Is your feature request related to a problem? Please describe.
I think so because posture check works on windows clients but not on android clients:
I added a posture check “block ip range” to a policy. This policy affects a group of peers to which windows laptops and android clients belong. Goal is to avoid passing accesses to the local network to the netbird VPN while the device is connected directly to that network.
While this works fine on windows clients (you can observe the route for the local network disappearing when connecting to it) this doesn’t happen to Android clients. The route persists and all accesses to the local network are routed via the netbird VPN.
Describe the solution you’d like
Same behaviour as on windows clients: the android client should respect posture checks.
Describe alternatives you’ve considered
The need is to make netbird sensitive for local network accesses. There’s a wireguard app that triggers to the current connected WLAN SSID and disables/enables with it. Netbird has a wider approach for many networks at the same time but there’s no mechanism to steer that automatically (only manually what is no option in day’s life).
Additional context
The posture check feature is great for that!
The netbird internal IPs match. The external IP of my home network and what is reported in netbird as peer’s external address match, too. There’s no reporting of my internal local IP within wireguard (server and peer).
My devices (Windows laptops and Android phone) are put into a single group (my_remotes). The posture check rule lays within the access policy that connects my_remotes to the ressources of my home network. It has a peer network range rule that blocks the IP range of my local home network.
This comes from when I asked Claude how to automatically obtain passing by netbird for local networks while using them while I’m on my way outside. I know a similar feature from the app “Wireguard-Tunnel” that binds activation of a tunnel to active WLAN profiles.
The posture check method works for Windows peers where I can observe that those local networks are disconnected as long as I stay whithin them. But not on Android: they are connected constantly (tested with traceroutes).
What I observed: on my Google Pixel the “About this phone” / IP Address field always reports the netbird internal address, here 100.100.x.y as long as netbird is connected. The true local address only appears if Netbird is disconnected. So posture checks as done in my way can’t match ever.
This is not the case for Windows clients. Here the client seems to look for all adapters and match if one of them shows a filtered address.