Document HA routing peer selection from v0.81.1 (#1043)

* Document HA routing peer selection from v0.81.1

Routing peer high availability changed in the client (netbirdio/netbird
#7689 and #8192): a relayed routing peer is held for a delay before an
equivalent direct one takes over, latency is sampled continuously and only
moves the route on a clear gain, and switches are logged with their reason.

Rewrite the High availability section of How Routing Peers Work for the
new behavior, document NB_HA_RELAYED_SWITCH_DELAY and its default, and
list the variable in the client environment variables reference.

* Correct the HA routing peer selection version to v0.81.1

* Spell out the latency noise margin and the exit node loss event

The latency switch margin is four times the combined measurement noise of
both paths, not the noise itself. A network with a default route records
the loss of its last routing peer as "Default route disconnected due to
peer unreachability", not as "No routing peer available".
This commit is contained in:
Riccardo Manfrin
2026-10-16 10:59:42 +02:00
committed by GitHub
parent 7a0e1e7b60
commit 1ab145bf2e
2 changed files with 58 additions and 14 deletions
@@ -35,6 +35,7 @@ To clear all saved service parameters (including env vars), run `sudo netbird se
| `NB_DISABLE_CUSTOM_ROUTING` | All | Revert to the routing behavior from before exit node support was added. No exclusion routes or fwmark-based socket routing will be used; all dialers and listeners fall back to plain `net.Dial`/`net.Listen`. Routes with a prefix of /7 or larger (e.g. default routes, 0.0.0.0/0) will be rejected. |
| `NB_ROUTE_PROTO_FLAG` | macOS, BSD | Set a custom route flag on routes the client adds to the routing table. Accepted values: `2` (RTF_PROTO2) or `3` (RTF_PROTO3); defaults to RTF_PROTO1. Not used on Linux (Linux uses netlink with its own protocol field). |
| `NB_DISABLE_ROUTE_CACHE` | Windows | Disable the 2-second cache on Windows routing table lookups. The client reads the OS routing table (via Win32 API) when adding or removing routes; without the cache, each operation triggers a fresh read. Only needed for debugging route conflicts. |
| `NB_HA_RELAYED_SWITCH_DELAY` | All | How long a relayed routing peer keeps a highly available network before the route moves to an equivalent routing peer with a direct connection. Takes a duration (default `30s`), `0` to switch at once, or `never` to keep a routing peer whose direct connection fell back to relayed for as long as it stays connected. Available from v0.81.1. See [Relayed switch delay](/manage/networks/how-routing-peers-work#relayed-switch-delay). |
| `NB_FWMARK_BASE` | Linux | Move the netfilter mark range the client uses (default base `0x1BD00`, covering `0x1BD00`-`0x1BD0FF`). Set this when other software on the host claims bits the NetBird marks use, so its rules act on NetBird traffic. The value is the base of the range, decimal or `0x`-prefixed, and the low byte identifies the individual mark, so it has to be left free: `NB_FWMARK_BASE=0x11000` puts the marks at `0x11000`-`0x110FF`. A value that is zero, larger than 32 bits, or has a bit set in its low byte is rejected with a warning in the log and the default range is used. |
Container network plugins, CNIs and other VPNs claim bits of the mark space for themselves. When one of them has a rule matching a bit that a NetBird mark also sets, that rule acts on NetBird traffic, which shows up as traffic being dropped, masqueraded, or routed elsewhere. `NB_FWMARK_BASE` moves the whole NetBird range out of the way.