Baike.dev
Log in
Back to tool/Back to issues
#1865·nebula

BUG: In certain configurations, lighthouse will process host queries for its own address

Author: matt-definedCreated Sep 1, 2026Updated Sep 1, 2026

What version of nebula are you using? (nebula -version)

1.11.1

What operating system are you using?

Linux

Describe the Bug

In certain scenarios lighthouses can end up processing host queries for itself, and sending itself a punch notification. In this situation, it will then start to initiate a tunnel with itself (but then stop, without sending a handshake) until the timeout is reached.

Logs from affected hosts

time=2026-09-01T14:16:53.531Z level=INFO msg="Handshake message received" vpnAddrs="[10.162.148.9 fdef:99:99:e2b9:aa70:83ee:8502:ec89]" from=172.20.0.1:34534 certName=probe certVersion=2 fingerprint=09596b2813fd2697543c00e619ffd1fb0d32584def24e47e8d52c0e81fe2f446 issuer=b045078d2e3902606653d85e46c3c2cf81ce663814e6f75f337ad00e35493aa8 initiatorIndex=937729865 responderIndex=581034947 handshake="map[stage:2 style:ix_psk0]"
time=2026-09-01T14:16:53.531Z level=INFO msg="Taking new handshake" vpnAddrs="[10.162.148.9 fdef:99:99:e2b9:aa70:83ee:8502:ec89]" localIndex=495786579 remoteIndex=1680675524 certName=probe
time=2026-09-01T14:16:53.531Z level=DEBUG msg="Hostmap vpnIp added" hostMap="map[hostinfo:map[existing:true localIndexId:581034947 vpnAddrs:[10.162.148.9 fdef:99:99:e2b9:aa70:83ee:8502:ec89]] mapTotalSize:2 vpnAddrs:[10.162.148.9 fdef:99:99:e2b9:aa70:83ee:8502:ec89]]"
time=2026-09-01T14:16:53.531Z level=INFO msg="Handshake message sent" vpnAddrs="[10.162.148.9 fdef:99:99:e2b9:aa70:83ee:8502:ec89]" handshake="map[stage:2 style:ix_psk0]" cached=false initiatorIndex=937729865 responderIndex=581034947 certName=probe certVersion=2 fingerprint=09596b2813fd2697543c00e619ffd1fb0d32584def24e47e8d52c0e81fe2f446 issuer=b045078d2e3902606653d85e46c3c2cf81ce663814e6f75f337ad00e35493aa8 from=172.20.0.1:34534
time=2026-09-01T14:16:53.531Z level=DEBUG msg="Packet store" vpnAddrs=[10.162.148.2] localIndex=0 remoteIndex=0 length=1 stored=true
time=2026-09-01T14:16:53.531Z level=DEBUG msg="Generated index" index=41369472
time=2026-09-01T14:16:53.532Z level=INFO msg="Handshake message sent" vpnAddrs=[10.162.148.2] localIndex=41369472 remoteIndex=0 udpAddrs=[192.168.64.2:4242] initiatorIndex=41369472 handshake="map[stage:1 style:ix_psk0]"
time=2026-09-01T14:16:53.532Z level=DEBUG msg="Generated index" index=553343275
time=2026-09-01T14:16:53.532Z level=ERROR msg="Refusing to handshake with myself" vpnNetworks="[10.162.148.2/24 fdef:99:99:e2b9:aa70:a8ef:749d:b661/80]" from=172.20.0.1:53623 certName=docker-lighthouse certVersion=2 fingerprint=27291a90ab91a01564a98fbbd89485bfd58468d6f7dd93de4e79c27f7c05b8a5 issuer=b045078d2e3902606653d85e46c3c2cf81ce663814e6f75f337ad00e35493aa8
time=2026-09-01T14:16:53.761Z level=DEBUG msg="Generated index" index=660813341
time=2026-09-01T14:16:53.761Z level=DEBUG msg="Handshake message sent" vpnAddrs=[10.162.148.2] localIndex=41369472 remoteIndex=0 udpAddrs=[192.168.64.2:4242] initiatorIndex=41369472 handshake="map[stage:1 style:ix_psk0]"
time=2026-09-01T14:16:53.761Z level=ERROR msg="Refusing to handshake with myself" vpnNetworks="[10.162.148.2/24 fdef:99:99:e2b9:aa70:a8ef:749d:b661/80]" from=172.20.0.1:53623 certName=docker-lighthouse certVersion=2 fingerprint=27291a90ab91a01564a98fbbd89485bfd58468d6f7dd93de4e79c27f7c05b8a5 issuer=b045078d2e3902606653d85e46c3c2cf81ce663814e6f75f337ad00e35493aa8
