SVI/netbird
1
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-05-15 20:51:57 -04:00
Code Issues 3.0k Packages Projects Releases 10 Wiki Activity

ACLs do not have any impact on Network Routes #471

New Issue
Closed
opened 2025-11-20 05:11:58 -05:00 by saavagebueno · 3 comments
saavagebueno commented 2025-11-20 05:11:58 -05:00
Owner
Copy Link

Originally created by @mkapra on GitHub (Oct 12, 2023).

Describe the problem
It is possible to reach private networks even if there is no ACL allowing it.

To Reproduce
Steps to reproduce the behavior:

  1. Register 2 peers
  2. Add a new Network Route and append it to one of the peers
  3. Disable default ACL that allows every traffic
  4. e.g. ping the internal network created in Network Routes

Expected behavior
The ping should not go through because there is no ACL for it. I would expect that I need to create an ACL that allows the traffic to either the peer that routes to this internal network or to the internal network itself.

Originally created by @mkapra on GitHub (Oct 12, 2023). **Describe the problem** It is possible to reach private networks even if there is no ACL allowing it. **To Reproduce** Steps to reproduce the behavior: 1. Register 2 peers 2. Add a new Network Route and append it to one of the peers 3. Disable default ACL that allows every traffic 4. e.g. ping the internal network created in Network Routes **Expected behavior** The ping should not go through because there is no ACL for it. I would expect that I need to create an ACL that allows the traffic to either the peer that routes to this internal network or to the internal network itself.
saavagebueno commented 2025-11-20 05:11:59 -05:00
Author
Owner
Copy Link

@braginini commented on GitHub (Oct 14, 2023):

hey @mkapra
If there is no connection between a peer and a routing peer, ping to the internal network shouldn't be possible.
The connection is created only if there is an ACL allowing the access.

Could you please double check if there is no other ACL allowing the connection between your pinging peer and the routing peer?
Is it possible that the network range that the routing peer routes overlaps with some local range of the pinging peer?

@braginini commented on GitHub (Oct 14, 2023): hey @mkapra If there is no connection between a peer and a routing peer, ping to the internal network shouldn't be possible. The connection is created only if there is an ACL allowing the access. Could you please double check if there is no other ACL allowing the connection between your pinging peer and the routing peer? Is it possible that the network range that the routing peer routes overlaps with some local range of the pinging peer?
saavagebueno commented 2025-11-20 05:11:59 -05:00
Author
Owner
Copy Link

@mkapra commented on GitHub (Oct 17, 2023):

Hi @braginini,

sorry for bothering you. It seems that there was a syncing issue for the ACL or something like that. The problem is gone now and netbird behaves like you explained.

@mkapra commented on GitHub (Oct 17, 2023): Hi @braginini, sorry for bothering you. It seems that there was a syncing issue for the ACL or something like that. The problem is gone now and netbird behaves like you explained.
saavagebueno commented 2025-11-20 05:11:59 -05:00
Author
Owner
Copy Link

@mlsmaycon commented on GitHub (Oct 17, 2023):

Not a bother, thanks for the feedback @mkapra

@mlsmaycon commented on GitHub (Oct 17, 2023): Not a bother, thanks for the feedback @mkapra
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
2021 Q4
2022 Q1
2022 Q1
accessibility
acl
agent
agent
Android
Android
api
authentik
automation
azure
battery-usage
bug
cache
client
client-ui
cloud
cloud-only
cloudflare
community
compatibility
config-idp
config-issue
connection
contribution
coturn
cross-vpn
dashboard
data-usage
distribution
dns
docker
documentation
duplicate
enhancement
enhancement
event-stream
feature-request
freebsd
getting-started
go
good first issue
gui
help wanted
home-assistant
idp
inconsistency
integration
integrations
ios
ipv6
jwt
k8s
keycloak
linux
login
macos
management-service
missing-docs
mobile
moved-internal
needs-review
netbird-ui
networking
new-platform
nginx
notification
okta
openwrt
packaging
peer-management
peer-management
peer-management
performance
postgres
posture-checks
psk
pull-request
Mirrored from GitHub Pull Request
 question
refactor
relay
release
rfc
routes
security
security-related
self-hosting
server
signal
sleep-issue
ssh
ssl
status
store
synology
system-compatibility-issue
test-suite
third-party-integration
triage
triage-needed
troubleshooting
UX
waiting-feedback
windows
wontfix
zitadel
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
saavagebueno
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: SVI/netbird#471
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?