SVI/netbird
1
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-05-10 02:02:26 -04:00
Code Issues 3.0k Packages Projects Releases 10 Wiki Activity

Input chain rules on routing peers for subnet resources #2236

New Issue
Closed
opened 2025-11-20 07:06:19 -05:00 by saavagebueno · 4 comments
saavagebueno commented 2025-11-20 07:06:19 -05:00
Owner
Copy Link

Originally created by @mrlhansen on GitHub (Aug 29, 2025).

I am not really sure if the following is intentional or not.

I defined a network under "Networks" and the network has several subnets as resources. Next I create an ACL for accessing one of the subnets (e.g. 192.168.0.0/16) by choosing the subnet resource as the destination.

The network has two routing peers, and these peers have a local address inside the 192.168.0.0/16 subnet. The IP address on the routing peer is not accessible due to missing rules in the input chain, while IPs residing on other machines are accessible, because the forwarding chain is correct.

The routing peers are Linux machines and I see the missing rules in the input chain when dumping the nftables.

To Reproduce

Steps to reproduce the behavior:

  1. Create a network with the subnet 192.168.0.0/16 as a resource.
  2. Assign a routing peer for the network.
  3. Create an ACL for accessing the 192.168.0.0/16 subnet.
  4. On the node for the routing peer assign the IP address 192.168.1.1
  5. Try to ping the 192.168.1.1 from another peer that has access to the 192.168.0.0/16 via the before mentioned ACL.
  6. Ping fails due to missing rules in the input chain.

Expected behavior

I would expect the input chain to also honor traffic to the allowed subnet.

Are you using NetBird Cloud?

I am using self-host NetBird's control plane.

NetBird version

0.55.1

Is any other VPN software installed?

No.

Additional context

Here is a partial dump of the nftable rules. The two peers 100.69.3.60, 100.69.42.193 have access to all resources on the routing peers, while 100.69.196.121 only has access to the 10.128.0.0/24 subnet.

table ip netbird {
	set nb0000001 {
		type ipv4_addr
		flags dynamic
		elements = { 100.69.3.60, 100.69.42.193 }
	}

	set nb-4776d0f5 {
		type ipv4_addr
		flags interval
		elements = { 100.69.3.60, 100.69.42.193 }
	}

	set nb-70e1f9f5 {
		type ipv4_addr
		flags interval
		elements = { 100.69.3.60, 100.69.42.193,
			     100.69.196.121 }
	}

	chain netbird-rt-fwd {
		ct state established,related counter packets 5 bytes 306 accept
		...
		ip saddr @nb-4776d0f5 ip daddr 10.132.0.0/24 counter packets 0 bytes 0 accept
		ip saddr @nb-4776d0f5 ip daddr 10.128.0.0/24 counter packets 0 bytes 0 accept
		ip saddr @nb-70e1f9f5 ip daddr 10.128.0.0/24 counter packets 0 bytes 0 accept
	}

	chain netbird-acl-input-rules {
		ct state established,related counter packets 468 bytes 112631 accept
		ip saddr @nb0000001 accept
	}

	chain netbird-acl-input-filter {
		type filter hook input priority filter; policy accept;
		iifname "wt0" jump netbird-acl-input-rules
		iifname "wt0" drop
	}

