sendnrw/netbird-docs
2
0
Fork 0
mirror of https://github.com/netbirdio/docs.git synced 2026-10-11 08:09:03 +02:00
Code Issues Packages Projects Releases Wiki Activity

docs(site-to-vpn): drop sysctl ip_forward instruction on Linux

Browse Source 
NetBird handles IP forwarding itself on Linux; the manual sysctl was
unnecessary noise. Keep the host-firewall FORWARD-ACCEPT note since
UFW/firewalld setups still need it.
This commit is contained in:
Jack Carter
2026-05-13 12:43:25 +02:00
parent beb2e6e12f
commit 85266d83a9
1 changed files with 6 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/pages/manage/networks/use-cases/site-to-vpn.mdx
+6 -10
View File
@@ -87,17 +87,13 @@ The routing peer must SNAT site traffic onto its NetBird interface so the
overlay peer's access control sees a NetBird IP it recognises. See overlay peer's access control sees a NetBird IP it recognises. See
[Outbound SNAT requirement](#outbound-snat-requirement) for the reasoning. [Outbound SNAT requirement](#outbound-snat-requirement) for the reasoning.
**On Linux:** NetBird installs the SNAT automatically when masquerade is **On Linux:** no manual SNAT configuration is needed. NetBird enables IP
enabled on the routing peer (Step 4). Just enable IP forwarding: forwarding and installs the SNAT itself when masquerade is enabled on the
routing peer (Step 4).
```bash The only Linux-side caveat is if you run a host firewall (UFW, firewalld)
sudo sysctl -w net.ipv4.ip_forward=1 with the `FORWARD` chain default set to `DROP` — in that case, allow
echo 'net.ipv4.ip_forward=1' | sudo tee /etc/sysctl.d/99-netbird-routing.conf forwarding between the site-facing interface and `wt0`:
```
If you run a host firewall (UFW, firewalld) with the `FORWARD` chain default
set to `DROP`, also allow forwarding between the site-facing interface and
`wt0`:
```bash ```bash
sudo iptables -I FORWARD 1 -i <site-iface> -o wt0 -j ACCEPT sudo iptables -I FORWARD 1 -i <site-iface> -o wt0 -j ACCEPT