[cllient] Don't track ebpf traffic in conntrack#5166
Merged
Conversation
Contributor
📝 WalkthroughWalkthroughThis PR introduces eBPF proxy notrack functionality by adding NOTRACK chain management to firewall implementations (iptables and nftables), exposing proxy port discovery across the proxy stack, and integrating notrack setup into the engine's initialization flow. Changes
Sequence DiagramsequenceDiagram
participant Engine
participant WGIface
participant ProxyFactory
participant Firewall
participant KernelIPStack
Engine->>WGIface: Start()
WGIface->>ProxyFactory: GetProxyPort()
ProxyFactory-->>WGIface: proxyPort
WGIface-->>Engine: interface ready
Engine->>Engine: setupWGProxyNoTrack()
Engine->>WGIface: GetProxyPort()
WGIface-->>Engine: proxyPort (non-zero)
Engine->>Firewall: SetupEBPFProxyNoTrack(proxyPort, wgPort)
alt Iptables Backend
Firewall->>KernelIPStack: Create NETBIRD-RAW chain
Firewall->>KernelIPStack: Insert NOTRACK rules for proxy/wg traffic
KernelIPStack-->>Firewall: rules configured
else Nftables Backend
Firewall->>KernelIPStack: Create notrack output chain
Firewall->>KernelIPStack: Create notrack prerouting chain
Firewall->>KernelIPStack: Apply NOTRACK on 4 traffic scenarios
KernelIPStack-->>Firewall: chains configured
end
Firewall-->>Engine: success/error
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 3❌ Failed checks (2 warnings, 1 inconclusive)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing touches
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Fix all issues with AI agents
In `@client/internal/engine.go`:
- Around line 624-635: The setupWGProxyNoTrack method can dereference a nil
e.firewall when the firewall was not created (e.config.DisableFirewall true);
add a guard at the start of Engine.setupWGProxyNoTrack to return early if
e.firewall == nil (or if e.config.DisableFirewall) before calling
e.firewall.SetupEBPFProxyNoTrack, so the method safely no-ops when the firewall
is disabled; reference Engine.setupWGProxyNoTrack, e.firewall,
e.config.DisableFirewall and createFirewall when locating and applying the
change.
🧹 Nitpick comments (1)
client/internal/engine.go (1)
1661-1661: Minor: Extra blank line.This appears to be a formatting artifact. Consider removing if it wasn't intentional.
lixmal
force-pushed
the
no-track-ebpf-traffic
branch
from
daa7346 to
dfeae91
Compare
mlsmaycon
reviewed
Jan 23, 2026
| return fmt.Errorf("acl manager init: %w", err) | ||
| } | ||
|
|
||
| if err := m.initNoTrackChain(); err != nil { |
Collaborator
There was a problem hiding this comment.
What is the impact of this failing? Maybe we should do a soft failure with log only?
Collaborator
Author
There was a problem hiding this comment.
The caller will log it only
| return fmt.Errorf("acl manager init: %w", err) | ||
| } | ||
|
|
||
| if err := m.initNoTrackChains(workTable); err != nil { |
Collaborator
There was a problem hiding this comment.
same question. What is the impact of this failing? Maybe we should do a soft failure with log only?
Collaborator
Author
There was a problem hiding this comment.
The caller will log it only
|
pappz
approved these changes
Jan 27, 2026
7 tasks
10 tasks
7 tasks
7 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Describe your changes
In certain cases, NAT rules match our lo <-> lo traffic for wg <-> ebpf proxy (relay). This breaks connectivity.
This PR sets up notrack rules to exclude this traffic that is supposed to be rewritten by ebpf only.
The rules looks like this.
iptables:
nftables:
Issue ticket number and link
Stack
Checklist
Documentation
Select exactly one:
Docs PR URL (required if "docs added" is checked)
Paste the PR link from https://github.com/netbirdio/docs here:
https://github.com/netbirdio/docs/pull/__
Summary by CodeRabbit
✏️ Tip: You can customize this high-level summary in your review settings.