time=2026-09-01T14:16:54.161Z level=DEBUG msg="Handshake message sent" vpnAddrs=[10.162.148.2] localIndex=41369472 remoteIndex=0 udpAddrs=[192.168.64.2:4242] initiatorIndex=41369472 handshake="map[stage:1 style:ix_psk0]"
time=2026-09-01T14:16:54.161Z level=DEBUG msg="Generated index" index=3130637732
time=2026-09-01T14:16:54.161Z level=ERROR msg="Refusing to handshake with myself" vpnNetworks="[10.162.148.2/24 fdef:99:99:e2b9:aa70:a8ef:749d:b661/80]" from=172.20.0.1:53623 certName=docker-lighthouse certVersion=2 fingerprint=27291a90ab91a01564a98fbbd89485bfd58468d6f7dd93de4e79c27f7c05b8a5 issuer=b045078d2e3902606653d85e46c3c2cf81ce663814e6f75f337ad00e35493aa8
time=2026-09-01T14:16:54.560Z level=DEBUG msg="Handshake message sent" vpnAddrs=[10.162.148.2] localIndex=41369472 remoteIndex=0 udpAddrs=[192.168.64.2:4242] initiatorIndex=41369472 handshake="map[stage:1 style:ix_psk0]"
time=2026-09-01T14:16:54.560Z level=DEBUG msg="Generated index" index=343340958
time=2026-09-01T14:16:54.561Z level=ERROR msg="Refusing to handshake with myself" vpnNetworks="[10.162.148.2/24 fdef:99:99:e2b9:aa70:a8ef:749d:b661/80]" from=172.20.0.1:53623 certName=docker-lighthouse certVersion=2 fingerprint=27291a90ab91a01564a98fbbd89485bfd58468d6f7dd93de4e79c27f7c05b8a5 issuer=b045078d2e3902606653d85e46c3c2cf81ce663814e6f75f337ad00e35493aa8
time=2026-09-01T14:16:55.040Z level=DEBUG msg="Packet store" vpnAddrs=[10.162.148.2] localIndex=41369472 remoteIndex=0 length=2 stored=true
time=2026-09-01T14:16:55.060Z level=DEBUG msg="Handshake message sent" vpnAddrs=[10.162.148.2] localIndex=41369472 remoteIndex=0 udpAddrs=[192.168.64.2:4242] initiatorIndex=41369472 handshake="map[stage:1 style:ix_psk0]"
time=2026-09-01T14:16:55.060Z level=DEBUG msg="Generated index" index=2747552971
time=2026-09-01T14:16:55.061Z level=ERROR msg="Refusing to handshake with myself" vpnNetworks="[10.162.148.2/24 fdef:99:99:e2b9:aa70:a8ef:749d:b661/80]" from=172.20.0.1:53623 certName=docker-lighthouse certVersion=2 fingerprint=27291a90ab91a01564a98fbbd89485bfd58468d6f7dd93de4e79c27f7c05b8a5 issuer=b045078d2e3902606653d85e46c3c2cf81ce663814e6f75f337ad00e35493aa8
time=2026-09-01T14:16:55.661Z level=DEBUG msg="Handshake message sent" vpnAddrs=[10.162.148.2] localIndex=41369472 remoteIndex=0 udpAddrs=[192.168.64.2:4242] initiatorIndex=41369472 handshake="map[stage:1 style:ix_psk0]"
time=2026-09-01T14:16:55.661Z level=DEBUG msg="Generated index" index=13827215
time=2026-09-01T14:16:55.661Z level=ERROR msg="Refusing to handshake with myself" vpnNetworks="[10.162.148.2/24 fdef:99:99:e2b9:aa70:a8ef:749d:b661/80]" from=172.20.0.1:53623 certName=docker-lighthouse certVersion=2 fingerprint=27291a90ab91a01564a98fbbd89485bfd58468d6f7dd93de4e79c27f7c05b8a5 issuer=b045078d2e3902606653d85e46c3c2cf81ce663814e6f75f337ad00e35493aa8
time=2026-09-01T14:16:56.361Z level=DEBUG msg="Handshake message sent" vpnAddrs=[10.162.148.2] localIndex=41369472 remoteIndex=0 udpAddrs=[192.168.64.2:4242] initiatorIndex=41369472 handshake="map[stage:1 style:ix_psk0]"
time=2026-09-01T14:16:56.361Z level=DEBUG msg="Generated index" index=3056960701
time=2026-09-01T14:16:56.361Z level=ERROR msg="Refusing to handshake with myself" vpnNetworks="[10.162.148.2/24 fdef:99:99:e2b9:aa70:a8ef:749d:b661/80]" from=172.20.0.1:53623 certName=docker-lighthouse certVersion=2 fingerprint=27291a90ab91a01564a98fbbd89485bfd58468d6f7dd93de4e79c27f7c05b8a5 issuer=b045078d2e3902606653d85e46c3c2cf81ce663814e6f75f337ad00e35493aa8
