Selected NetBird Route (10.1.0.0/24) Not Installed in OS Routing Table with Overlapping Local Network (10.0.0.0/8) #2227

Open
opened 2025-11-20 07:06:13 -05:00 by saavagebueno · 2 comments
Owner

Originally created by @aronmal on GitHub (Aug 26, 2025).

Here is the filled-out NetBird GitHub issue template based on our conversation. Please provide the missing information where prompted.


Describe the problem

A NetBird route for the remote network 10.1.0.0/24 is selected on the client, but it is not being installed into the operating system's kernel routing table. This occurs when the client is connected to a local network with an overlapping IP range, specifically a public Wi-Fi network using 10.0.0.0/8. Despite the route selection feature being used, the route does not appear in the OS routing table, preventing access to the remote network.

To Reproduce

Steps to reproduce the behavior:

  1. Connect the NetBird client to a local network with an IP range that overlaps with a configured NetBird network route (e.g., local network 10.0.0.0/8, NetBird route 10.1.0.0/24).
  2. Ensure the NetBird client is running and connected to the control plane and peers (logs show successful relay connections).
  3. Verify the route status using netbird routes list. Observe that the route for 10.1.0.0/24 is listed as "Selected".
    aronmal@pop-os:~$ netbird routes list
    Available Networks:
    
      - ID: 10er
        Network: 10.1.0.0/24
        Status: Selected
    
      - ID: fritz-1
        Network: 192.168.1.0/24
        Status: Not Selected
    
      - ID: fritz-40
        Network: 192.168.40.0/24
        Status: Not Selected
    
  4. Check the operating system's routing table using ip route show or route -n.
    aronmal@pop-os:~$ ip route show
    default via 10.0.0.1 dev wlo1 proto dhcp metric 600 
    10.0.0.0/8 dev wlo1 proto kernel scope link src 10.0.253.18 metric 600 
    100.99.0.0/16 dev wt0 proto kernel scope link src 100.99.250.224 
    169.254.0.0/16 dev wlo1 scope link metric 1000 
    aronmal@pop-os:~$ route -n
    Kernel IP routing table
    Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
    0.0.0.0         10.0.0.1        0.0.0.0         UG    600    0        0 wlo1
    10.0.0.0        0.0.0.0         255.0.0.0       U     600    0        0 wlo1
    100.99.0.0      0.0.0.0         255.255.0.0     U     0      0        0 wt0
    169.254.0.0     0.0.0.0         255.255.0.0     U     1000   0        0 wlo1
    
  5. Observe that the route for 10.1.0.0/24 is missing from the OS routing table.

Expected behavior

The route for 10.1.0.0/24 should be successfully installed and visible in the operating system's routing table after being explicitly selected in NetBird, allowing traffic to the remote network.

Are you using NetBird Cloud?

Yes

NetBird version

0.52.2

Is any other VPN software installed?

No

Debug output

To help us resolve the problem, please attach the following anonymized status output:

aronmal@pop-os:~$ netbird status -dA
Peers detail:
 debian.netbird.cloud:
  NetBird IP: 100.99.138.105/32
  Public key: wTOpoSxMB2grAhi5lZZUVynvPYrAzErGj0l4QrSxQCs=
  Status: Idle
  -- detail --
  Connection type: P2P
  ICE candidate (Local/Remote): -/-
  ICE candidate endpoints (Local/Remote): -/-
  Relay server address: 
  Last connection update: 25 minutes, 10 seconds ago
  Last WireGuard handshake: -
  Transfer status (received/sent) 0 B/0 B
  Quantum resistance: false
  Networks: -
  Latency: 0s

 twintower.netbird.cloud:
  NetBird IP: 100.99.73.220
  Public key: k8HzsgAVgyCL4fvDRKyRwlptjHhxx5iwCukySkiVAxk=
  Status: Connected
  -- detail --
  Connection type: Relayed
  ICE candidate (Local/Remote): -/-
  ICE candidate endpoints (Local/Remote): -/-
  Relay server address: rels://streamline-de-fra1-2.relay.netbird.io:443
  Last connection update: 23 minutes, 49 seconds ago
  Last WireGuard handshake: 2 minutes, 38 seconds ago
  Transfer status (received/sent) 2.8 KiB/7.4 KiB
  Quantum resistance: false
  Networks: -
  Latency: 0s

