SVI/netbird
1
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-05-15 04:32:40 -04:00
Code Issues 3.0k Packages Projects Releases 10 Wiki Activity

AllowedIP without routing #275

New Issue
Open
opened 2025-11-20 05:08:58 -05:00 by saavagebueno · 15 comments
saavagebueno commented 2025-11-20 05:08:58 -05:00
Owner
Copy Link

Originally created by @stevefan1999-personal on GitHub (Feb 17, 2023).

Is your feature request related to a problem? Please describe.

I need to use Calico with my k0s cluster and I need to have allowed IP without auto IP route in netbird, because Calico already handled routing by using BIRD and will intelligently select wt0 as the gateway. But because my pod and service CIDR is not in the allowed IP list, I got required keys error which indeed is because the IP is not allowef

Describe the solution you'd like
Allow the option to disable route but keep allowed IPs

Describe alternatives you've considered
Use VXLAN on top of wt0, no dice
Use another wireguard on top of wt0 (Calico supports wireguard too), cannot create IP socket

Additional context
Add any other context or screenshots about the feature request here.

Originally created by @stevefan1999-personal on GitHub (Feb 17, 2023). **Is your feature request related to a problem? Please describe.** I need to use Calico with my k0s cluster and I need to have allowed IP without auto IP route in netbird, because Calico already handled routing by using BIRD and will intelligently select wt0 as the gateway. But because my pod and service CIDR is not in the allowed IP list, I got required keys error which indeed is because the IP is not allowef **Describe the solution you'd like** Allow the option to disable route but keep allowed IPs **Describe alternatives you've considered** Use VXLAN on top of wt0, no dice Use another wireguard on top of wt0 (Calico supports wireguard too), cannot create IP socket **Additional context** Add any other context or screenshots about the feature request here.
saavagebueno added the feature-requestwaiting-feedback labels 2025-11-20 05:08:58 -05:00
saavagebueno commented 2025-11-20 05:08:58 -05:00
Author
Owner
Copy Link

@ashish1099 commented on GitHub (Mar 28, 2023):

@stevefan1999-personal did you got it working ?

on my k8s cluster calico-node pod is just failing to start when netbird is running, and calico-node pods works fine, when netbird is stopped.

@ashish1099 commented on GitHub (Mar 28, 2023): @stevefan1999-personal did you got it working ? on my k8s cluster calico-node pod is just failing to start when netbird is running, and calico-node pods works fine, when netbird is stopped.
saavagebueno commented 2025-11-20 05:08:59 -05:00
Author
Owner
Copy Link

@stevefan1999-personal commented on GitHub (Mar 28, 2023):

@ashish1099 I decided to remove Netbird from my K8S node simply because of this

@stevefan1999-personal commented on GitHub (Mar 28, 2023): @ashish1099 I decided to remove Netbird from my K8S node simply because of this
saavagebueno commented 2025-11-20 05:08:59 -05:00
Author
Owner
Copy Link

@KlavsKlavsen commented on GitHub (Mar 30, 2023):

Yeah.. we finally got time to start trying out netbird - but are stuck on this :(

@KlavsKlavsen commented on GitHub (Mar 30, 2023): Yeah.. we finally got time to start trying out netbird - but are stuck on this :(
saavagebueno commented 2025-11-20 05:08:59 -05:00
Author
Owner
Copy Link

@ashish1099 commented on GitHub (Mar 30, 2023):

This failed later on. I'm waiting on calico 3.26 which has a bgpfilter and will try to exclude the netbird cidr.
will update here when I have reached that stage.

Adding a bgpconfiguration which made this work.

apiVersion: crd.projectcalico.org/v1
kind: BGPConfiguration
metadata:
  name: default
spec:
  logSeverityScreen: Error
  nodeToNodeMeshEnabled: false
  asNumber: 64512

I got the idea from here https://github.com/projectcalico/calico/issues/3760#issuecomment-808418033

@ashish1099 commented on GitHub (Mar 30, 2023): This failed later on. I'm waiting on calico 3.26 which has a bgpfilter and will try to exclude the netbird cidr. will update here when I have reached that stage. ~Adding a bgpconfiguration which made this work.~ ```yaml apiVersion: crd.projectcalico.org/v1 kind: BGPConfiguration metadata: name: default spec: logSeverityScreen: Error nodeToNodeMeshEnabled: false asNumber: 64512 ``` I got the idea from here https://github.com/projectcalico/calico/issues/3760#issuecomment-808418033
saavagebueno commented 2025-11-20 05:08:59 -05:00
Author
Owner
Copy Link

@damoasis commented on GitHub (Nov 12, 2023):

Any news?

@damoasis commented on GitHub (Nov 12, 2023): Any news?
saavagebueno commented 2025-11-20 05:08:59 -05:00
Author
Owner
Copy Link

@ashish1099 commented on GitHub (Nov 13, 2023):

@damoasis the latest calico didn't worked for me unfortunately.

We are going to try cilium now and I will update it here, if I was able to made it work with netbird.

