SVI/netbird
1
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-06-10 01:12:51 -04:00
Code Issues 3.0k Packages Projects Releases 10 Wiki Activity

Exclude routing peer public IP from routes #2028

New Issue
Closed
opened 2025-11-20 06:11:30 -05:00 by saavagebueno · 5 comments
saavagebueno commented 2025-11-20 06:11:30 -05:00
Owner
Copy Link

Originally created by @eveyraud on GitHub (Jun 30, 2025).

Is your feature request related to a problem? Please describe.
Refering to ticket #4047 :
When a NetBird network route or exit node is configured to include the routing peer's public IP address, a direct P2P connection fails. This happens because WireGuard attempts to route traffic destined for the routing peer's public IP back into the VPN tunnel managed by that same peer. Consequently, P2P connectivity cannot be sustained, and NetBird falls back to using the TCP relay, degrading performances.

Describe the solution you'd like
Exclude the routing peer's public IP from the route added to the system

Describe alternatives you've considered
Add an option to exclude the routing peer's public IP in the network definition

Additional context
None

Originally created by @eveyraud on GitHub (Jun 30, 2025). **Is your feature request related to a problem? Please describe.** Refering to ticket #4047 : When a NetBird network route or exit node is configured to include the routing peer's public IP address, a direct P2P connection fails. This happens because WireGuard attempts to route traffic destined for the routing peer's public IP back into the VPN tunnel managed by that same peer. Consequently, P2P connectivity cannot be sustained, and NetBird falls back to using the TCP relay, degrading performances. **Describe the solution you'd like** Exclude the routing peer's public IP from the route added to the system **Describe alternatives you've considered** Add an option to exclude the routing peer's public IP in the network definition **Additional context** None
saavagebueno added the bugnetworking labels 2025-11-20 06:11:30 -05:00
saavagebueno commented 2025-11-20 06:11:31 -05:00
Author
Owner
Copy Link

@nazarewk commented on GitHub (Jun 30, 2025):

I'm pretty sure determining all of the Peer's externally accessible IPs is non-trivial (some customers have 2 or more uplinks, multiple VLANs joined indirectly through routers etc.), but maybe we could allow the user to specify a set of IP ranges + interface pairs to force local routing through?

@nazarewk commented on GitHub (Jun 30, 2025): I'm pretty sure determining all of the Peer's externally accessible IPs is non-trivial (some customers have 2 or more uplinks, multiple VLANs joined indirectly through routers etc.), but maybe we could allow the user to specify a set of IP ranges + interface pairs to force local routing through?
saavagebueno commented 2025-11-20 06:11:31 -05:00
Author
Owner
Copy Link

@eveyraud commented on GitHub (Jun 30, 2025):

I'm pretty sure determining all of the Peer's externally accessible IPs is non-trivial (some customers have 2 or more uplinks, multiple VLANs joined indirectly through routers etc.), but maybe we could allow the user to specify a set of IP ranges + interface pairs to force local routing through?

You are right, I hadn't considered those types of infrastructure setups. However, are you suggesting that this would need to be specified client-side? I think it would be better managed server-side. Maybe don't I understand the implications of such a request so feel free to correct me if I'm wrong.

Thanks for your help

@eveyraud commented on GitHub (Jun 30, 2025): > I'm pretty sure determining all of the Peer's externally accessible IPs is non-trivial (some customers have 2 or more uplinks, multiple VLANs joined indirectly through routers etc.), but maybe we could allow the user to specify a set of IP ranges + interface pairs to force local routing through? You are right, I hadn't considered those types of infrastructure setups. However, are you suggesting that this would need to be specified client-side? I think it would be better managed server-side. Maybe don't I understand the implications of such a request so feel free to correct me if I'm wrong. Thanks for your help
saavagebueno commented 2025-11-20 06:11:31 -05:00
Author
Owner
Copy Link

@saule1508 commented on GitHub (Jul 3, 2025):

that is one reason why the exit node is not working for us, all the connections become relayed. We could add routing on the client to make sure routing peers public IP and stun IP gets routed outside the vpn tunnel, but it is cumbersome and error prone. It would be nice if the exit node set-up would allow to exclude IP's ?

@saule1508 commented on GitHub (Jul 3, 2025): that is one reason why the exit node is not working for us, all the connections become relayed. We could add routing on the client to make sure routing peers public IP and stun IP gets routed outside the vpn tunnel, but it is cumbersome and error prone. It would be nice if the exit node set-up would allow to exclude IP's ?
saavagebueno commented 2025-11-20 06:11:31 -05:00
Author
Owner
Copy Link

@lixmal commented on GitHub (Jul 22, 2025):

Hey folks, could you please test https://github.com/netbirdio/netbird/releases/tag/v0.51.2 and report whether the issue has been resolved for you?

@lixmal commented on GitHub (Jul 22, 2025): Hey folks, could you please test https://github.com/netbirdio/netbird/releases/tag/v0.51.2 and report whether the issue has been resolved for you?
saavagebueno commented 2025-11-20 06:11:31 -05:00
Author
Owner
Copy Link

@eveyraud commented on GitHub (Jul 22, 2025):

Fixed, thanks !

@eveyraud commented on GitHub (Jul 22, 2025): Fixed, thanks !
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
2021 Q4
2022 Q1
2022 Q1
accessibility
acl
agent
agent
Android
Android
api
authentik
automation
azure
battery-usage
bug
cache
client
client-ui
cloud
cloud-only
cloudflare
community
compatibility
config-idp
config-issue
connection
contribution
coturn
cross-vpn
dashboard
data-usage
distribution
dns
docker
documentation
duplicate
enhancement
enhancement
event-stream
feature-request
freebsd
getting-started
go
good first issue
gui
help wanted
home-assistant
idp
inconsistency
integration
integrations
ios
ipv6
jwt
k8s
keycloak
linux
login
macos
management-service
missing-docs
mobile
moved-internal
needs-review
netbird-ui
networking
new-platform
nginx
notification
okta
openwrt
packaging
peer-management
peer-management
peer-management
performance
postgres
posture-checks
psk
pull-request
Mirrored from GitHub Pull Request
 question
refactor
relay
release
rfc
routes
security
security-related
self-hosting
server
signal
sleep-issue
ssh
ssl
status
store
synology
system-compatibility-issue
test-suite
third-party-integration
triage
triage-needed
troubleshooting
UX
waiting-feedback
windows
wontfix
zitadel
No Label bug networking
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
saavagebueno
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: SVI/netbird#2028
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?