 pve2.netbird.cloud:
  NetBird IP: 100.99.121.218
  Public key: ZHC3t646CMe0IDAiTjP+scvCq8oS+MDftTcHF8zasQc=
  Status: Connected
  -- detail --
  Connection type: Relayed
  ICE candidate (Local/Remote): -/-
  ICE candidate endpoints (Local/Remote): -/-
  Relay server address: rels://streamline-de-fra1-2.relay.netbird.io:443
  Last connection update: 23 minutes, 45 seconds ago
  Last WireGuard handshake: 58 seconds ago
  Transfer status (received/sent) 4.6 KiB/6.9 KiB
  Quantum resistance: false
  Networks: 10.1.0.0/24
  Latency: 0s

 pve1.netbird.cloud:
  NetBird IP: 100.99.151.94
  Public key: M8Gx5c2L41Vpn0jscIvXHzi/hLSV/nT2PTg7xN01LhY=
  Status: Connected
  -- detail --
  Connection type: Relayed
  ICE candidate (Local/Remote): -/-
  ICE candidate endpoints (Local/Remote): -/-
  Relay server address: rels://streamline-de-fra1-2.relay.netbird.io:443
  Last connection update: 23 minutes, 49 seconds ago
  Last WireGuard handshake: 11 seconds ago
  Transfer status (received/sent) 1.1 MiB/126.4 KiB
  Quantum resistance: false
  Networks: -
  Latency: 0s

 pve3.netbird.cloud:
  NetBird IP: 100.99.245.69
  Public key: L2r906W6kZ4yNmeDJLjuJfex5yuI61iNw7sZtrZXBTk=
  Status: Connecting
  -- detail --
  Connection type: P2P
  ICE candidate (Local/Remote): -/-
  ICE candidate endpoints (Local/Remote): -/-
  Relay server address: 
  Last connection update: 40 minutes, 5 seconds ago
  Last WireGuard handshake: -
  Transfer status (received/sent) 0 B/0 B
  Quantum resistance: false
  Networks: -
  Latency: 0s

Events:
  [INFO] SYSTEM (acbba7a6-4ab7-4780-a02c-a7ec4fbcc44f)
    Message: Network map updated
    Time: 11 hours, 37 minutes ago
  [INFO] SYSTEM (42bf2296-4d48-446d-b82b-c0ca712bb6a0)
    Message: Network map updated
    Time: 8 hours, 35 minutes ago
  [INFO] SYSTEM (7412037c-7ba5-4dd3-8a1b-e1de1d0627f5)
    Message: Network map updated
    Time: 44 minutes, 57 seconds ago
  [INFO] SYSTEM (61556263-4df8-40a9-b5d4-76f9b5b644c1)
    Message: Network map updated
    Time: 44 minutes, 50 seconds ago
  [INFO] SYSTEM (c8d540f4-7cb5-4f66-afe9-ef871756fbd5)
    Message: Network map updated
    Time: 40 minutes, 5 seconds ago
  [INFO] SYSTEM (e426bc9b-f674-47f8-a756-c0d90bc83531)
    Message: Network map updated
    Time: 29 minutes, 42 seconds ago
  [INFO] SYSTEM (73bddcc8-ec24-4e2c-9688-5aceb2cbb33d)
    Message: Network deselection changed
    Time: 27 minutes, 43 seconds ago
    Metadata: all: false, append: false, networks: 10er
  [INFO] SYSTEM (72f28e21-6e6b-4f8b-bfb5-46b1896ad7aa)
    Message: Network selection changed
    Time: 27 minutes, 36 seconds ago
    Metadata: all: false, append: true, networks: 10er
  [INFO] SYSTEM (d4a48abf-2da2-42bb-b5bb-116744357acc)
    Message: Network map updated
    Time: 25 minutes, 10 seconds ago
  [INFO] SYSTEM (eec92f8e-b11d-4679-96d3-b84c1e5658eb)
    Message: Network selection changed
    Time: 14 minutes, 24 seconds ago
    Metadata: all: false, append: false, networks: 10er
OS: linux/amd64
Daemon version: 0.55.1
CLI version: 0.55.1
Profile: default
Management: Connected to https://api.netbird.io:443
Signal: Connected to https://signal.netbird.io:443
Relays: 
  [stun:stun.netbird.io:443] is Available
  [stun:stun.netbird.io:5555] is Available
  [turns:turn.netbird.io:443?transport=tcp] is Available
  [rels://streamline-de-fra1-2.relay.netbird.io:443] is Available
Nameservers: 
FQDN: pop-os.netbird.cloud
NetBird IP: 100.99.250.224/16
Interface type: Kernel
Quantum resistance: false
Lazy connection: false
Networks: -
Forwarding rules: 0
Peers count: 3/5 Connected

