User space wireguard not working? #2799
Comments
Silex
changed the title
|
We currently haven't implemented any forwarding from the netstack NIC to elsewhere (host or routes), so unfortunately, this access won't work in netstack mode. |
|
Thanks for the answer. Can you maybe clarify what netstack mode is for? I think it basically means "create a socks server that allows other applications to reach other peers through it", but that's "outgoing" only correct? |
|
The intended use is in serverless environments: https://docs.netbird.io/how-to/netbird-on-faas
correct |
|
Thanks. Is it planned to allow for some I asked AXIS about what I can do with this limited user, we'll see what they say. Maybe I could create the wg interface as root and then netbird could work under the ACAP user. |
|
@lixmal I'm a developer. How easy would it be to provide It's a shame because I find netbird much better than tailscale in pretty much every aspects, except I need a way to access remote cameras 😢 |
We currently don't have any plans for that, there's been no request so far.
It's not trivial. You'd have to implement a forwarder for tcp and udp (and possibly others like icmp, sctp, ...) packets that arrive on the wireguard netstack interface and decide where to forward them (= dial the destination address and copy over the payload). Starting point would be somewhere here That's when we get ahold of the netstack interface. |
|
Thanks! I noticed the AXIS camera It looks like the Management Service connects just fine, but then the tun interface creation fails. I forwarded this to AXIS in the hope they can losen up restrictions using some ACAP flags. |
|
@lixmal just found out that tailscale works because it uses https://github.com/WireGuard/wireguard-go How feasible would it be for netbird to fallback to wireguard-go as a backup strategy? I assume it'd be a lot of dev. |
Already uses |
|
Then I'm confused about why tailscale works and netbird does not (without NB_USE_NETSTACK_MODE of course). Will investigate more and report. |
|
Ok, so the crux is not wireguard-go, tailscale uses a Userspace Network Stack which allows it to bypass the need of CAP_NET_ADMIN. Implementing the same in netbird is likely to be a lot of work. |
First of all, thanks a lot for this awesome software! We are in the process of migrating everything to netbird and so far the experience is great.
I already succeed in running netbird on Teltonika routers, and now I'm trying to run netbird 0.28.4 on AXIS cameras. The goal is to be able to connect to the cameras (HTTP/RTSP) from other peers.
The problem is that the user running the application (ACAP) is very limited, but someone managed to run tailscale on them (https://github.com/Mo3he/Axis_Cam_Tailscale), so I'm pretty sure it'd be feasible to run netbird too.
Apparently they do it with
--tun=userspace-networkingwhen using tailscale (https://github.com/Mo3he/Axis_Cam_Tailscale/blob/main/aarch64/app/Tailscale_VPN).So, I made a script like this:
This script runs fine as root (I can access my cameras), but when I run it as the application user (which will is the non-negociable default in latest firmares) then it outputs this:
And while the peer shows up in the netbird ui, of course I cannot connect to it. So next if I uncomment the line with
NB_USE_NETSTACK_MODE, then it connects fine and I can even ping the camera, but I cannot remotely access it.With
NB_USE_NETSTACK_MODEhere is what it status prints:Here's what the client.log show:
Can you clarify:
NB_USE_NETSTACK_MODEis actually a dead end and won't help me connect from outside to my camera.The text was updated successfully, but these errors were encountered: