sendnrw/netbird-docs
2
0
Fork 0
mirror of https://github.com/netbirdio/docs.git synced 2026-09-26 16:59:04 +02:00
Code Issues Packages Projects Releases Wiki Activity

docs: document the fallback when the client cannot manage firewall rules (#964)

Browse Source 
* docs: document the fallback when the client cannot manage firewall rules

Add a troubleshooting section for hosts that are missing the netfilter
modules the client's firewall rules depend on, such as the mark match used
for policy routing or ipset. Include the client log excerpt so the error is
findable by search, with timestamps, hostname and peer identifiers removed.

Document what actually happens. The client logs the failure and proceeds
with the userspace packet filter, so NetBird keeps working and keeps
filtering, and on a routing peer the forwarding path moves to userspace as
well. Remedies are ordered from narrowest to broadest, starting with
loading the missing module and the related environment variables before
reaching for --disable-firewall.

Warn that --disable-firewall is not the same as that automatic fallback.
The userspace filter does not take over, so NetBird enforces no access
control on the peer, and the operator has to recreate the restrictions with
the host's own firewall.

Reference the new section from the Synology install page, where these
netfilter match modules can be missing alongside the tun module already
covered there.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* docs: reword the NB_USE_LEGACY_ROUTING line

Address CodeRabbit review: 'ip-rule based routing' was an incorrectly
hyphenated compound modifier. Reword so the sentence describes the fallback
directly and drops the compound modifier.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Bruno Mercier Costa
2026-09-04 12:23:31 +02:00
committed by GitHub
co-authored by Claude Opus 4.8
parent cb5813d1df
commit 7c6b66ccf3
2 changed files with 68 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/pages/get-started/install/synology.mdx
+7
View File
@@ -51,6 +51,13 @@ fi
```
4. If you’d like to see the logs for this task, select the task you create and click on Settings. Check the box that says Save output results, select a save location, and click OK. Now, if you select the task and **Action > View Result**, you’ll see any error logs and status.
<Note>
Synology devices do not always expose every kernel module NetBird uses. Alongside the `tun` module above, the
netfilter match modules behind the client's firewall rules can be missing, `mark` and `ipset` in particular. The
client then logs a `failed to create native firewall` warning and falls back to userspace filtering. See
[When the client cannot manage firewall rules](/help/troubleshooting-client#when-the-client-cannot-manage-firewall-rules).
</Note>
## Running with a Setup Key
In case you are activating a server peer, you can use a [setup key](/manage/peers/register-machines-using-setup-keys) as described in the steps below.
> This is especially helpful when you are running multiple server instances with infrastructure-as-code tools like ansible and terraform.