time=2026-09-01T14:16:57.060Z level=DEBUG msg="Handshake message sent" vpnAddrs=[10.162.148.2] localIndex=41369472 remoteIndex=0 udpAddrs=[192.168.64.2:4242] initiatorIndex=41369472 handshake="map[stage:1 style:ix_psk0]"
time=2026-09-01T14:16:57.060Z level=DEBUG msg="Generated index" index=2062463173
time=2026-09-01T14:16:57.061Z level=ERROR msg="Refusing to handshake with myself" vpnNetworks="[10.162.148.2/24 fdef:99:99:e2b9:aa70:a8ef:749d:b661/80]" from=172.20.0.1:53623 certName=docker-lighthouse certVersion=2 fingerprint=27291a90ab91a01564a98fbbd89485bfd58468d6f7dd93de4e79c27f7c05b8a5 issuer=b045078d2e3902606653d85e46c3c2cf81ce663814e6f75f337ad00e35493aa8
time=2026-09-01T14:16:58.060Z level=DEBUG msg="Handshake message sent" vpnAddrs=[10.162.148.2] localIndex=41369472 remoteIndex=0 udpAddrs=[192.168.64.2:4242] initiatorIndex=41369472 handshake="map[stage:1 style:ix_psk0]"
time=2026-09-01T14:16:58.061Z level=DEBUG msg="Generated index" index=2586343771
time=2026-09-01T14:16:58.061Z level=ERROR msg="Refusing to handshake with myself" vpnNetworks="[10.162.148.2/24 fdef:99:99:e2b9:aa70:a8ef:749d:b661/80]" from=172.20.0.1:53623 certName=docker-lighthouse certVersion=2 fingerprint=27291a90ab91a01564a98fbbd89485bfd58468d6f7dd93de4e79c27f7c05b8a5 issuer=b045078d2e3902606653d85e46c3c2cf81ce663814e6f75f337ad00e35493aa8
time=2026-09-01T14:16:59.060Z level=DEBUG msg="Handshake message sent" vpnAddrs=[10.162.148.2] localIndex=41369472 remoteIndex=0 udpAddrs=[192.168.64.2:4242] initiatorIndex=41369472 handshake="map[stage:1 style:ix_psk0]"
time=2026-09-01T14:16:59.061Z level=DEBUG msg="Generated index" index=303349758
time=2026-09-01T14:16:59.061Z level=ERROR msg="Refusing to handshake with myself" vpnNetworks="[10.162.148.2/24 fdef:99:99:e2b9:aa70:a8ef:749d:b661/80]" from=172.20.0.1:53623 certName=docker-lighthouse certVersion=2 fingerprint=27291a90ab91a01564a98fbbd89485bfd58468d6f7dd93de4e79c27f7c05b8a5 issuer=b045078d2e3902606653d85e46c3c2cf81ce663814e6f75f337ad00e35493aa8
time=2026-09-01T14:16:59.460Z level=DEBUG msg="Tunnel status" vpnAddrs="[10.162.148.9 fdef:99:99:e2b9:aa70:83ee:8502:ec89]" localIndex=495786579 remoteIndex=1680675524 certName=probe tunnelCheck="map[method:passive state:alive]"
time=2026-09-01T14:16:59.460Z level=DEBUG msg="Tunnel status" vpnAddrs="[10.162.148.9 fdef:99:99:e2b9:aa70:83ee:8502:ec89]" localIndex=581034947 remoteIndex=937729865 certName=probe tunnelCheck="map[method:passive state:alive]"
time=2026-09-01T14:17:00.161Z level=INFO msg="Handshake timed out" vpnAddrs=[10.162.148.2] localIndex=41369472 remoteIndex=0 udpAddrs=[192.168.64.2:4242] initiatorIndex=41369472 durationNs=6629335489 handshake="map[stage:1 style:ix_psk0]"

Config files from affected hosts

firewall:
  default_local_cidr_any: false
  inbound:
  - description: Allows ping requests from other hosts
    host: any
    port: any
    proto: icmp
  - description: ""
    groups:
    - role:human
    port: "3128"
    proto: tcp
  outbound:
  - host: any
    port: any
    proto: any
lighthouse:
  am_lighthouse: true
listen:
  host: 0.0.0.0
  port: 4242
  read_buffer: 10485760
  write_buffer: 10485760
logging:
  format: text
  level: info
punchy:
  punch: false
  respond: false
  target_all_remotes: false
relay:
  am_relay: true
static_host_map:
  10.162.148.2:
  - 192.168.64.2:4242
  fdef:99:99:e2b9:aa70:53ef:e545:a4b4:
  - 192.168.64.2:4242
tun:
  dev: defined1
  drop_local_broadcast: true
  drop_multicast: true
  mtu: 1300
tunnels:
  drop_inactive: false
  inactivity_timeout: 10m0s

Source: slackhq/nebula

View original on GitHubView discussion on GitHub