SVI/netbird
1
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-06-04 22:42:37 -04:00
Code Issues 3.0k Packages Projects Releases 10 Wiki Activity

A removed peer from the group continues to receive traffic. #1734

New Issue
Open
opened 2025-11-20 06:05:43 -05:00 by saavagebueno · 2 comments
saavagebueno commented 2025-11-20 06:05:43 -05:00
Owner
Copy Link

Originally created by @tropnikovvl on GitHub (Mar 18, 2025).

Describe the problem

Using the new Networks functionality, it is possible to assign a group of peers as a destination.
If you add a peer to a group that is listed as a destination group, it will start receiving traffic; if you remove it from there, it will continue to receive traffic.

To Reproduce

Steps to reproduce the behavior:

  1. Using the setup key create a peer
  2. Add this peer to the devops-exit and internal groups
    Image
  3. Add our laptop's peer to the devops and main groups
    Image
  4. Create a new network with resources
    Image
  5. Create policies allowing devops to access devops-exit and main to internal
    Image
  6. Make sure everything works and resources are available.
  7. Remove the node peer from the devops-exit group and make sure that resources available only to devops (EKS-3) are still somehow available despite the fact that the node is not in the group.

Expected behavior

Since the destination group does not contain a node's peer, then accordingly there should be no access to resources for it.

Are you using NetBird Cloud?

Self-host NetBird's control plane.

NetBird version

0.38.2

Is any other VPN software installed?

No

Debug output

To help us resolve the problem, please attach the following debug output

netbird status -dA

Peers detail:
 019142a3eecd.netbird.selfhosted:
  NetBird IP: 100.107.222.223
  Public key: key
  Status: Connected
  -- detail --
  Connection type: Relayed
  ICE candidate (Local/Remote): -/-
  ICE candidate endpoints (Local/Remote): -/-
  Relay server address: rel://example.anon-NOJB7.domain:33080
  Last connection update: Now
  Last WireGuard handshake: -
  Transfer status (received/sent) 148 B/240 B
  Quantum resistance: false
  Networks: 10.180.0.0/16, 10.185.0.0/16, 10.189.0.0/16
  Latency: 0s

Events:
  [INFO] SYSTEM (5d0e3977-55e4-47fc-bace-931191351505)
    Message: Network map updated
    Time: 16 minutes, 36 seconds ago
  [INFO] SYSTEM (b4a0e21c-bb94-4401-943a-1149d9d4041b)
    Message: Network map updated
    Time: 16 minutes, 28 seconds ago
  [INFO] SYSTEM (a063137f-9383-42ce-8e90-d1d9eee5f468)
    Message: Network map updated
    Time: 16 minutes, 13 seconds ago
  [INFO] SYSTEM (298a7b0f-26d2-48a5-a3d3-1f7befae96c8)
    Message: Network map updated
    Time: 15 minutes, 45 seconds ago
  [INFO] SYSTEM (cac74c0b-d5b5-4043-9321-294ef35dad62)
    Message: Network map updated
    Time: 15 minutes, 2 seconds ago
  [INFO] SYSTEM (f928c194-e93f-4015-beb5-7439eb1daba4)
    Message: Network map updated
    Time: 14 minutes, 52 seconds ago
  [INFO] SYSTEM (85fa2f8f-5d3f-4321-8998-c4dc893bfa8e)
    Message: Network map updated
    Time: 14 minutes, 45 seconds ago
  [INFO] SYSTEM (dbccdfd6-2da9-48ae-a018-202f8fb82a82)
    Message: Network map updated
    Time: 14 minutes, 34 seconds ago
  [INFO] SYSTEM (0f7719ba-cc66-44b3-9302-04a6077f41a4)
    Message: Network map updated
    Time: 5 minutes, 48 seconds ago
  [INFO] SYSTEM (8a624769-083c-4c6f-8acd-825783e3faec)
    Message: Network map updated
    Time: Now
OS: darwin/arm64
Daemon version: 0.38.2
CLI version: 0.38.2
Management: Connected to https://example.anon-NOJB7.domain:33073
Signal: Connected to http://example.anon-NOJB7.domain:10000
Relays:
  [stun:example.anon-NOJB7.domain:3478] is Available
  [turn:example.anon-NOJB7.domain:3478?transport=udp] is Available
  [rel://example.anon-NOJB7.domain:33080] is Available
Nameservers:
FQDN: example.netbird.selfhosted
NetBird IP: 100.107.78.157/16
Interface type: Userspace
Quantum resistance: false
Networks: -
Forwarding rules: 0
Peers count: 1/1 Connected

Have you tried these troubleshooting steps?