@ashish1099 commented on GitHub (Nov 13, 2023): @damoasis the latest calico didn't worked for me unfortunately. We are going to try cilium now and I will update it here, if I was able to made it work with netbird.
saavagebueno commented 2025-11-20 05:08:59 -05:00
Author
Owner
Copy Link

@mlsmaycon commented on GitHub (Nov 14, 2023):

Hello @ashish1099, When creating an interface, NetBird sets its local route 100.X.X.X/16 to the host (or container) routing table. Is that the main issue, or is it happening when using network routes?

Can you share a bit more about the issue:

  • Is the NetBird agent running on the host or as a container with the host network?
  • Do you run the agent as a daemon on all nodes of the cluster?
@mlsmaycon commented on GitHub (Nov 14, 2023): Hello @ashish1099, When creating an interface, NetBird sets its local route 100.X.X.X/16 to the host (or container) routing table. Is that the main issue, or is it happening when using network routes? Can you share a bit more about the issue: - Is the NetBird agent running on the host or as a container with the host network? - Do you run the agent as a daemon on all nodes of the cluster?
saavagebueno commented 2025-11-20 05:08:59 -05:00
Author
Owner
Copy Link

@damoasis commented on GitHub (Nov 15, 2023):

@mlsmaycon

  • NetBird agent running on the host or as a container with the host network all has the same issue
  • run the agent as a daemon on all nodes of the cluster

the test k8s environment (the cni is calico):

  • 1 master,2 nodes(k8s-node1,k8s-node2), and 1 client (win 10 pc)
  • run NetBird agent on all the nodes (include the master and the pc);
  • the pod cidr is 10.233.0.0/16

In order to let the client connect to the pod with pod ip in the k8s cluster directly I add a Network route to k8s-node2:

  • add Network Routes 10.233.0.0/16 to the peer k8s-node2 and the Distribution groups is the client

After add the network route:

  • The client(win 10 pc) can connect to the pod in the k8s cluster with the pod ip directly
  • And also the pod can connect to the client directly.

The problem is that:

  • any pod on the k8s-node2 can not connet to other pod or service with service name or domain name but can still connect to other service or pod with ip address
  • can not schedule any new pod to the k8s-node2
  • and also the daemon set calico-node on the k8s-node2 in the kube-system namespace can not work any more when be killed. As a result the client could not connect to the pod any more.

image

But when remove the Routes and restart the machine of k8s-node2 all will go right.

@damoasis commented on GitHub (Nov 15, 2023): @mlsmaycon - NetBird agent running on the host or as a container with the host network all has the same issue - run the agent as a daemon on all nodes of the cluster the test k8s environment (the cni is calico): - 1 master,2 nodes(k8s-node1,k8s-node2), and 1 client (win 10 pc) - run NetBird agent on all the nodes (include the master and the pc); - the pod cidr is 10.233.0.0/16 In order to let the client connect to the pod with pod ip in the k8s cluster directly I add a Network route to k8s-node2: - add Network Routes 10.233.0.0/16 to the peer k8s-node2 and the Distribution groups is the client After add the network route: - The client(win 10 pc) can connect to the pod in the k8s cluster with the pod ip directly - And also the pod can connect to the client directly. The problem is that: - any pod on the k8s-node2 can not connet to other pod or service with service name or domain name but can still connect to other service or pod with ip address - can not schedule any new pod to the k8s-node2 - and also the daemon set calico-node on the k8s-node2 in the kube-system namespace can not work any more when be killed. As a result the client could not connect to the pod any more. ![image](https://github.com/netbirdio/netbird/assets/6927042/0becc46c-43bf-430b-a74f-1da0e1865f4e) But when remove the Routes and restart the machine of k8s-node2 all will go right.
saavagebueno commented 2025-11-20 05:09:00 -05:00
Author
Owner
Copy Link

@mlsmaycon commented on GitHub (Nov 24, 2023):

@damoasis to make it work you removed the pod network 10.233.0.0/16 or the 100.X.X.X/16?

@mlsmaycon commented on GitHub (Nov 24, 2023): @damoasis to make it work you removed the pod network 10.233.0.0/16 or the 100.X.X.X/16?
saavagebueno commented 2025-11-20 05:09:00 -05:00
Author
Owner
Copy Link

@damoasis commented on GitHub (Nov 28, 2023):

@mlsmaycon

@damoasis to make it work you removed the pod network 10.233.0.0/16 or the 100.X.X.X/16?

10.233.0.0/16

@damoasis commented on GitHub (Nov 28, 2023): @mlsmaycon > @damoasis to make it work you removed the pod network 10.233.0.0/16 or the 100.X.X.X/16? 10.233.0.0/16
saavagebueno commented 2025-11-20 05:09:00 -05:00
Author
Owner
Copy Link

@mlsmaycon commented on GitHub (Nov 28, 2023):

Thanks for the update.

If the Kubernetes clients are configured as routers, they shouldn't be adding these routes. As you mentioned, the network route is distributing the routes to the client group. Can you confirm that the kubernetes nodes aren't part of the client group?

