netbirdio / netbird

Connect your devices into a secure WireGuard®-based overlay network with SSO, MFA and granular access controls.
https://netbird.io
BSD 3-Clause "New" or "Revised" License
10.78k stars 487 forks source link

New network route logic has lower priority in route table #2001

Open Thunderbottom opened 4 months ago

Thunderbottom commented 4 months ago

Describe the problem

Recently, on upgrading to the latest netbird versions (> 0.27.0), new networking route logic is being used, which creates a separate route table for netbird with a priority number higher than the main route table (lower priority overall). This causes netbird to fail to route to subnet network routes that collide with the user's local subnet. On connecting to netbird, the netbird routes should have a higher priority than the main table routes (lower priority number).

For example, on connecting to tailscale, the tailscale route network creates a routing table with priority 50, and the main table has a priority of 100. In case of netbird, it creates a route table with priority 110 and sets the main table's priority to 100. See the code here:

https://github.com/netbirdio/netbird/blob/a5811a2d7dfd33eee331bf204201f081bbb411c9/client/internal/routemanager/systemops_linux.go#L76-L83

Currently to fix this, we need to revert to the old routing logic:

$ sudo mkdir -p /etc/sysconfig
$ echo 'NB_USE_LEGACY_ROUTING=true'  | sudo tee -a /etc/sysconfig/netbird
$ sudo systemctl restart netbird

To Reproduce

Steps to reproduce the behavior:

  1. Upgrade to a newer version of Netbird.
  2. Check ip route show. It won't show the Netbird routes in the main table.
  3. Check ip route show table all. See Netbird table with ID 7120.
  4. Check ip rule show. See that the main table has a higher lookup priority than the Netbird table.
  5. Netbird network route fails in case the network route's subnet (eg. 192.168.0.0/16), overlaps with the local network subnet (eg. 192.168.0.0/24).

Expected behavior

On connecting to Netbird, the Netbird routes should have a higher lookup priority than the local subnet.

Are you using NetBird Cloud?

Self-hosted NetBird's control plane.

NetBird version

netbird version: 0.27.7

mlsmaycon commented 4 months ago

Thanks for opening this bug report. We will look into the best solution for this case and fix in the next releases.