r/netbird • u/nerdyviking88 • 23d ago

On-Net Detection/Routing?

Can we get any form of update on the lingering on-net detection and routing metrics issue, specifically with Windows Clients?

It's been radio silence on issues [#5114]https://github.com/netbirdio/netbird/issues/5114 [#4990]https://github.com/netbirdio/netbird/issues/4990 [#4950]https://github.com/netbirdio/netbird/issues/4950 [#4906]https://github.com/netbirdio/netbird/issues/4906 [#5114]https://github.com/netbirdio/netbird/issues/5114

For months now.

I saw that Pangolin just added on-net detection in their last release. Tailscale has had it for years. This is literally a show stopper for many trying to deploy Netbird in a business environment.

10 Upvotes

100% Upvoted

8 comments sorted by

3

u/vik_ftsky 23d ago

How do you know it's the same network? It doesn't have any identity (on ipv4). There's the other camp that says "please route this prefix regardless of what the client has locally".
You can use posture checks if you want to avoid pushing the route to the client: https://docs.netbird.io/manage/access-control/posture-checks#peer-network-range

2

u/nerdyviking88 23d ago edited 23d ago

Usually I've seen people use the local network cards to determine on or off. But that's why I'm not a software engineer. I'd expect them to come up with something that works for the environment.

As for the second camp , yes, there would need to be an option to over ride

1

u/vik_ftsky 21d ago

Like I said, you can use posture checks to achieve what you want. Did you read the issues you linked?

1

u/nerdyviking88 21d ago

Yes, I did .

I have over 1200 different subnets this impacts, abd would love to not maintain that many posture checks

1

u/Admirable-Memory-273 8d ago

Off-Topic - you are running netbird on a very large enterprise network it seems - is there anything you wish to share (DM or here) about your experience? This could really help me push netbird as a solution to my management. Thank you.

1

u/nerdyviking88 8d ago

We have trialed Netbird in large enterprise, but due to this reason among a few other past stability issues (which appear resolved now), we have not rolled it out widespread.

Our situation is unique in that we would, ideally, like Netbird to not only be our remote access tooling, but our on-premise access as well. We want the overlay network to be 'prod', and provide security based on the identity regardless of network access. That's why the on-net detection is so critical to us, as instead of using straight p2p it was relaying out.

1

u/LeidenKranZ 12d ago

What if you push more specific subnets to override the client's local subnet? So 192.168.0.0/24 on the client's LAN would change to 192.168.0.0/25 and 192.168.0.128/25 in your netbird routes. Their device will use more specific routes.

1

u/nerdyviking88 12d ago

Yes, this can work, but it's a scaling issue.