	chain netbird-acl-forward-filter {
		type filter hook forward priority filter; policy accept;
		meta mark 0x0001bd20 accept
		iifname "wt0" jump netbird-rt-fwd
		iifname "wt0" drop
	}
}
Originally created by @mrlhansen on GitHub (Aug 29, 2025). I am not really sure if the following is intentional or not. I defined a network under "Networks" and the network has several subnets as resources. Next I create an ACL for accessing one of the subnets (e.g. 192.168.0.0/16) by choosing the subnet resource as the destination. The network has two routing peers, and these peers have a local address inside the 192.168.0.0/16 subnet. The IP address on the routing peer is not accessible due to missing rules in the input chain, while IPs residing on other machines are accessible, because the forwarding chain is correct. The routing peers are Linux machines and I see the missing rules in the input chain when dumping the nftables. **To Reproduce** Steps to reproduce the behavior: 1. Create a network with the subnet 192.168.0.0/16 as a resource. 2. Assign a routing peer for the network. 3. Create an ACL for accessing the 192.168.0.0/16 subnet. 4. On the node for the routing peer assign the IP address 192.168.1.1 5. Try to ping the 192.168.1.1 from another peer that has access to the 192.168.0.0/16 via the before mentioned ACL. 6. Ping fails due to missing rules in the input chain. **Expected behavior** I would expect the input chain to also honor traffic to the allowed subnet. **Are you using NetBird Cloud?** I am using self-host NetBird's control plane. **NetBird version** `0.55.1` **Is any other VPN software installed?** No. **Additional context** Here is a partial dump of the nftable rules. The two peers `100.69.3.60, 100.69.42.193` have access to all resources on the routing peers, while `100.69.196.121` only has access to the `10.128.0.0/24` subnet. ```text table ip netbird { set nb0000001 { type ipv4_addr flags dynamic elements = { 100.69.3.60, 100.69.42.193 } } set nb-4776d0f5 { type ipv4_addr flags interval elements = { 100.69.3.60, 100.69.42.193 } } set nb-70e1f9f5 { type ipv4_addr flags interval elements = { 100.69.3.60, 100.69.42.193, 100.69.196.121 } } chain netbird-rt-fwd { ct state established,related counter packets 5 bytes 306 accept ... ip saddr @nb-4776d0f5 ip daddr 10.132.0.0/24 counter packets 0 bytes 0 accept ip saddr @nb-4776d0f5 ip daddr 10.128.0.0/24 counter packets 0 bytes 0 accept ip saddr @nb-70e1f9f5 ip daddr 10.128.0.0/24 counter packets 0 bytes 0 accept } chain netbird-acl-input-rules { ct state established,related counter packets 468 bytes 112631 accept ip saddr @nb0000001 accept } chain netbird-acl-input-filter { type filter hook input priority filter; policy accept; iifname "wt0" jump netbird-acl-input-rules iifname "wt0" drop } chain netbird-acl-forward-filter { type filter hook forward priority filter; policy accept; meta mark 0x0001bd20 accept iifname "wt0" jump netbird-rt-fwd iifname "wt0" drop } } ```
saavagebueno added the triage-needed label 2025-11-20 07:06:19 -05:00
saavagebueno commented 2025-11-20 07:06:20 -05:00
Author
Owner
Copy Link

@nazarewk commented on GitHub (Aug 29, 2025):

While this is still work in progress, please take a look at the explanation at https://github.com/netbirdio/docs/pull/401

PS: yes, the PR contains one big screenshot

@nazarewk commented on GitHub (Aug 29, 2025): While this is still work in progress, please take a look at the explanation at https://github.com/netbirdio/docs/pull/401 PS: yes, the PR contains one big screenshot
saavagebueno commented 2025-11-20 07:06:20 -05:00
Author
Owner
Copy Link

@mrlhansen commented on GitHub (Aug 29, 2025):

@nazarewk Yes, this is does exactly describe the "issue" that I am seeing. I assume the solution is just a secondary rule to give access to the local peer address.

@mrlhansen commented on GitHub (Aug 29, 2025): @nazarewk Yes, this is does exactly describe the "issue" that I am seeing. I assume the solution is just a secondary rule to give access to the local peer address.
saavagebueno commented 2025-11-20 07:06:20 -05:00
Author
Owner
Copy Link

@nazarewk commented on GitHub (Aug 29, 2025):

I assume the solution is just a secondary rule to give access to the local peer address.

exactly

@nazarewk commented on GitHub (Aug 29, 2025): > I assume the solution is just a secondary rule to give access to the local peer address. exactly
saavagebueno commented 2025-11-20 07:06:20 -05:00
Author
Owner
Copy Link

@mrlhansen commented on GitHub (Aug 29, 2025):

Thanks for the help, I am closing the issue.

@mrlhansen commented on GitHub (Aug 29, 2025): Thanks for the help, I am closing the issue.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
2021 Q4
2022 Q1
2022 Q1
accessibility
acl
agent
agent
Android
Android
api
authentik
automation
azure
battery-usage
bug
cache
client
client-ui
cloud
cloud-only
cloudflare
community
compatibility
config-idp
config-issue
connection
contribution
coturn
cross-vpn
dashboard
data-usage
distribution
dns
docker
documentation
duplicate
enhancement
enhancement
event-stream
feature-request
freebsd
getting-started
go
good first issue
gui
help wanted
home-assistant
idp
inconsistency
integration
integrations
ios
ipv6
jwt
k8s
keycloak
linux
login
macos
management-service
missing-docs
mobile
moved-internal
needs-review
netbird-ui
networking
new-platform
nginx
notification
okta
openwrt
packaging
peer-management
peer-management
peer-management
performance
postgres
posture-checks
psk
pull-request
Mirrored from GitHub Pull Request
 question
refactor
relay
release
rfc
routes
security
security-related
self-hosting
server
signal
sleep-issue
ssh
ssl
status
store
synology
system-compatibility-issue
test-suite
third-party-integration
triage
triage-needed
troubleshooting
UX
waiting-feedback
windows
wontfix
zitadel
No Label triage-needed
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
saavagebueno
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: SVI/netbird#2236
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?