Unable to block RFC1918 traffic when using --block-lan-access on Exit Node

Community Support Self-Hosted
1

Describe the problem

Why trying to set up Exit Node with netbird up --block-lan-access, it still allows peers to access lan behind the exit node. Default all-all policy already deleted. If I use iptable to drop the internal subnet on wt0 it works until netbird restarts.

To Reproduce

Steps to reproduce the behavior:

  1. Delete default all-all
  2. Create internal exit node
  3. Run netbird up --block-lan-access
  4. Setup exit node route
  5. Give peer access to the exit mode via policy
  6. Peer connect exit node
  7. Access internal subnet
  8. Traffic goes through.

Expected behavior

Expecting nerbird up --block-lan-access would block RFC 1918 traffics

Are you using NetBird Cloud?

Self hosted

NetBird version

Daemon version: 0.76.1
CLI version: 0.76.1

Is any other VPN software installed?

No

Have you tried these troubleshooting steps?

  • Reviewed client troubleshooting (if applicable)
  • Checked for newer NetBird versions
  • Searched for similar issues on GitHub (including closed ones)
  • Restarted the NetBird client
  • Disabled other VPN software
  • Checked firewall settings
2

The --block-lan-access flag is designed to prevent the client/peer using the Exit Node from accessing their own local LAN while connected to the Exit Node. It was not originally designed to act as an egress firewall for the Exit Node host itself.

3

Is there a way to make the exit node purely for internet access? I tried using iptables to block it, but it won’t persist with NetBird up.