  • Checked for newer NetBird versions
  • Searched for similar issues on GitHub (including closed ones)
  • Restarted the NetBird client
  • Disabled other VPN software
  • Checked firewall settings
Originally created by @tropnikovvl on GitHub (Mar 18, 2025). **Describe the problem** Using the new **Networks** functionality, it is possible to assign a group of peers as a destination. If you add a peer to a group that is listed as a destination group, it will start receiving traffic; if you remove it from there, it will **continue** to receive traffic. **To Reproduce** Steps to reproduce the behavior: 1. Using the setup key create a peer 2. Add this peer to the devops-exit and internal groups ![Image](https://github.com/user-attachments/assets/8255759c-198d-456b-ada6-53964fcf0f4a) 3. Add our laptop's peer to the devops and main groups ![Image](https://github.com/user-attachments/assets/b57a6730-60af-4877-a4ed-a2e0b82f4d60) 4. Create a new network with resources ![Image](https://github.com/user-attachments/assets/a5efc341-6731-469b-a32c-03aabb9cf5e2) 5. Create policies allowing devops to access devops-exit and main to internal ![Image](https://github.com/user-attachments/assets/53edbc39-45bf-41a4-af35-6bae4587def5) 6. Make sure everything works and resources are available. 7. Remove the node peer from the devops-exit group and make sure that resources available only to devops (EKS-3) are still somehow available despite the fact that the node is not in the group. **Expected behavior** Since the destination group does not contain a node's peer, then accordingly there should be no access to resources for it. **Are you using NetBird Cloud?** Self-host NetBird's control plane. **NetBird version** 0.38.2 **Is any other VPN software installed?** No **Debug output** To help us resolve the problem, please attach the following debug output netbird status -dA ``` Peers detail: 019142a3eecd.netbird.selfhosted: NetBird IP: 100.107.222.223 Public key: key Status: Connected -- detail -- Connection type: Relayed ICE candidate (Local/Remote): -/- ICE candidate endpoints (Local/Remote): -/- Relay server address: rel://example.anon-NOJB7.domain:33080 Last connection update: Now Last WireGuard handshake: - Transfer status (received/sent) 148 B/240 B Quantum resistance: false Networks: 10.180.0.0/16, 10.185.0.0/16, 10.189.0.0/16 Latency: 0s Events: [INFO] SYSTEM (5d0e3977-55e4-47fc-bace-931191351505) Message: Network map updated Time: 16 minutes, 36 seconds ago [INFO] SYSTEM (b4a0e21c-bb94-4401-943a-1149d9d4041b) Message: Network map updated Time: 16 minutes, 28 seconds ago [INFO] SYSTEM (a063137f-9383-42ce-8e90-d1d9eee5f468) Message: Network map updated Time: 16 minutes, 13 seconds ago [INFO] SYSTEM (298a7b0f-26d2-48a5-a3d3-1f7befae96c8) Message: Network map updated Time: 15 minutes, 45 seconds ago [INFO] SYSTEM (cac74c0b-d5b5-4043-9321-294ef35dad62) Message: Network map updated Time: 15 minutes, 2 seconds ago [INFO] SYSTEM (f928c194-e93f-4015-beb5-7439eb1daba4) Message: Network map updated Time: 14 minutes, 52 seconds ago [INFO] SYSTEM (85fa2f8f-5d3f-4321-8998-c4dc893bfa8e) Message: Network map updated Time: 14 minutes, 45 seconds ago [INFO] SYSTEM (dbccdfd6-2da9-48ae-a018-202f8fb82a82) Message: Network map updated Time: 14 minutes, 34 seconds ago [INFO] SYSTEM (0f7719ba-cc66-44b3-9302-04a6077f41a4) Message: Network map updated Time: 5 minutes, 48 seconds ago [INFO] SYSTEM (8a624769-083c-4c6f-8acd-825783e3faec) Message: Network map updated Time: Now OS: darwin/arm64 Daemon version: 0.38.2 CLI version: 0.38.2 Management: Connected to https://example.anon-NOJB7.domain:33073 Signal: Connected to http://example.anon-NOJB7.domain:10000 Relays: [stun:example.anon-NOJB7.domain:3478] is Available [turn:example.anon-NOJB7.domain:3478?transport=udp] is Available [rel://example.anon-NOJB7.domain:33080] is Available Nameservers: FQDN: example.netbird.selfhosted NetBird IP: 100.107.78.157/16 Interface type: Userspace Quantum resistance: false Networks: - Forwarding rules: 0 Peers count: 1/1 Connected ``` **Have you tried these troubleshooting steps?** - [x] Checked for newer NetBird versions - [x] Searched for similar issues on GitHub (including closed ones) - [x] Restarted the NetBird client - [x] Disabled other VPN software - [x] Checked firewall settings
saavagebueno added the triage-needed label 2025-11-20 06:05:43 -05:00
saavagebueno commented 2025-11-20 06:05:44 -05:00
Author
Owner
Copy Link