Create and upload a debug bundle, and share the returned file key:

aronmal@pop-os:~$ netbird debug for 1m -AS -U
Log level set to trace.
netbird down
netbird up
Remaining time: 00:00:01
Duration completed
Creating debug bundle...
Log level restored to INFO
Local file:
/tmp/netbird.debug.2849761301.zip
Upload file key:
f79e391890ab27fb37c88b3b4be7011e22aa2e5ca6f38ffa9c4481884941f726/2e7991cf-128a-4e81-96f1-8d0750965c44

Additional context

  • Operating System (Client): Pop!_OS
  • Local Network: 10.0.0.0/8 (public Wi-Fi)
  • Remote Network: 10.1.0.0/24 (via NetBird route ID 10er)
  • Routing Peer OS: debian
  • Masquerading: Masquerading is enabled for the 10.1.0.0/24 route in the NetBird control panel
  • Routing Peer NetBird IP: 100.99.121.218
  • Access Control: Working when connected to any other wifi network before
  • Client Logs: The provided logs show successful relay connections but no explicit errors regarding route installation.
    2025-08-26T08:36:46+02:00 INFO [peer: k8HzsgAVgyCL4fvDRKyRwlptjHhxx5iwCukySkiVAxk=] client/internal/peer/handshaker.go:96: received offer, running version 0.52.2, remote WireGuard listen port 54436, session id: unknown
    ...
    2025-08-26T08:37:03+02:00 INFO [peer: M8Gx5c2L41Vpn0jscIvXHzi/hLSV/nT2PTg7xN01LhY=] client/internal/peer/conn.go:293: OnRemoteOffer, on status ICE: Disconnected, status Relay: Connected
    ...
    2025-08-26T08:38:37+02:00 WARN [peer: ZHC3t646CMe0IDAiTjP+scvCq8oS+MDftTcHF8zasQc=] client/internal/peer/worker_ice.go:158: ICE Agent is not initialized yet
    ...
    

Have you tried these troubleshooting steps?

