik
automation
azure
battery-usage
bug
cache
client
client-ui
cloud
cloud-only
cloudflare
community
compatibility
config-idp
config-issue
connection
contribution
coturn
cross-vpn
dashboard
data-usage
distribution
dns
docker
documentation
duplicate
enhancement
enhancement
event-stream
feature-request
freebsd
getting-started
go
good first issue
gui
help wanted
home-assistant
idp
inconsistency
integration
integrations
ios
ipv6
jwt
k8s
keycloak
linux
login
macos
management-service
missing-docs
mobile
moved-internal
needs-review
netbird-ui
networking
new-platform
nginx
notification
okta
openwrt
packaging
peer-management
peer-management
peer-management
performance
postgres
posture-checks
psk
pull-request
Mirrored from GitHub Pull Request
 question
refactor
relay
release
rfc
routes
security
security-related
self-hosting
server
signal
sleep-issue
ssh
ssl
status
store
synology
system-compatibility-issue
test-suite
third-party-integration
triage
triage-needed
troubleshooting
UX
waiting-feedback
windows
wontfix
zitadel
No Label triage-needed waiting-feedback
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
saavagebueno
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: SVI/netbird#1309
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?