@lixmal commented on GitHub (Apr 26, 2025):

Hi @tropnikovvl, can you provide the debug bundle please, or at least the network_map.json in it?

@lixmal commented on GitHub (Apr 26, 2025): Hi @tropnikovvl, can you provide the debug bundle please, or at least the `network_map.json` in it?
saavagebueno commented 2025-11-20 06:05:44 -05:00
Author
Owner
Copy Link

@Blackclaws commented on GitHub (Jun 24, 2025):

I can confirm that this happens sometimes. This only happens if you are still connected to the routing peer however and any new connections will be blocked. At least ICMP continues to ping back and forth but any new ping will not work.

The expectation certainly is that as soon as you remove an access policy that allows access to a network resource even for ICMP those are blocked. But I'm not sure that's easily possible.

I've checked with an SSH connection and that one is properly blocked/cut unless you have overlapping policies that still allow you access to the peer (which is what I'd advise to always check).

@Blackclaws commented on GitHub (Jun 24, 2025): I can confirm that this happens sometimes. This only happens if you are still connected to the routing peer however and any _new_ connections will be blocked. At least ICMP continues to ping back and forth but any new ping will not work. The expectation certainly is that as soon as you remove an access policy that allows access to a network resource even for ICMP those are blocked. But I'm not sure that's easily possible. I've checked with an SSH connection and that one is properly blocked/cut unless you have overlapping policies that still allow you access to the peer (which is what I'd advise to always check).
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
2021 Q4
2022 Q1
2022 Q1
accessibility
acl
agent
agent
Android
Android
api
authentik
automation
azure
battery-usage
bug
cache
client
client-ui
cloud
cloud-only
cloudflare
community
compatibility
config-idp
config-issue
connection
contribution
coturn
cross-vpn
dashboard
data-usage
distribution
dns
docker
documentation
duplicate
enhancement
enhancement
event-stream
feature-request
freebsd
getting-started
go
good first issue
gui
help wanted
home-assistant
idp
inconsistency
integration
integrations
ios
ipv6
jwt
k8s
keycloak
linux
login
macos
management-service
missing-docs
mobile
moved-internal
needs-review
netbird-ui
networking
new-platform
nginx
notification
okta
openwrt
packaging
peer-management
peer-management
peer-management
performance
postgres
posture-checks
psk
pull-request
Mirrored from GitHub Pull Request
 question
refactor
relay
release
rfc
routes
security
security-related
self-hosting
server
signal
sleep-issue
ssh
ssl
status
store
synology
system-compatibility-issue
test-suite
third-party-integration
triage
triage-needed
troubleshooting
UX
waiting-feedback
windows
wontfix
zitadel
No Label triage-needed
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
saavagebueno
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: SVI/netbird#1734
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?