SVI/netbird
1
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-05-28 11:02:11 -04:00
Code Issues 3.0k Packages Projects Releases 10 Wiki Activity

Docker Client fails to create iptables Forward rules and DNS probing on Synology. #844

New Issue
Closed
opened 2025-11-20 05:18:28 -05:00 by saavagebueno · 3 comments
saavagebueno commented 2025-11-20 05:18:28 -05:00
Owner
Copy Link

Originally created by @zzecool on GitHub (May 4, 2024).

Describe the problem
Running Docker Client version 0.27.4 and getting the following errors :

024-05-04T15:43:42.465646724Z 2024-05-04T15:43:42Z ERRO client/internal/routemanager/server_nonandroid.go:66: Unable to add route copsvubnabic73cqrb2g from server, got: insert routing rules: error while adding new forwarding rule for 10.0.0.0/24: running [/sbin/iptables -t filter -I NETBIRD-RT-FWD 1 -s 100.110.0.0/16 -d 10.0.0.0/24 -j ACCEPT -m comment --comment netbird-fwd-copsvubnabic73cqrb2g --wait]: exit status 1: Warning: Extension comment revision 0 not supported, missing kernel module?
2024-05-04T15:43:42.466373439Z iptables: No chain/target/match by that name.
2024-05-04T15:43:42.466462423Z 
2024-05-04T15:43:42.466507482Z 2024-05-04T15:43:42Z INFO client/internal/acl/manager.go:52: ACL rules processed in: 34.549µs, total rules count: 2
2024-05-04T15:43:44.466974354Z 2024-05-04T15:43:44Z WARN client/internal/dns/upstream.go:185: probing upstream nameserver 1.1.1.1:53: read udp 172.23.0.2:43795->1.1.1.1:53: i/o timeout
2024-05-04T15:43:44.467586003Z 2024-05-04T15:43:44Z WARN client/internal/dns/upstream.go:185: probing upstream nameserver 1.0.0.1:53: read udp 172.23.0.2:48481->1.0.0.1:53: i/o timeout
2024-05-04T18:36:33.561437284Z 2024-05-04T18:36:33Z WARN client/internal/engine.go:512: running SSH server is not permitted
2024-05-04T18:36:33.566448223Z 2024-05-04T18:36:33Z ERRO client/internal/routemanager/server_nonandroid.go:66: Unable to add route copsvubnabic73cqrb2g from server, got: insert routing rules: error while adding new forwarding rule for 10.0.0.0/24: running [/sbin/iptables -t filter -I NETBIRD-RT-FWD 1 -s 100.110.0.0/16 -d 10.0.0.0/24 -j ACCEPT -m comment --comment netbird-fwd-copsvubnabic73cqrb2g --wait]: exit status 1: Warning: Extension comment revision 0 not supported, missing kernel module?

As you can see server is telling this client that he is a routing peer for 10.0.0.0/24 but the client fails to apply the iptable rule to make the routing work.

The server where the Docker Client is running is a Synology one and the problem is the iptables version:

If i try the same rule directly on the Host :

iptables v1.8.3 (legacy): Couldn't load match comment':No such file or directory

To avoid this problem a simple solution would be to implement a "iptables --version" check ( clean )
Or to just retry without commenting ( dirty )

Even without the comment in this version of iptable you need to create the Chain before hand like this :

iptables

Another problem which i dont understand is this :

2024-05-04T15:43:44.466974354Z 2024-05-04T15:43:44Z WARN client/internal/dns/upstream.go:185: probing upstream nameserver 1.1.1.1:53: read udp 172.23.0.2:43795->1.1.1.1:53: i/o timeout
2024-05-04T15:43:44.467586003Z 2024-05-04T15:43:44Z WARN client/internal/dns/upstream.go:185: probing upstream nameserver 1.0.0.1:53: read udp 172.23.0.2:48481->1.0.0.1:53: i/o timeout

Cause if i connect in the container with a console i can resolve just fine

image

Same results for 1.0.0.1

Please help me fix this as your native linux app fails to install as well in Synology, but this is for another issue.

Thanks in advance.

