sendnrw/netbird
2
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-05-02 23:26:41 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix legacy dynamic route NAT missing v6 duplicate

Browse Source 
The v6 NAT duplication only triggered for DomainSet destinations
(modern DNS path). Legacy dynamic routes use a 0.0.0.0/0 prefix
destination, so the v6 NAT rule was never created.

Add a Dynamic field to RouterPair so the firewall manager can
distinguish dynamic routes from exit nodes (both use /0 prefixes).
Set it from route.IsDynamic() in routeToRouterPair and propagate
through GetInversePair. Both nftables and iptables managers check
pair.Dynamic instead of destination shape.

Also accumulate errors in RemoveNatRule so v6 cleanup is attempted
even if v4 removal fails.
This commit is contained in:
Viktor Liu
2026-04-10 13:06:14 +02:00
parent 567f36b07e
commit 4b298fb53c
4 changed files with 20 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
client/firewall/manager/routerpair.go
View File

@@ -12,6 +12,10 @@ type RouterPair struct {
Destination Network
Masquerade bool
Inverse bool
// Dynamic indicates the route is domain-based. NAT rules for dynamic
// routes are duplicated to the v6 table so that resolved AAAA records
// are masqueraded correctly.
Dynamic bool
}
func GetInversePair(pair RouterPair) RouterPair {
@@ -22,22 +26,10 @@ func GetInversePair(pair RouterPair) RouterPair {
Destination: pair.Source,
Masquerade: pair.Masquerade,
Inverse: true,
Dynamic: pair.Dynamic,
}
}
// NeedsV6NATDuplicate reports whether a v4 NAT pair should be duplicated to
// the v6 table. This is true for DomainSets (resolved IPs can be either
// family) and for the v4 default wildcard 0.0.0.0/0 used by the legacy DNS
// resolver path for dynamic routes.
func NeedsV6NATDuplicate(pair RouterPair) bool {
if pair.Destination.IsSet() {
return true
}
return pair.Destination.IsPrefix() &&
pair.Destination.Prefix.Bits() == 0 &&
pair.Destination.Prefix.Addr().Is4()
}
// ToV6NatPair creates a v6 counterpart of a v4 NAT pair with `::/0` source
// and, for prefix destinations, `::/0` destination.
func ToV6NatPair(pair RouterPair) RouterPair {