Can't ping routing peer's local IP after explicitly setting up a policy that allows access

[luantran96]

Describe the problem

I want to access the local IP of a routing peer of a network as this server hosts many of my applications. I found the solution to this is mentioned in this PR which is to creating an access policy that explicitly allows access to the routing peers. Even after doing so, I'm still not able to ping to local IP of the routing peer

To Reproduce

Steps to reproduce the behavior:

1. Create a network with the subnet 10.0.0.0/8 as a resource and assign it to group
2. Assign a routing group (right now there's one peer) for the network
3. Create an ACL for accessing the 10.0.0.0/8 subnet
4. Create an ACL for accessing the routing peer group

Expected behavior

After creating a routing peer policy, I should be able to ping the local IP of the routing peer.

Are you using NetBird Cloud?

self hosted

NetBird version

0.60.8

Is any other VPN software installed?

No

If yes, which one?

Debug output

To help us resolve the problem, please attach the following anonymized status output

netbird status -dA

Create and upload a debug bundle, and share the returned file key:

netbird debug for 1m -AS -U

Uploaded files are automatically deleted after 30 days.

Alternatively, create the file only and attach it here manually:

netbird debug for 1m -AS

Screenshots

Additional context

I'm trying to connect from a peer that is in the Admin group

Have you tried these troubleshooting steps?

• Reviewed client troubleshooting (if applicable)
• Checked for newer NetBird versions
• Searched for similar issues on GitHub (including closed ones)
• Restarted the NetBird client
• Disabled other VPN software
• Checked firewall settings

[coderabbitai]

📝 CodeRabbit Plan Mode

Generate an implementation plan and prompts that you can use with your favorite coding agent.

• Create Plan

Examples

• Example 1
• Example 2

---

🔗 Similar Issues

Related Issues

• Network allows access to routing peer, but not adjacent devices #4841
• Unable to route overlapping /24 networks #4765
• Network Policy does not limit Traffic to specified port #4787
• Routing peer broken from 0.40.0 onwards #3841

🔗 Related PRs

#4802 - [management] Fix direct peer networks route [merged]

👤 Suggested Assignees

• ninjack-dev
• mitchplze
• philzett
• drewhemm
• pascal-fischer

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord or schedule a call!

[Billy5804]

I believe I'm also having this issue. I've got a network configured with 2 domain resources that with one resolving x.x.x.4 and the other resolving x.x.x.2 which is the LAN IP of the routing peer. Both of the resources have been added to the same group and a policy is configured to give my client peer access to the group. I am able to access the resource domain that resolves x.x.x.4, but the domain that resolves x.x.x.2 is not accessible and gets no response when pinged.

Since the service I'm trying to access with the domain that resolves the routing peer is running under docker on the peer host I also tried modifying the resolution of the domain using the extra_hosts in my compose file for the routing peer netbird client to resolve the domain as "host-gateway" and when that also didn't work I changed it to the gateway IP of the docker network that the target service is using, but that also failed to work.

I'm also self hosted and running 0.65.2 on both my server and windows/docker clients.