User space wireguard not working? #2799
Comments
Silex
changed the title
|
We currently haven't implemented any forwarding from the netstack NIC to elsewhere (host or routes), so unfortunately, this access won't work in netstack mode. |
|
Thanks for the answer. Can you maybe clarify what netstack mode is for? I think it basically means "create a socks server that allows other applications to reach other peers through it", but that's "outgoing" only correct? |
|
The intended use is in serverless environments: https://docs.netbird.io/how-to/netbird-on-faas
correct |
|
Thanks. Is it planned to allow for some I asked AXIS about what I can do with this limited user, we'll see what they say. Maybe I could create the wg interface as root and then netbird could work under the ACAP user. |
|
@lixmal I'm a developer. How easy would it be to provide It's a shame because I find netbird much better than tailscale in pretty much every aspects, except I need a way to access remote cameras 😢 |
We currently don't have any plans for that, there's been no request so far.
It's not trivial. You'd have to implement a forwarder for tcp and udp (and possibly others like icmp, sctp, ...) packets that arrive on the wireguard netstack interface and decide where to forward them (= dial the destination address and copy over the payload). Starting point would be somewhere here That's when we get ahold of the netstack interface. |
|
Thanks! I noticed the AXIS camera It looks like the Management Service connects just fine, but then the tun interface creation fails. I forwarded this to AXIS in the hope they can losen up restrictions using some ACAP flags. |
|
@lixmal just found out that tailscale works because it uses https://github.com/WireGuard/wireguard-go How feasible would it be for netbird to fallback to wireguard-go as a backup strategy? I assume it'd be a lot of dev. |
Already uses |
|
Then I'm confused about why tailscale works and netbird does not (without NB_USE_NETSTACK_MODE of course). Will investigate more and report. |
|
Ok, so the crux is not wireguard-go, tailscale uses a Userspace Network Stack which allows it to bypass the need of CAP_NET_ADMIN. Implementing the same in netbird is likely to be a lot of work. |
|
Oh my it is christmas! 🥳 I'll continue the discussion there then |
|
Let's keep the discussion here please. The PR is for review comments.
You can grab binaries here on the bottom https://github.com/netbirdio/netbird/actions/runs/12590171435 |
|
Will test & report 👍 |
|
Ok, initial tests show same behavior (it logs but it's not online). That said I have some problems with my installation, will continue testing monday. |
|
You can grab a more recent binary here with some changes https://github.com/netbirdio/netbird/actions/runs/12603370959 |
|
It wooooooooooooooooooooooooooooooooooooooooooorks 🥳 🚀 😄
The other day it was just that I forgot to use |
|
Here are some logs in case they're helpful (redacted management url, logs might be a bit out of order because of a bug on these cameras with how things are logged): |
|
Glad it works for you. There are a few of errors in the log, but these are expected and don't interfere with operations. We'll eventually silence them |
|
Nice. I'll confirm it also work on arm64, if you need anything from me please do tell. Out of curiosity, when do you expect this to reach standard releases? |
|
does this mean we can potentially run netbird in a kubernetes pod unprivileged as a subnet router to internal k8s pod subnets? eg without needing: |
Nothing so far, thanks! If you pull a newer version, you'll have to set
Next release probably,
Yes, indeed. Although don't expect the same performance as with capabilities. There's also a Dockerfile & tag for that mode: netbird/client/Dockerfile-rootless Lines 1 to 16 in 3e836db |
|
Nice, performance vs security/compliance is sometimes an acceptable compromise, main usecases I have in mind is just as remote access to private clusters rather than service to service Thanks for the efforts |
|
I see the PR got merged, congratulations! 🚀 🎉 Should I close this? |
First of all, thanks a lot for this awesome software! We are in the process of migrating everything to netbird and so far the experience is great.
I already succeed in running netbird on Teltonika routers, and now I'm trying to run netbird 0.28.4 on AXIS cameras. The goal is to be able to connect to the cameras (HTTP/RTSP) from other peers.
The problem is that the user running the application (ACAP) is very limited, but someone managed to run tailscale on them (https://github.com/Mo3he/Axis_Cam_Tailscale), so I'm pretty sure it'd be feasible to run netbird too.
Apparently they do it with
--tun=userspace-networkingwhen using tailscale (https://github.com/Mo3he/Axis_Cam_Tailscale/blob/main/aarch64/app/Tailscale_VPN).So, I made a script like this:
This script runs fine as root (I can access my cameras), but when I run it as the application user (which will is the non-negociable default in latest firmares) then it outputs this:
And while the peer shows up in the netbird ui, of course I cannot connect to it. So next if I uncomment the line with
NB_USE_NETSTACK_MODE, then it connects fine and I can even ping the camera, but I cannot remotely access it.With
NB_USE_NETSTACK_MODEhere is what it status prints:Here's what the client.log show:
Can you clarify:
NB_USE_NETSTACK_MODEis actually a dead end and won't help me connect from outside to my camera.The text was updated successfully, but these errors were encountered: