Baike.dev
Log in
Back to tool/Back to issues
#1882·nebula

BUG: Nebula fails IP configuration of the tun device

Author: jblt-sidnCreated Sep 17, 2026Updated Sep 18, 2026

What version of nebula are you using? (nebula -version)

1.11.1

What operating system are you using?

Linux 6.12.102-flatcar

Describe the Bug

I configured two hosts as described in the quickstart documentation, one lighthouse and one host. Both hosts have nebula up and running and seem to have a tunnel established. Using the sshd backend, I can succesfully run print-tunnel and device-info commands which show me the tunnel and device configuration respectively.

On both ends, nebula1 devices are succesfully created also. However, IP configuration and routing is missing on both ends. Therefore, the hosts cannot establish what traffic needs to be sent over the tunnel. As these hosts have multiple interfaces, both physical and virtual, I added the interfaces that Nebula needs to ignore to the local_allow_list.

I even used strace to monitor Netlink calls to configure the interface but I don't see any. Nebula logs the following message, however:

"time=2026-09-17T09:32:19.791Z level=INFO msg="Nebula interface is active" interface=nebula1 networks=[192.168.100.1/24] build=1.11.1 udpAddr=x.x.x.x:4242 boringcrypto=false"

Logs from affected hosts

time=2026-09-17T09:32:19.786Z level=DEBUG msg="Client nebula certificate(s)" cert="[{\"curve\":\"CURVE25519\",\"details\":{\"groups\":null,\"isCa\":false,\"issuer\":\"2ff6704b58db78454a139d8cb2937db9bb95a2b1c708556e209d9cfea38d3ea6\",\"name\":\"lighthouse01\",\"networks\":[\"192.168.100.1/24\"],\"notAfter\":\"2036-09-11T15:12:40Z\",\"notBefore\":\"2026-09-14T15:13:53Z\",\"unsafeNetworks\":null},\"fingerprint\":\"f61f93c65fbb4ebd39e4e86bf0bed1cb382a7d4eebc43470ad1d65cc1c280728\",\"publicKey\":\"545f6be06aa48933087b490e71963d0b4dba9e983f8ad3c7bb71a8099c74a321\",\"signature\":\"c31d816f5f0d4d9c31094a85b609bd7b02533667d0cdb64b903c35e64097ad1f1080eeb92c2527edd521df0210425e63a31ff7e771bb19883022bc2b5920a504\",\"version\":2}]"
time=2026-09-17T09:32:19.787Z level=DEBUG msg="Trusted CA fingerprints" fingerprints=[2ff6704b58db78454a139d8cb2937db9bb95a2b1c708556e209d9cfea38d3ea6]
time=2026-09-17T09:32:19.787Z level=INFO msg="Firewall rule added" firewallRule="map[caName: caSha: cidr: direction:outgoing endPort:0 groups:[] host:any localCidr: proto:0 startPort:0]"
time=2026-09-17T09:32:19.787Z level=WARN msg="ignoring port specification for ICMP firewall rule" port=any
time=2026-09-17T09:32:19.787Z level=INFO msg="Firewall rule added" firewallRule="map[caName: caSha: cidr: direction:incoming endPort:0 groups:[] host:any localCidr: proto:1 startPort:0]"
time=2026-09-17T09:32:19.787Z level=INFO msg="Firewall rule added" firewallRule="map[caName: caSha: cidr: direction:incoming endPort:22 groups:[] host:any localCidr: proto:6 startPort:22]"
time=2026-09-17T09:32:19.787Z level=INFO msg="Firewall started" firewallHashes=SHA:76c77c87efc394ea26c348df77eddb7b686359b4f12cca030a71ce8aff88fbb9,FNV:1417645050
time=2026-09-17T09:32:19.788Z level=INFO msg="Authorized ssh key" subsystem=sshd sshKey="ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB4wqbE6KHWWnuhnrRi7VaHAwxYBirEIxwJ1InWBIhTA" sshUser=somedude
time=2026-09-17T09:32:19.788Z level=INFO msg=listening addr=x.x.x.x:4242
time=2026-09-17T09:32:19.791Z level=INFO msg="Main HostMap created" preferredRanges=[]
time=2026-09-17T09:32:19.791Z level=INFO msg="punchy enabled"
time=2026-09-17T09:32:19.791Z level=INFO msg="Loaded send_recv_error config" sendRecvError=always
time=2026-09-17T09:32:19.791Z level=INFO msg="Loaded accept_recv_error config" acceptRecvError=always
time=2026-09-17T09:32:19.791Z level=INFO msg="Nebula interface is active" interface=nebula1 networks=[192.168.100.1/24] build=1.11.1 udpAddr=x.x.x.x:4242 boringcrypto=false

