sendnrw/netbird
2
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-09-14 02:39:06 +02:00
Code Issues Packages Projects Releases Wiki Activity

Keep the DNS interception hooks installed when the firewall is disabled

Browse Source
This commit is contained in:
Viktor Liu
2026-09-09 11:14:35 +02:00
parent d2e62e358a
commit 6c8e0764b8
5 changed files with 89 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
client/firewall/create_linux.go
+3 -3
View File
@@ -68,11 +68,11 @@ func NewFirewall(iface IFaceMapper, stateManager *statemanager.Manager, flowLogg
case err == nil && !iface.IsUserspaceBind():
// Nothing to do, fall through
case err == nil && iface.IsUserspaceBind():
// Native firewall handles packet filtering, but the userspace WireGuard bind
// Native firewall handles packet filtering, but the userspace bind
// needs a device filter for DNS interception hooks. Install a minimal
// hooks-only filter that passes all traffic through to the kernel firewall.
if err := iface.SetFilter(&uspfilter.HooksFilter{}); err != nil {
log.Warnf("failed to set hooks filter, DNS via memory hooks will not work: %v", err)
if err := InstallDNSHooksFilter(iface); err != nil {
log.Errorf("failed to set hooks filter, DNS via memory hooks will not work: %v", err)
}
case err != nil && !iface.IsUserspaceBind():
// Kernel cannot fall back to anything else, need to return error