Baike.dev
Log in
Back to tool/Back to issues
#1607·nebula

Feature request: Access DNS server on tun-less lighthouse (tun.disabled: true)

Author: genpfaultCreated Feb 11, 2026Updated Apr 25, 2026

What version of nebula are you using? (nebula -version)

1.9.3

What operating system are you using?

Linux (Debian 13/Trixie)

Describe the Bug

I've configured my lighthouse to serve DNS, per the documentation:

yaml
lighthouse:
  am_lighthouse: true
  serve_dns: true
  dns:
    host: '[::]'
    port: 53

From a non-lighthouse host I can ping the lighthouse's Nebula IP fine:

none
$ ping 100.100.100.10
PING 100.100.100.10 (100.100.100.10) 56(84) bytes of data.
64 bytes from 100.100.100.10: icmp_seq=1 ttl=64 time=48.8 ms
64 bytes from 100.100.100.10: icmp_seq=2 ttl=64 time=16.2 ms
...

But dig times out when I try to do a DNS lookup:

none
$ dig @100.100.100.10 +short host A
;; communications error to 100.100.100.10#53: timed out
;; communications error to 100.100.100.10#53: timed out
;; communications error to 100.100.100.10#53: timed out
;; no servers could be reached

Logs from affected hosts

Lighthouse:

none
INFO[0000] Firewall rule added                           firewallRule="map[caName: caSha: direction:outgoing endPort:0 groups:[] host:any ip: localIp: proto:0 startPort:0]"
INFO[0000] Firewall rule added                           firewallRule="map[caName: caSha: direction:incoming endPort:0 groups:[] host:any ip: localIp: proto:0 startPort:0]"
INFO[0000] Firewall started                              firewallHashes="SHA:498215dec4e5687a2353f51c10838c113bd1af35ef72b8e8c9f536986ada5417,FNV:2782948616"
INFO[0000] listening "0.0.0.0" 4242                     
INFO[0000] Main HostMap created                          network=100.100.100.10/24 preferredRanges="[]"
INFO[0000] punchy disabled                              
INFO[0000] Loaded send_recv_error config                 sendRecvError=always
INFO[0000] Nebula interface is active                    boringcrypto=false build=1.9.3 interface=disabled network=100.100.100.10/24 udpAddr="0.0.0.0:4242"
INFO[0000] Starting DNS responder                        dnsListener="[::]:53"
INFO[0010] Handshake message received                    certName=host fingerprint=8b9a31c381f9fc2995814f3484ca03c2e87ed8c7a5a5f070964a8b46a8649d95 handshake="map[stage:1 style:ix_psk0]" initiatorIndex=3826124135 issuer=9b7c928cc6c34ea55ef8a47644c57819f86dcb705a969e37808e22aefe4b0cb1 remoteIndex=0 responderIndex=0 udpAddr="10.0.0.21:54377" vpnIp=100.100.100.20
INFO[0010] Handshake message sent                        certName=host fingerprint=8b9a31c381f9fc2995814f3484ca03c2e87ed8c7a5a5f070964a8b46a8649d95 handshake="map[stage:2 style:ix_psk0]" initiatorIndex=3826124135 issuer=9b7c928cc6c34ea55ef8a47644c57819f86dcb705a969e37808e22aefe4b0cb1 remoteIndex=0 responderIndex=577380173 udpAddr="10.0.0.21:54377" vpnIp=100.100.100.20

Host:

none
INFO[0000] Firewall rule added                           firewallRule="map[caName: caSha: direction:outgoing endPort:0 groups:[] host:any ip: localIp: proto:0 startPort:0]"
INFO[0000] Firewall rule added                           firewallRule="map[caName: caSha: direction:incoming endPort:0 groups:[] host:any ip: localIp: proto:0 startPort:0]"
INFO[0000] Firewall started                              firewallHashes="SHA:498215dec4e5687a2353f51c10838c113bd1af35ef72b8e8c9f536986ada5417,FNV:2782948616"
INFO[0000] listening "0.0.0.0" 0                        
INFO[0000] Main HostMap created                          network=100.100.100.20/24 preferredRanges="[]"
INFO[0000] punchy disabled                              
INFO[0000] Loaded send_recv_error config                 sendRecvError=always
INFO[0000] Nebula interface is active                    boringcrypto=false build=1.9.3 interface=nebula1 network=100.100.100.20/24 udpAddr="0.0.0.0:54377"
INFO[0000] Handshake message sent                        handshake="map[stage:1 style:ix_psk0]" initiatorIndex=3826124135 localIndex=3826124135 remoteIndex=0 udpAddrs="[10.0.0.42:4242]" vpnIp=100.100.100.10
INFO[0000] Handshake message received                    certName=lighthouse durationNs=19819482 fingerprint=ad0ed958c8fdc361f0b86ad8c932946f159b7fc3c1033df20467ee5b9411b9ac handshake="map[stage:2 style:ix_psk0]" initiatorIndex=3826124135 issuer=9b7c928cc6c34ea55ef8a47644c57819f86dcb705a969e37808e22aefe4b0cb1 remoteIndex=3826124135 responderIndex=577380173 sentCachedPackets=1 udpAddr="10.0.0.42:4242" vpnIp=100.100.100.10

Config files from affected hosts

Certs:

none
nebula-cert ca -name "testnet" -duration 175320h
nebula-cert sign -name "lighthouse" -ip "100.100.100.10/24"
nebula-cert sign -name "host" -ip "100.100.100.20/24"

Lighthouse:

yaml
pki:
  ca: ca.crt
  cert: lighthouse.crt
  key: lighthouse.key

static_host_map:

lighthouse:
  am_lighthouse: true
  serve_dns: true
  dns:
    host: '[::]'
    port: 53

listen:
  port: 4242

tun:
  disabled: true

firewall:
  outbound:
    - port: any
      proto: any
      host: any
  inbound:
    - port: any
      proto: any
      host: any

Host:

yaml
pki:
  ca: ca.crt
  cert: host.crt
  key: host.key

static_host_map:
  "100.100.100.10": ["10.0.0.42:4242"]

lighthouse:
  am_lighthouse: false
  hosts:
    - "100.100.100.10"

listen:
  port: 0

tun:
  disabled: false
  dev: nebula1

firewall:
  outbound:
    - port: any
      proto: any
      host: any
  inbound:
    - port: any
      proto: any
      host: any

Source: slackhq/nebula

View original on GitHubView discussion on GitHub