Debugging from the sshd backend
> list-hostmap 
[192.168.100.10]: [[x:x:x:x::]:4242 x.x.x.x:4242]
> print-tunnel 192.168.100.10
{"vpnAddrs":["192.168.100.10"],"localIndex":1109117713,"remoteIndex":946230481,"remoteAddrs":["[x:x:x:x::]:4242","x.x.x.x:4242"],"cert":{"curve":"CURVE25519","details":{"groups":null,"isCa":false,"issuer":"2ff6704b58db78454a139d8cb2937db9bb95a2b1c708556e209d9cfea38d3ea6","name":"appserver01","networks":["192.168.100.10/24"],"notAfter":"2036-09-11T15:12:40Z","notBefore":"2026-09-14T15:14:21Z","unsafeNetworks":null},"fingerprint":"6a83150fcf0515292fdbf02a42e667b859c3d3acaf85f794a430d8c1556b6d79","publicKey":"9df68d432dd23c60b7c3a7069dff9dffc70060a3cbee43ee32a6f96e85d50d12","signature":"44cf337a7436fc1c88596f05f3038f20abc3984c210fa3a31cdb8c6c4c619460b5146f1f09707ccd50bc024070443f787b0d15aa5b039d235afec88632f53503","version":2},"messageCounter":43,"currentRemote":"x.x.x.x:4242","currentRelaysToMe":[],"currentRelaysThroughMe":[]}

Config files from affected hosts

Lighthouse:

pki:
  ca: /etc/nebula/ca.crt
  cert: /etc/nebula/lighthouse01.crt
  key: /etc/nebula/lighthouse01.key

lighthouse:
  am_lighthouse: true
  interval: 60
  remote_allow_list:
    '0.0.0.0/0': true
  local_allow_list:
    interfaces:
      'docker.*': false
      'dummy0': false

listen:
  host: x.x.x.x
  port: 4242

tun:
  disabled: false
  dev: nebula1
  mtu: 1300

logging:
  level: debug
  format: text

sshd:
  enabled: true
  listen: 127.0.0.1:2222
  host_key: /etc/nebula/ssh_host_ed25519_key
  authorized_users:
    - user: somedude
      keys:
        - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB4wqbE6KHWWnuhnrRi7VaHAwxYBirEIxwJ1InWBIhTA'

punchy:
  punch: true

firewall:
  outbound:
    - port: any
      proto: any
      host: any
  inbound:
    - port: any
      proto: icmp
      host: any
    - port: 22
      proto: tcp
      host: any

Host:

pki:
  ca: /etc/nebula/ca.crt
  cert: /etc/nebula/appserver01.crt
  key: /etc/nebula/appserver01.key

lighthouse:
  am_lighthouse: false
  interval: 60
  remote_allow_list:
    '0.0.0.0/0': true
  local_allow_list:
    interfaces:
      'docker.*': false
      'dummy0': false
  hosts:
    - "192.168.100.1"  # overlay IP of the lighthouse

static_host_map:
  "192.168.100.1": ["x.x.x.x:4242"]  # real public IP:port

listen:
  host: x.x.x.x
  port: 4242 

punchy:
  punch: true
  respond: true

firewall:
  outbound:
    - port: any
      proto: any
      host: any
  inbound:
    - port: any
      proto: icmp
      host: any
    - port: 22
      proto: tcp
      host: any
    - port: 443
      proto: tcp
      host: any

Nebula1 interface configuration on both ends:

nebula1: flags=4305<UP,POINTOPOINT,RUNNING,NOARP,MULTICAST>  mtu 1300
        inet6 fe80::f653:83d0:c002:59b2  prefixlen 64  scopeid 0x20<link>
        unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  txqueuelen 500  (UNSPEC)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 48  bytes 12644 (12.3 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

Source: slackhq/nebula

View original on GitHubView discussion on GitHub