No IPv6 forwarding rule created on exit node

[K900]

Before posting

• I searched existing discussions and issues, including closed ones, and checked the relevant docs.
• I believe this is a product bug rather than a configuration or setup question.
• I can reproduce this issue, or for intermittent issues I've included trigger, frequency, and timing details below.
• I removed or anonymized sensitive data from logs, screenshots, and configuration.

Affected area

Routes / Exit nodes

Deployment type

Self-hosted - advanced/custom deployment

Operating system or environment

Linux

NetBird version and upgrade status

0.71.1 / dashboard 2.38.0

Did this work before?

No, this never worked

Regression details

IPv6 support added in 0.71.0, doesn't seem to have worked ever

Summary

When using a Linux machine with nftables as an exit node, the IPv4 ruleset has

chain netbird-rt-fwd {
  ct state established,related counter accept
  counter accept
}

Whereas the IPv6 ruleset has

chain netbird-rt-fwd {
  ct state established,related counter accept
}

Which means no IPv6 traffic is actually allowed to be forwarded.

Current behavior

IPv6 traffic isn't forwarded by the exit node

Expected behavior

IPv6 traffic is forwarded by the exit node

Steps to reproduce

1. Set up an exit node
2. Try connecting to an IPv6 host through it
3. Observe no traffic
4. nft add rule ip6 netbird netbird-rt-fwd counter accept
5. Observe traffic

Environment and topology

N/A

Self-hosted details, if available

• Deployment method: NixOS
• Management version: 0.71.1
• Dashboard version: 2.38.0

Logs, status output, or debug evidence

N/A

Related issues or discussions

No response

Impact

No response

Additional context

No response

[migueldamota]

I also did some digging here: The network map coming from management does not contain an entry for ::0/0 in routesFirewallRules which is used to create rules in nftables.

{
  // ...
  "routesFirewallRules": [
    {
      "sourceRanges": [
        "0.0.0.0/0"
      ],
      "destination": "0.0.0.0/0",
      "protocol": 1,
      "portInfo": {
        "PortSelection": null
      },
      "RouteID": "..."
    }
  ],
  // ...
}

And I also noticed in the dashboard code that the default network range set for Exit Nodes is only 0.0.0.0/0

Just wanted to share this 😄 and maybe it helps resolving it faster.

PS: I only have one network route set

[K900]

Oh, that explains a few things actually.

[migueldamota]

If you want to have IPv6 support for now, you can add it with this command on the exit node:
nft add rule ip6 netbird netbird-rt-fwd counter accept

[joachimtingvold]

Thanks for this, was wondering why it wasn't working.

[joachimtingvold]

Any good ideas on how to make this persistent through reboots? (since the NetBird client controls the rulesets normally).

[joachimtingvold]

The following seems to do the trick for now (comment added to the rule to avoid adding duplicates):

root@ninja:~# crontab -l | grep nft
* * * * * /usr/sbin/nft list chain ip6 netbird netbird-rt-fwd 2>/dev/null | /bin/grep -Fq 'added-by-cron' || /usr/sbin/nft add rule ip6 netbird netbird-rt-fwd counter accept comment "added-by-cron"

[lixmal]

Fixed with #6368. Try adding an access control group in the meantime

[joachimtingvold]

Excellent, thanks!

FYI, I have "clients <-> exit-nodes - ALL / ALL" policy (even before I wrote my comments above). I still had to do add the nft-entry manually to get it to work.

[lixmal]

You need specifically an access control group like described here https://docs.netbird.io/manage/network-routes/access-control

[joachimtingvold]

Uhm, this seems to still be an issue... I upgraded my exit-nodes (they are running 0.72.3 now), and I still have this issue. Adding the nft rule manually resolves it:

nft add rule ip6 netbird netbird-rt-fwd counter accept