  • Reviewed client troubleshooting
  • Checked for newer NetBird versions
  • Searched for similar issues on GitHub (including closed ones) - This is the purpose of creating this issue.
  • Restarted the NetBird client
  • Disabled other VPN software
  • Checked firewall settings
Originally created by @aronmal on GitHub (Aug 26, 2025). Here is the filled-out NetBird GitHub issue template based on our conversation. Please provide the missing information where prompted. --- ### **Describe the problem** A NetBird route for the remote network **10.1.0.0/24** is selected on the client, but it is **not being installed into the operating system's kernel routing table**. This occurs when the client is connected to a local network with an **overlapping IP range**, specifically a public Wi-Fi network using **10.0.0.0/8**. Despite the route selection feature being used, the route does not appear in the OS routing table, preventing access to the remote network. ### **To Reproduce** Steps to reproduce the behavior: 1. Connect the NetBird client to a local network with an IP range that overlaps with a configured NetBird network route (e.g., local network 10.0.0.0/8, NetBird route 10.1.0.0/24). 2. Ensure the NetBird client is running and connected to the control plane and peers (logs show successful relay connections). 3. Verify the route status using ```netbird routes list```. Observe that the route for 10.1.0.0/24 is listed as "Selected". ```bash aronmal@pop-os:~$ netbird routes list Available Networks: - ID: 10er Network: 10.1.0.0/24 Status: Selected - ID: fritz-1 Network: 192.168.1.0/24 Status: Not Selected - ID: fritz-40 Network: 192.168.40.0/24 Status: Not Selected ``` 4. Check the operating system's routing table using ```ip route show``` or ```route -n```. ```bash aronmal@pop-os:~$ ip route show default via 10.0.0.1 dev wlo1 proto dhcp metric 600 10.0.0.0/8 dev wlo1 proto kernel scope link src 10.0.253.18 metric 600 100.99.0.0/16 dev wt0 proto kernel scope link src 100.99.250.224 169.254.0.0/16 dev wlo1 scope link metric 1000 aronmal@pop-os:~$ route -n Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 0.0.0.0 10.0.0.1 0.0.0.0 UG 600 0 0 wlo1 10.0.0.0 0.0.0.0 255.0.0.0 U 600 0 0 wlo1 100.99.0.0 0.0.0.0 255.255.0.0 U 0 0 0 wt0 169.254.0.0 0.0.0.0 255.255.0.0 U 1000 0 0 wlo1 ``` 5. Observe that the route for 10.1.0.0/24 is **missing** from the OS routing table. ### **Expected behavior** The route for 10.1.0.0/24 should be successfully installed and visible in the operating system's routing table after being explicitly selected in NetBird, allowing traffic to the remote network. ### **Are you using NetBird Cloud?** Yes ### **NetBird version** 0.52.2 ### **Is any other VPN software installed?** No ### **Debug output** To help us resolve the problem, please attach the following anonymized status output: ```bash aronmal@pop-os:~$ netbird status -dA Peers detail: debian.netbird.cloud: NetBird IP: 100.99.138.105/32 Public key: wTOpoSxMB2grAhi5lZZUVynvPYrAzErGj0l4QrSxQCs= Status: Idle -- detail -- Connection type: P2P ICE candidate (Local/Remote): -/- ICE candidate endpoints (Local/Remote): -/- Relay server address: Last connection update: 25 minutes, 10 seconds ago Last WireGuard handshake: - Transfer status (received/sent) 0 B/0 B Quantum resistance: false Networks: - Latency: 0s twintower.netbird.cloud: NetBird IP: 100.99.73.220 Public key: k8HzsgAVgyCL4fvDRKyRwlptjHhxx5iwCukySkiVAxk= Status: Connected -- detail -- Connection type: Relayed ICE candidate (Local/Remote): -/- ICE candidate endpoints (Local/Remote): -/- Relay server address: rels://streamline-de-fra1-2.relay.netbird.io:443 Last connection update: 23 minutes, 49 seconds ago Last WireGuard handshake: 2 minutes, 38 seconds ago Transfer status (received/sent) 2.8 KiB/7.4 KiB Quantum resistance: false Networks: - Latency: 0s pve2.netbird.cloud: NetBird IP: 100.99.121.218 Public key: ZHC3t646CMe0IDAiTjP+scvCq8oS+MDftTcHF8zasQc= Status: Connected -- detail -- Connection type: Relayed ICE candidate (Local/Remote): -/- ICE candidate endpoints (Local/Remote): -/- Relay server address: rels://streamline-de-fra1-2.relay.netbird.io:443 Last connection update: 23 minutes, 45 seconds ago Last WireGuard handshake: 58 seconds ago Transfer status (received/sent) 4.6 KiB/6.9 KiB Quantum resistance: false Networks: 10.1.0.0/24 Latency: 0s pve1.netbird.cloud: NetBird IP: 100.99.151.94 Public key: M8Gx5c2L41Vpn0jscIvXHzi/hLSV/nT2PTg7xN01LhY= Status: Connected -- detail -- Connection type: Relayed ICE candidate (Local/Remote): -/- ICE candidate endpoints (Local/Remote): -/- Relay server address: rels://streamline-de-fra1-2.relay.netbird.io:443 Last connection update: 23 minutes, 49 seconds ago Last WireGuard handshake: 11 seconds ago Transfer status (received/sent) 1.1 MiB/126.4 KiB Quantum resistance: false Networks: - Latency: 0s pve3.netbird.cloud: NetBird IP: 100.99.245.69 Public key: L2r906W6kZ4yNmeDJLjuJfex5yuI61iNw7sZtrZXBTk= Status: Connecting -- detail -- Connection type: P2P ICE candidate (Local/Remote): -/- ICE candidate endpoints (Local/Remote): -/- Relay server address: Last connection update: 40 minutes, 5 seconds ago Last WireGuard handshake: - Transfer status (received/sent) 0 B/0 B Quantum resistance: false Networks: - Latency: 0s Events: [INFO] SYSTEM (acbba7a6-4ab7-4780-a02c-a7ec4fbcc44f) Message: Network map updated Time: 11 hours, 37 minutes ago [INFO] SYSTEM (42bf2296-4d48-446d-b82b-c0ca712bb6a0) Message: Network map updated Time: 8 hours, 35 minutes ago [INFO] SYSTEM (7412037c-7ba5-4dd3-8a1b-e1de1d0627f5) Message: Network map updated Time: 44 minutes, 57 seconds ago [INFO] SYSTEM (61556263-4df8-40a9-b5d4-76f9b5b644c1) Message: Network map updated Time: 44 minutes, 50 seconds ago [INFO] SYSTEM (c8d540f4-7cb5-4f66-afe9-ef871756fbd5) Message: Network map updated Time: 40 minutes, 5 seconds ago [INFO] SYSTEM (e426bc9b-f674-47f8-a756-c0d90bc83531) Message: Network map updated Time: 29 minutes, 42 seconds ago [INFO] SYSTEM (73bddcc8-ec24-4e2c-9688-5aceb2cbb33d) Message: Network deselection changed Time: 27 minutes, 43 seconds ago Metadata: all: false, append: false, networks: 10er [INFO] SYSTEM (72f28e21-6e6b-4f8b-bfb5-46b1896ad7aa) Message: Network selection changed Time: 27 minutes, 36 seconds ago Metadata: all: false, append: true, networks: 10er [INFO] SYSTEM (d4a48abf-2da2-42bb-b5bb-116744357acc) Message: Network map updated Time: 25 minutes, 10 seconds ago [INFO] SYSTEM (eec92f8e-b11d-4679-96d3-b84c1e5658eb) Message: Network selection changed Time: 14 minutes, 24 seconds ago Metadata: all: false, append: false, networks: 10er OS: linux/amd64 Daemon version: 0.55.1 CLI version: 0.55.1 Profile: default Management: Connected to https://api.netbird.io:443 Signal: Connected to https://signal.netbird.io:443 Relays: [stun:stun.netbird.io:443] is Available [stun:stun.netbird.io:5555] is Available [turns:turn.netbird.io:443?transport=tcp] is Available [rels://streamline-de-fra1-2.relay.netbird.io:443] is Available Nameservers: FQDN: pop-os.netbird.cloud NetBird IP: 100.99.250.224/16 Interface type: Kernel Quantum resistance: false Lazy connection: false Networks: - Forwarding rules: 0 Peers count: 3/5 Connected ``` Create and upload a debug bundle, and share the returned file key: ```bash aronmal@pop-os:~$ netbird debug for 1m -AS -U Log level set to trace. netbird down netbird up Remaining time: 00:00:01 Duration completed Creating debug bundle... Log level restored to INFO Local file: /tmp/netbird.debug.2849761301.zip Upload file key: f79e391890ab27fb37c88b3b4be7011e22aa2e5ca6f38ffa9c4481884941f726/2e7991cf-128a-4e81-96f1-8d0750965c44 ``` ### **Additional context** * **Operating System (Client):** Pop!_OS * **Local Network:** 10.0.0.0/8 (public Wi-Fi) * **Remote Network:** 10.1.0.0/24 (via NetBird route ID ```10er```) * **Routing Peer OS:** debian * **Masquerading:** Masquerading is enabled for the 10.1.0.0/24 route in the NetBird control panel * **Routing Peer NetBird IP:** 100.99.121.218 * **Access Control:** Working when connected to any other wifi network before * **Client Logs:** The provided logs show successful relay connections but no explicit errors regarding route installation. ``` 2025-08-26T08:36:46+02:00 INFO [peer: k8HzsgAVgyCL4fvDRKyRwlptjHhxx5iwCukySkiVAxk=] client/internal/peer/handshaker.go:96: received offer, running version 0.52.2, remote WireGuard listen port 54436, session id: unknown ... 2025-08-26T08:37:03+02:00 INFO [peer: M8Gx5c2L41Vpn0jscIvXHzi/hLSV/nT2PTg7xN01LhY=] client/internal/peer/conn.go:293: OnRemoteOffer, on status ICE: Disconnected, status Relay: Connected ... 2025-08-26T08:38:37+02:00 WARN [peer: ZHC3t646CMe0IDAiTjP+scvCq8oS+MDftTcHF8zasQc=] client/internal/peer/worker_ice.go:158: ICE Agent is not initialized yet ... ``` ### **Have you tried these troubleshooting steps?** - [x] Reviewed [client troubleshooting](https://docs.netbird.io/how-to/troubleshooting-client) - [x] Checked for newer NetBird versions - [x] Searched for similar issues on GitHub (including closed ones) - *This is the purpose of creating this issue.* - [x] Restarted the NetBird client - [x] Disabled other VPN software - [x] Checked firewall settings
saavagebueno added the triage-needed label 2025-11-20 07:06:13 -05:00
Author
Owner