If possible, share the network route configuration in detail and group membership for your nodes.

@mlsmaycon commented on GitHub (Nov 28, 2023): Thanks for the update. If the Kubernetes clients are configured as routers, they shouldn't be adding these routes. As you mentioned, the network route is distributing the routes to the `client` group. Can you confirm that the kubernetes nodes aren't part of the `client` group? If possible, share the network route configuration in detail and group membership for your nodes.
saavagebueno commented 2025-11-20 05:09:00 -05:00
Author
Owner
Copy Link

@damoasis commented on GitHub (Nov 28, 2023):

Thanks for the update.

If the Kubernetes clients are configured as routers, they shouldn't be adding these routes. As you mentioned, the network route is distributing the routes to the client group. Can you confirm that the kubernetes nodes aren't part of the client group?

If possible, share the network route configuration in detail and group membership for your nodes.

@mlsmaycon The kubernetes nodes aren't part of the client group, the client group onley contains the win 10 pc.
image
image
netbird

My requirement is to allow the win10 computer to directly access the IP of the internal pod in k8s through netbird.

@damoasis commented on GitHub (Nov 28, 2023): > Thanks for the update. > > If the Kubernetes clients are configured as routers, they shouldn't be adding these routes. As you mentioned, the network route is distributing the routes to the `client` group. Can you confirm that the kubernetes nodes aren't part of the `client` group? > > If possible, share the network route configuration in detail and group membership for your nodes. @mlsmaycon The kubernetes nodes aren't part of the client group, the client group onley contains the win 10 pc. ![image](https://github.com/netbirdio/netbird/assets/6927042/af755896-9878-467a-9e39-94f263c334be) ![image](https://github.com/netbirdio/netbird/assets/6927042/1efb8afc-d88e-495e-a8cc-0d0f9471042c) ![netbird](https://github.com/netbirdio/netbird/assets/6927042/b774e6ce-1db7-44b0-95fe-84125c1ef001) My requirement is to allow the win10 computer to directly access the IP of the internal pod in k8s through netbird.
saavagebueno commented 2025-11-20 05:09:00 -05:00
Author
Owner
Copy Link

@echowings commented on GitHub (May 5, 2024):

I want this feature too! Is there a plan to implement it ?

@echowings commented on GitHub (May 5, 2024): I want this feature too! Is there a plan to implement it ?
saavagebueno commented 2025-11-20 05:09:00 -05:00
Author
Owner
Copy Link

@nazarewk commented on GitHub (Apr 23, 2025):

My requirement is to allow the win10 computer to directly access the IP of the internal pod in k8s through netbird.

I believe this is already handled by Networks and (older) Network Routes

Were you guys able to figure out your Kubernetes setup? Did it maybe start working with more recent NetBird versions?

@nazarewk commented on GitHub (Apr 23, 2025): > My requirement is to allow the win10 computer to directly access the IP of the internal pod in k8s through netbird. I believe this is already handled by Networks and (older) Network Routes ---- Were you guys able to figure out your Kubernetes setup? Did it maybe start working with more recent NetBird versions?
saavagebueno commented 2025-11-20 05:09:00 -05:00
Author
Owner
Copy Link

@MichalisDBA commented on GitHub (Jun 5, 2025):

We install Netbird in a Rancher Kubernetes VM and we have problem with calico. Although Netbird is connected, clients can not access the VM because calico hijacks the iptables and add chained rules at the top. Any way to mitigate this?

@MichalisDBA commented on GitHub (Jun 5, 2025): We install Netbird in a Rancher Kubernetes VM and we have problem with calico. Although Netbird is connected, clients can not access the VM because calico hijacks the iptables and add chained rules at the top. Any way to mitigate this?
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
2021 Q4
2022 Q1
2022 Q1
accessibility
acl
agent
agent
Android
Android
api
authentik
automation
azure
battery-usage
bug
cache
client
client-ui
cloud
cloud-only
cloudflare
community
compatibility
config-idp
config-issue
connection
contribution
coturn
cross-vpn
dashboard
data-usage
distribution
dns
docker
documentation
duplicate
enhancement
enhancement
event-stream
feature-request
freebsd
getting-started
go
good first issue
gui
help wanted
home-assistant
idp
inconsistency
integration
integrations
ios
ipv6
jwt
k8s
keycloak
linux
login
macos
management-service
missing-docs
mobile
moved-internal
needs-review
netbird-ui
networking
new-platform
nginx
notification
okta
openwrt
packaging
peer-management
peer-management
peer-management
performance
postgres
posture-checks
psk
pull-request
Mirrored from GitHub Pull Request
 question
refactor
relay
release
rfc
routes
security
security-related
self-hosting
server
signal
sleep-issue
ssh
ssl
status
store
synology
system-compatibility-issue
test-suite
third-party-integration
triage
triage-needed
troubleshooting
UX
waiting-feedback
windows
wontfix
zitadel
No Label feature-request waiting-feedback
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
saavagebueno
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: SVI/netbird#275
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?