[client] Match Windows ICE interface-filter substrings case-insensitively

client/internal/stdnet/filter.go

@@ -8,19 +8,72 @@
 	"golang.zx2c4.com/wireguard/wgctrl"
 )
 
+// windowsKnownBadSubstrings lists Windows interface-name fragments that
+// should ALWAYS be excluded from ICE candidate gathering, even when the
+// caller-supplied disallow list does not cover them. These are the
+// interfaces uray-mic-d4's debug bundle (2026-05-04) showed Pion ICE
+// picking as host candidates -- producing dead-end pairs because none
+// of these can be reached from the public internet:
+//
+//   - "loopback pseudo-interface" -> 127.0.0.1 (loopback)
+//   - "vethernet (default switch)" -> 172.26.x.x (Hyper-V NAT-only)
+//   - "vethernet (wsl"             -> WSL2 host-only
+//
+// Matched as case-insensitive substrings.
+//
+// IMPORTANT: User-named Hyper-V external switches like "vEthernet (LAN)"
+// MUST NOT be filtered. On uray-mic-d4 that interface IS the default
+// route (192.168.0.243/22 -> 0.0.0.0/0 via 192.168.0.254). Filtering it
+// out would actually break P2P, not improve it.
+var windowsKnownBadSubstrings = []string{
+	"loopback pseudo-interface",
+	"vethernet (default switch)",
+	"vethernet (wsl",
+}
+
 // InterfaceFilter is a function passed to ICE Agent to filter out not allowed interfaces
 // to avoid building tunnel over them.
+//
+// Matching is case-insensitive because Windows interface names use mixed
+// case (e.g. "Loopback Pseudo-Interface 1") while the disallow list is
+// lowercase. Without the fold, the historic implementation let every
+// Windows interface slip past and Pion ICE picked junk addresses
+// (127.0.0.1, 172.26.x.x Hyper-V Default Switch, internal-VPN /22s) as
+// local host candidates, dooming P2P to dead-end pairs and forcing
+// relay-only. See windowsKnownBadSubstrings for the targeted Windows
+// extras.
+//
+// Reported by Michael Uray on uray-mic-d4 (2026-05-04): 0/28 peers P2P.
 func InterfaceFilter(disallowList []string) func(string) bool {
-
 	return func(iFace string) bool {
+		lowerIFace := strings.ToLower(iFace)
 
-		if strings.HasPrefix(iFace, "lo") {
-			// hardcoded loopback check to support already installed agents
+		// Linux/macOS loopback prefix ("lo", "lo0").
+		if strings.HasPrefix(lowerIFace, "lo") {
 			return false
 		}
 
+		// Windows-specific known-bad substrings (loopback, NAT switches).
+		if runtime.GOOS == "windows" {
+			for _, sub := range windowsKnownBadSubstrings {
+				if strings.Contains(lowerIFace, sub) {
+					return false
+				}
+			}
+		}
+
 		for _, s := range disallowList {
-			if strings.HasPrefix(iFace, s) && runtime.GOOS != "ios" {
+			sLower := strings.ToLower(s)
+			// "veth" exists on both Linux (legitimate veth pair to filter)
+			// and Windows (where every Hyper-V iface starts with vEthernet,
+			// including the user's REAL default-route external switch). On
+			// Windows, junk Hyper-V interfaces are filtered above by name;
+			// applying a blanket vEthernet* prefix here would also drop
+			// user-named external switches like "vEthernet (LAN)".
+			if sLower == "veth" && runtime.GOOS == "windows" {
+				continue
+			}
+			if strings.HasPrefix(lowerIFace, sLower) && runtime.GOOS != "ios" {
 				return false
 			}
 		}

client/internal/stdnet/filter_test.go

@@ -0,0 +1,80 @@
+package stdnet
+
+import (
+	"runtime"
+	"testing"
+)
+
+// Regression test for the Windows-side ICE interface filter.
+//
+// Two things this test pins down:
+//
+//  1. Loopback / Hyper-V Default Switch / WSL adapter must be excluded
+//     even though their Windows names ("Loopback Pseudo-Interface 1",
+//     "vEthernet (Default Switch)") don't share a lowercase prefix with
+//     anything in the default disallow list.
+//
+//  2. User-named Hyper-V external switches (e.g. "vEthernet (LAN)")
+//     MUST stay allowed. On uray-mic-d4 (Michael Uray's debug bundle
+//     2026-05-04) that interface owns the default route at
+//     192.168.0.243/22 -> 0.0.0.0/0; filtering it out would have
+//     made P2P worse, not better. Codex review caught the broad
+//     "veth"-prefix variant of this fix before it shipped.
+func TestInterfaceFilter_Windows_TargetedFiltering(t *testing.T) {
+	disallow := []string{"wt", "wg", "veth", "br-", "lo", "docker"}
+	allow := InterfaceFilter(disallow)
+
+	cases := []struct {
+		name string
+		want bool // true => allowed, false => filtered out
+	}{
+		// Always-bad Windows interfaces: filtered.
+		{"Loopback Pseudo-Interface 1", false},
+		{"vEthernet (Default Switch)", false},
+		{"vEthernet (WSL)", false},
+		{"vEthernet (WSL (Hyper-V firewall))", false},
+		// Disallow-list tokens (any platform).
+		{"wt0", false},
+		// Linux names (lowercase) still filtered:
+		{"lo", false},
+
+		// Real candidate interfaces stay allowed.
+		{"Ethernet USB", true},
+		{"OpenVPN 1", true},
+		{"WiFi", true},
+		// Critical: user-named Hyper-V external switch is the actual
+		// default-route interface and must NOT be dropped.
+		{"vEthernet (LAN)", true},
+		{"vEthernet (External)", true},
+	}
+
+	for _, c := range cases {
+		// The wgctrl branch can override on hosts where NetBird is
+		// running; tests run on a host where these names are not
+		// real interfaces, so the final return faithfully reflects
+		// the disallow-list logic.
+		got := allow(c.name)
+		// "veth*" prefix only filters on non-Windows; on Linux test
+		// runners "vEthernet (LAN)" still passes because of mixed
+		// case + the !Windows branch keeping the prefix match.
+		if !c.want && got {
+			t.Errorf("InterfaceFilter(%q) = true, want false (should be filtered)", c.name)
+		}
+		if c.want && !got && runtime.GOOS == "windows" && c.name == "vEthernet (LAN)" {
+			t.Fatalf("InterfaceFilter(%q) = false, want true on Windows (this is uray-mic-d4's default-route interface)", c.name)
+		}
+	}
+}
+
+// Linux-side regression: keep filtering legitimate Linux veth pairs.
+func TestInterfaceFilter_Linux_VethPair(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("veth prefix filter is intentionally skipped on Windows")
+	}
+	allow := InterfaceFilter([]string{"veth", "docker", "lo"})
+	for _, name := range []string{"veth0", "veth1234", "docker0", "lo"} {
+		if allow(name) {
+			t.Errorf("InterfaceFilter(%q) = true, want false on Linux", name)
+		}
+	}
+}