sendnrw/netbird-docs
2
0
Fork 0
mirror of https://github.com/netbirdio/docs.git synced 2026-08-27 18:21:27 +02:00
Code Issues Packages Projects Releases Wiki Activity

docs(site-to-vpn): drop sysctl ip_forward instruction on Linux

Browse Source 
NetBird handles IP forwarding itself on Linux; the manual sysctl was
unnecessary noise. Keep the host-firewall FORWARD-ACCEPT note since
UFW/firewalld setups still need it.
This commit is contained in:
Jack Carter
2026-05-13 12:43:25 +02:00
parent beb2e6e12f
commit 85266d83a9
1 changed files with 6 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
src/pages/manage/networks/use-cases/site-to-vpn.mdx
View File

@@ -87,17 +87,13 @@ The routing peer must SNAT site traffic onto its NetBird interface so the
overlay peer's access control sees a NetBird IP it recognises. See
[Outbound SNAT requirement](#outbound-snat-requirement) for the reasoning.
**On Linux:** NetBird installs the SNAT automatically when masquerade is
enabled on the routing peer (Step 4). Just enable IP forwarding:
**On Linux:** no manual SNAT configuration is needed. NetBird enables IP
forwarding and installs the SNAT itself when masquerade is enabled on the
routing peer (Step 4).
```bash
sudo sysctl -w net.ipv4.ip_forward=1
echo 'net.ipv4.ip_forward=1' | sudo tee /etc/sysctl.d/99-netbird-routing.conf
```
If you run a host firewall (UFW, firewalld) with the `FORWARD` chain default
set to `DROP`, also allow forwarding between the site-facing interface and
`wt0`:
The only Linux-side caveat is if you run a host firewall (UFW, firewalld)
with the `FORWARD` chain default set to `DROP` — in that case, allow
forwarding between the site-facing interface and `wt0`:
```bash
sudo iptables -I FORWARD 1 -i <site-iface> -o wt0 -j ACCEPT