Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Feature/exit nodes - Linux support #1667

Merged
merged 45 commits into from
Mar 21, 2024
Merged

Feature/exit nodes - Linux support #1667

merged 45 commits into from
Mar 21, 2024

Conversation

lixmal
Copy link
Contributor

@lixmal lixmal commented Mar 5, 2024 •
edited
Loading

This PR adds client default route support for Linux clients:

  • Route Management: Establishes routes, including the default route, in a dedicated routing table, enabling VPN traffic to be correctly routed through the VPN tunnel while maintaining access to local and management networks.
  • Routing Rules: Implements several routing rules to ensure management traffic always uses the physical interface. It prioritizes existing local routes over VPN routes and directs all unmatched routes to the VPN routing table.
  • Custom fwmark applications: Applies a custom fwmark to all management network connections, including gRPC for signal and management servers, the eBPF proxy, ICE (STUN/TURN) connections, the shared socket, and the WireGuard interface. This marking system effectively excludes these connections from being routed through the VPN.
  • Enhanced Error Handling and Cleanup: Improves error reporting and handling. It also introduces a comprehensive cleanup routine to revert all changes made to the routing rules and the custom routing table, ensuring no residual configurations that might affect system networking.

The update also includes renaming and reorganizing packages for better clarity and maintenance.

Issue ticket number and link

Updates #289

Checklist

  • Is it a bug fix
  • Is a typo/documentation fix
  • Is a feature enhancement
  • It is a refactor
  • Created tests that fail without the change (if possible)
  • Extended the README / documentation, if necessary

@mlsmaycon mlsmaycon changed the title Feature/exit nodes Feature/exit nodes - Linux support Mar 5, 2024
lixmal added 17 commits March 5, 2024 11:51
@lixmal lixmal force-pushed the feature/exit-nodes branch from 3ea2665 to 9cc0b41 Compare March 13, 2024 14:53
@lixmal lixmal force-pushed the feature/exit-nodes branch 9 times, most recently from eceaf32 to 869c841 Compare March 14, 2024 10:19
@lixmal lixmal force-pushed the feature/exit-nodes branch from 869c841 to 04844e3 Compare March 14, 2024 10:32
@lixmal lixmal marked this pull request as ready for review March 16, 2024 23:37
pappz
pappz requested changes Mar 19, 2024
View reviewed changes
iface/wg_configurer.go Outdated Show resolved Hide resolved
iface/wg_configurer_kernel.go Show resolved Hide resolved
pappz
pappz requested changes Mar 19, 2024
View reviewed changes
iface/wg_configurer_usp.go Outdated Show resolved Hide resolved
lixmal added 3 commits March 19, 2024 19:17
@lixmal
Fix missing fwmark setting
397a184
@lixmal
Remove fwmark split on kernel configurer
0b8cf53
@lixmal
Use masked address for forwarding/nat rules
70fda9f 
Previously this was the wg interface's IP address + prefix length.
This stopped working with the new approach for some reason.
Using the nft tool this would be automatically fixed by the tool, but
using netfilter directly seems to leave it as is.
@lixmal lixmal merged commit 2475473 into main Mar 21, 2024
21 checks passed
@lixmal lixmal deleted the feature/exit-nodes branch March 21, 2024 15:49
@TheRedScreen64 TheRedScreen64 mentioned this pull request Mar 27, 2024
Closed
Foosec pushed a commit to Foosec/netbird that referenced this pull request May 8, 2024
@lixmal
Support client default routes for Linux (netbirdio#1667)
7dfc12e 
All routes are now installed in a custom netbird routing table.
Management and wireguard traffic is now marked with a custom fwmark.
When the mark is present the traffic is routed via the main routing table, bypassing the VPN.
When the mark is absent the traffic is routed via the netbird routing table, if:
- there's no match in the main routing table
- it would match the default route in the routing table

IPv6 traffic is blocked when a default route IPv4 route is configured to avoid leakage.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@pappz pappz pappz approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@lixmal @pappz @mlsmaycon