In the example config.yml it mentions defining subnets in a node's certificate - how is this done?

[bmullan]

I read a line in the example config.yml file that says:

# Unsafe routes allows you to route traffic over nebula to non-nebula nodes
# Unsafe routes should be avoided unless you have hosts/services that cannot run nebula
# NOTE: The nebula certificate of the "via" node MUST have the "route" defined as a subnet in its certificate
unsafe_routes:
#- route: 172.16.1.0/24
# via: 192.168.100.99
# mtu: 1300 #mtu will default to tun mtu if this option is not sepcified

How is this done?

[harpchad]

With nebula-cert when you create the cert for that node, i.e.:

nebula-cert sign -name mynode -ip 192.168.255.1/24 -out-crt ./mynode.crt -out-key ./mynode.key -subnets 192.168.254.0/24,192.168.255.0/24 -groups red,blue

[lightngn]

Comment,
Should your command read as follows in the subnet section? -subnets 192.168.254.0/24,192.168.255.0/24
Like this

nebula-cert sign -name mynode -ip 192.168.255.1/24 -out-crt ./mynode.crt -out-key ./mynode.key -subnets 192.168.254.0/24,192.168.255.0/24 -groups red,blue

[bmullan]

@harpchad
@lightngn asked if the command example you gave was correct or not? Can you look at his question and say which is correct?
Thanks

[lightngn]

What are your subnets that you are trying to add to unsafe_routes?

[bmullan]

yes I have the subnets added to unsafe_routes.

but his question was

Should your command read as follows in the subnet section? -subnets 192.168.254.0/24,192.168.255.0/24
Like this

nebula-cert sign -name mynode -ip 192.168.255.1/24 -out-crt ./mynode.crt -out-key ./mynode.key -subnets 192.168.254.0/24,192.168.255.0/24 -groups red,blue

which differs from your example by leaving the last octet "0" instead of "1"
also... is that 255 in the 3rd Octet correct?

[harpchad]

@lightngn
Yes, the subnets should be the network number .0, typed out an example too quickly, thanks for catching that.

[JonTheNiceGuy]

Follow-up question.

Given this nebula-cert command:

nebula-cert sign -name node_15 -ip 192.0.2.15/24 -subnets 203.0.113.0/24 -groups backup_hosts

Do the groups for the certificate on that node also get propogated to the protected subnet, e.g.:

firewall:
  inbound:
    - port: 22
      protocol: tcp
      groups: backup_hosts # Effective 192.0.2.15 + 203.0.113.0/24

OR do we need to specify it by IP, like this:

firewall:
  inbound:
    - port: 22
      protocol: tcp
      cidr: 203.0.113.0/24

[rawdigits]

The rules directly affect the 'unsafe_route' subnet(s) as well. Ie, if you allow port 22 inbound to 192.0.2.15, you are allowing port 22 to everything behind it at 203.0.113.0/24 as well.

Because we don't want to be in the business of running as a general purpose firewall, I'd recommend folks use iptables or similar if they want to further restrict things over unsafe_routes.

[JonTheNiceGuy]

Do we need to treat the nebula host as a router, and add static routes towards the Nebula IP pool, or does it hide-NAT behind the IP of the nebula host? Also, if we must route to the nebula pool, does this mean that the unsafe hosts can directly address the nebula node?

e.g.: Given a Nebula "Client" (192.0.2.10), a Nebula "Router" (192.0.2.15 / 198.51.100.15) and an Unsafe "Server" 203.0.113.10, does the Server see traffic from 192.0.2.10 or 198.51.100.15? Can the Server initiate traffic to the client?

I would assume it's likely to be the case that we'll have to route to the Nebula addresses (which is fine), but just wanted to check...

[rawdigits]

In the case of unsafe_routes, the server will see the traffic from its real origin, in this case 192.0.2.10. This also works in reverse as long as the unsafe_route configuration exists on all nodes participating.

I.e. if you have a cert on the nebula router "192.168.0.15" with the subnet defined, but you don't set an unsafe_route in 192.168.0.10's configuration, the routes won't be set up and the traffic will fail.

[bfvogel]

Two quick question as it is not quite clear from the example config.

Do unsafe routes only need to exist on the "via" nodes cert and the client nodes you want to consume the route?

Secondarily, should the route be injected into the client nodes routing table once the tunnel comes up?

IE: Client Node1
routes: unsafe_routes: - route: 192.168.116.0/24 via: 172.34.10.1 mtu: 1300 - route: 192.168.113.0/24 via: 172.34.10.4 mtu: 1300

"via" Node1 (172.34.10.1)
routes: unsafe_routes: - route: 192.168.113.0/24 via: 172.34.10.4 mtu: 1300

"via" Node2 (172.34.10.4)
routes: unsafe_routes: - route: 192.168.116.0/24 via: 172.34.10.1 mtu: 1300

I ask as with this config I see no modification to any routeing table and when adding route manually no route specific traffic passed.

[livid]

Do I need to do anything else on the "via" nebula node?

Now after added the subnet to its cert, I can ping its IP in that subnet but unable to reach other hosts in that subnet.

[johnmaguire]

Do unsafe routes only need to exist on the "via" nodes cert and the client nodes you want to consume the route?

They only need to exist on the "via" node's cert.

There is a guide on setting up unsafe_routes here: https://nebula.defined.net/docs/guides/unsafe_routes/#prerequisites

Please feel free to re-open / ping if you have further questions.