@nazarewk commented on GitHub (Sep 1, 2025):

@aronmal the route is added to the netbird / 7120 / 0x1BD0

99bd34c02a/client/internal/routemanager/systemops/systemops_linux.go (L47-L47)

it is present in routes.txt as such in your debug bundle:

Routing Table:
==============

Destination                   Gateway   Interface  Idx  Metric  Protocol  Scope   Type       Table    Flags  
----------------------------  --------  ---------  ---  ------  --------  ------  ---------  -------  -----  
...
0.0.0.0/0                     10.0.0.1  wlo1       2    600     dhcp      global  unicast    main     -      
10.0.0.0/8                    -         wlo1       2    600     kernel    link    unicast    main     -      
...
10.1.0.0/24                   -         wt0        45   0       boot      global  unicast    netbird  -      
@nazarewk commented on GitHub (Sep 1, 2025): @aronmal the route is added to the `netbird` / `7120` / `0x1BD0` https://github.com/netbirdio/netbird/blob/99bd34c02a1bcd45af5d5a18f5a1a3a92bafda90/client/internal/routemanager/systemops/systemops_linux.go#L47-L47 it is present in `routes.txt` as such in your debug bundle: ```text Routing Table: ============== Destination Gateway Interface Idx Metric Protocol Scope Type Table Flags ---------------------------- -------- --------- --- ------ -------- ------ --------- ------- ----- ... 0.0.0.0/0 10.0.0.1 wlo1 2 600 dhcp global unicast main - 10.0.0.0/8 - wlo1 2 600 kernel link unicast main - ... 10.1.0.0/24 - wt0 45 0 boot global unicast netbird - ```
Author
Owner

@aronmal commented on GitHub (Oct 14, 2025):

Good. I wouldn't expect netbird not to pick up the route, but why isn't it then shown by ip route and route?

I understand there would be a collision and the local network would become unreachable and by that maybe the internet connection in general if the default gateway can't be reached.

Could there then be a warning or info for users?

Who is going to first check for the hotspots network range. There may be more people confused why they can't reach their services. One might look in the netbird dashboard as first thought, if they still got permissions. But it still is a big hurdle if the connection is expected to work (even though it maybe shouldn't in such a situation and one should better start a hotspot on their phone to have NAT if not needing to connect to local devices and just lurk the internet connection)

@aronmal commented on GitHub (Oct 14, 2025): Good. I wouldn't expect netbird not to pick up the route, but why isn't it then shown by `ip route` and `route`? I understand there would be a collision and the local network would become unreachable and by that maybe the internet connection in general if the default gateway can't be reached. Could there then be a warning or info for users? Who is going to first check for the hotspots network range. There may be more people confused why they can't reach their services. One might look in the netbird dashboard as first thought, if they still got permissions. But it still is a big hurdle if the connection is expected to work (even though it maybe shouldn't in such a situation and one should better start a hotspot on their phone to have NAT if not needing to connect to local devices and just lurk the internet connection)
Sign in to join this conversation.
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: SVI/netbird#2227