Originally created by @zzecool on GitHub (May 4, 2024). **Describe the problem** Running Docker Client version 0.27.4 and getting the following errors : ``` 024-05-04T15:43:42.465646724Z 2024-05-04T15:43:42Z ERRO client/internal/routemanager/server_nonandroid.go:66: Unable to add route copsvubnabic73cqrb2g from server, got: insert routing rules: error while adding new forwarding rule for 10.0.0.0/24: running [/sbin/iptables -t filter -I NETBIRD-RT-FWD 1 -s 100.110.0.0/16 -d 10.0.0.0/24 -j ACCEPT -m comment --comment netbird-fwd-copsvubnabic73cqrb2g --wait]: exit status 1: Warning: Extension comment revision 0 not supported, missing kernel module? 2024-05-04T15:43:42.466373439Z iptables: No chain/target/match by that name. 2024-05-04T15:43:42.466462423Z 2024-05-04T15:43:42.466507482Z 2024-05-04T15:43:42Z INFO client/internal/acl/manager.go:52: ACL rules processed in: 34.549µs, total rules count: 2 2024-05-04T15:43:44.466974354Z 2024-05-04T15:43:44Z WARN client/internal/dns/upstream.go:185: probing upstream nameserver 1.1.1.1:53: read udp 172.23.0.2:43795->1.1.1.1:53: i/o timeout 2024-05-04T15:43:44.467586003Z 2024-05-04T15:43:44Z WARN client/internal/dns/upstream.go:185: probing upstream nameserver 1.0.0.1:53: read udp 172.23.0.2:48481->1.0.0.1:53: i/o timeout 2024-05-04T18:36:33.561437284Z 2024-05-04T18:36:33Z WARN client/internal/engine.go:512: running SSH server is not permitted 2024-05-04T18:36:33.566448223Z 2024-05-04T18:36:33Z ERRO client/internal/routemanager/server_nonandroid.go:66: Unable to add route copsvubnabic73cqrb2g from server, got: insert routing rules: error while adding new forwarding rule for 10.0.0.0/24: running [/sbin/iptables -t filter -I NETBIRD-RT-FWD 1 -s 100.110.0.0/16 -d 10.0.0.0/24 -j ACCEPT -m comment --comment netbird-fwd-copsvubnabic73cqrb2g --wait]: exit status 1: Warning: Extension comment revision 0 not supported, missing kernel module? ``` As you can see server is telling this client that he is a routing peer for 10.0.0.0/24 but the client fails to apply the iptable rule to make the routing work. The server where the Docker Client is running is a Synology one and the problem is the iptables version: If i try the same rule directly on the Host : `iptables v1.8.3 (legacy): Couldn't load match comment':No such file or directory` To avoid this problem a simple solution would be to implement a "iptables --version" check ( clean ) Or to just retry without commenting ( dirty ) Even without the comment in this version of iptable you need to create the Chain before hand like this : ![iptables](https://github.com/netbirdio/netbird/assets/2816897/98423b16-8911-42df-8991-f99e40312a07) -------------------------------------------------------------------------------------------------------------------------------------------- Another problem which i dont understand is this : ``` 2024-05-04T15:43:44.466974354Z 2024-05-04T15:43:44Z WARN client/internal/dns/upstream.go:185: probing upstream nameserver 1.1.1.1:53: read udp 172.23.0.2:43795->1.1.1.1:53: i/o timeout 2024-05-04T15:43:44.467586003Z 2024-05-04T15:43:44Z WARN client/internal/dns/upstream.go:185: probing upstream nameserver 1.0.0.1:53: read udp 172.23.0.2:48481->1.0.0.1:53: i/o timeout ``` Cause if i connect in the container with a console i can resolve just fine ![image](https://github.com/netbirdio/netbird/assets/2816897/1353b788-91ca-44cb-bd21-9f297a34d463) Same results for 1.0.0.1 Please help me fix this as your native linux app fails to install as well in Synology, but this is for another issue. Thanks in advance.
saavagebueno added the triage-needed label 2025-11-20 05:18:28 -05:00
saavagebueno commented 2025-11-20 05:18:29 -05:00
Author
Owner
Copy Link

@zzecool commented on GitHub (May 6, 2024):

@pappz This isnt closed as removing comments in iptable will only partially fix this problem.

In iptables v1.8.3 (legacy) [ We cant update this in Synology ]

Even without the comment in this version of iptable you need to create the Chain before hand like this :

image

@zzecool commented on GitHub (May 6, 2024): @pappz This isnt closed as removing comments in iptable will only partially fix this problem. In iptables v1.8.3 (legacy) [ We cant update this in Synology ] **Even without the comment in this version of iptable you need to create the Chain before hand like this :** ![image](https://github.com/netbirdio/netbird/assets/2816897/1deb237c-a6a0-41c4-9a6d-37878ef70d4c)
saavagebueno commented 2025-11-20 05:18:29 -05:00
Author
Owner
Copy Link

@pappz commented on GitHub (May 6, 2024):

Hello @zzecool!
I think we create it in this line.

@pappz commented on GitHub (May 6, 2024): Hello @zzecool! I think we create it in [this](https://github.com/netbirdio/netbird/blob/7357a9954c8ff394329099911c11ce093dece21a/client/firewall/iptables/router_linux.go#L211) line.
saavagebueno commented 2025-11-20 05:18:29 -05:00
Author
Owner
Copy Link

@zzecool commented on GitHub (May 6, 2024):

Hello @zzecool!
I think we create it in this line.

I'm anticipating the next docker image and I will let you know.

Thank you.

@zzecool commented on GitHub (May 6, 2024): > Hello @zzecool! > I think we create it in [this](https://github.com/netbirdio/netbird/blob/7357a9954c8ff394329099911c11ce093dece21a/client/firewall/iptables/router_linux.go#L211) line. I'm anticipating the next docker image and I will let you know. Thank you.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
2021 Q4
2022 Q1
2022 Q1
accessibility
acl
agent
agent
Android
Android
api
authentik
automation
azure
battery-usage
bug
cache
client
client-ui
cloud
cloud-only
cloudflare
community
compatibility
config-idp
config-issue
connection
contribution
coturn
cross-vpn
dashboard
data-usage
distribution
dns
docker
documentation
duplicate
enhancement
enhancement
event-stream
feature-request
freebsd
getting-started
go
good first issue
gui
help wanted
home-assistant
idp
inconsistency
integration
integrations
ios
ipv6
jwt
k8s
keycloak
linux
login
macos
management-service
missing-docs
mobile
moved-internal
needs-review
netbird-ui
networking
new-platform
nginx
notification
okta
openwrt
packaging
peer-management
peer-management
peer-management
performance
postgres
posture-checks
psk
pull-request
Mirrored from GitHub Pull Request
 question
refactor
relay
release
rfc
routes
security
security-related
self-hosting
server
signal
sleep-issue
ssh
ssl
status
store
synology
system-compatibility-issue
test-suite
third-party-integration
triage
triage-needed
troubleshooting
UX
waiting-feedback
windows
wontfix
zitadel
No Label triage-needed
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
saavagebueno
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: SVI/netbird#844
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?