Skip to content

Commit c96042a

Browse files
committed
feat: add information on verifying system's routing rules
1 parent c304724 commit c96042a

File tree

1 file changed

+99
-0
lines changed

1 file changed

+99
-0
lines changed

src/pages/how-to/troubleshooting-client.mdx

Lines changed: 99 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -307,6 +307,7 @@ In short:
307307
2. Are Netbird's network routing resources configured?
308308
3. Do Netbird's Access Control rules allow access from `peer-a` to `peer-b`?
309309
4. Do Netbird's Access Control rules allow access from `peer-a` to the target's ACL Group?
310+
5. Is `peer-a`'s operating system configured to use the route?
310311
311312
#### Does `peer-b` have direct access to `srv-c`'s port `80`?
312313
@@ -412,6 +413,104 @@ Just like with the previous section you can loosen the above example by:
412413
- selecting a different destination group from the pool assigned to `peer-b`,
413414
- it could be built-in `All` group, but it is discouraged,
414415
416+
#### Is `peer-a`'s operating system configured to use the route?
417+
418+
After all resources are configured in the Netbird management you should check whether they are
419+
properly registered with your operating system.
420+
421+
You can start by checking Netbird client's configuration with `netbird status -d` command:
422+
423+
```shell
424+
% netbird status -d
425+
Peers detail:
426+
brys-vm-nbt-ubuntu-isolated-01.netbird.cloud:
427+
...
428+
Status: Connected
429+
-- detail --
430+
Connection type: P2P
431+
...
432+
Networks: 10.123.45.0/24
433+
...
434+
Peers count: 1/1 Connected
435+
```
436+
437+
You should be primarily looking for _Networks_ section under each _Peers detail_, but you can also check:
438+
439+
- _Peer_'s name,
440+
- _Peer_'s _Status_: it should be `Connected`,
441+
- _Peer_'s _Connection type_: it can be either `P2P` (direct) or `Relayed` (over the Internet),
442+
- _Peers count_ near the end of the output,
443+
444+
##### Verifying routing configuration on the Windows operating system
445+
446+
Below commands assume running a PowerShell prompt with administrator's privileges.
447+
448+
The easiest way is to read output of `Get-NetRoute` command:
449+
450+
```shell
451+
PS C:\Users\user> Get-NetRoute
452+
453+
ifIndex DestinationPrefix NextHop RouteMetric ifMetric PolicyStore
454+
------- ----------------- ------- ----------- -------- -----------
455+
...
456+
17 10.123.45.255/32 0.0.0.0 256 5 ActiveStore
457+
17 10.123.45.0/24 0.0.0.0 1 5 ActiveStore
458+
...
459+
17 100.83.255.255/32 0.0.0.0 256 5 ActiveStore
460+
17 100.83.183.133/32 0.0.0.0 256 5 ActiveStore
461+
17 100.83.0.0/16 0.0.0.0 256 5 ActiveStore
462+
...
463+
```
464+
465+
You should be looking for your specific subnet's IP ranges (`10.123.45.0/24` in case of `int-net1`) and anything from
466+
`100.*.0.0/16` range.
467+
468+
Some other alternatives are `route print` & `Get-NetIPConfiguration`.
469+
470+
##### Verifying routing configuration on the MacOS operating system
471+
472+
The easiest way to verify system configuration is `netstat -nr` command:
473+
474+
```shell
475+
% netstat -nr
476+
477+
Routing tables
478+
479+
Internet:
480+
Destination Gateway Flags Netif Expire
481+
...
482+
100.83/16 utun100 USc utun100
483+
100.83.19.63 100.83.19.63 UH utun100
484+
...
485+
10.123.45 utun100 USc utun100
486+
...
487+
488+
Internet6:
489+
Destination Gateway Flags Netif Expire
490+
...
491+
```
492+
493+
You should be looking for `utun*` interface in 4th column and searching the rows for
494+
your specific subnet's clamped IP ranges (`10.123.45` in case of `int-net1`) and anything from `100.*/16` range.
495+
496+
##### Verifying routing configuration on the Linux operating system
497+
498+
Depending on specifics of your Linux distribution (or even your configuration of it) you should be able to use either
499+
`iproute2` or `net-tools` family of network commands.
500+
501+
Netbird client stores it's custom routes in the routing table `7120` (or `0x1BD0`) when it's available (through
502+
`iproute2` interface).
503+
504+
For `iproute2` (`ip`, `ss` tools):
505+
506+
- `ip route` to find built-in `100.*.0.0/16` route,
507+
- `ip route show table 7120` or `ip route show table all` to find the specific routed networks,
508+
509+
For `net-tools` (`ifconfig`, `route`, `netstat` tools):
510+
511+
- `route -n` to find built-in `100.*.0.0/16` route,
512+
- neither `route` nor `netstat` support viewing content of custom routing tables,
513+
415514
### Public nameservers
416515
417516
When you configure a _Nameserver_ accessible from the Internet without a VPN, the Netbird client acts as a proxy

0 commit comments

Comments
 (0)