Mesh: problems other Linux meshes hit, and whether we handle them

kayg commented

2026-10-15 07:44:06 +00:00

Owner

Survey of Linux-labelled and Linux-text issues in Tailscale and NetBird, grouped by recurring problem class. The full report, representative issue links and comment counts, project mitigations, source locations and proof proposals are attached.

Class	Severity	Our status	Proposed fix
NAT traversal, blocked UDP, relay fallback and direct recovery	Breaks connections	Not handled for mesh peer traffic	Implement D196 relay and direct-path recovery, including TCP/TLS 443 relay; test hard NAT and UDP-blocked paths.
Roaming, link changes, flapping and default routes	Breaks or interrupts connections	Partial on server control path; absent for peer path discovery	Observe Linux link/route changes, refresh endpoints with hysteresis, and test Wi-Fi/LTE and suspend/resume.
Firewalls, Docker/Kubernetes ordering, `rp_filter` and conntrack	Breaks connections or forwarding	Partial	Validate firewall coexistence and strict reverse-path behavior across frontends and container rules.
MTU, PMTU blackholes, segmentation offload and throughput	Degrades or blackholes large traffic	Partial: fixed 1380-byte MTU, no adaptation found	Add bounded MTU recovery and real-kernel IPv4/IPv6 blackhole and offload tests.
DNS managers, resolv.conf ownership and split DNS	Breaks name resolution	Partial: name model only, no host resolver integration	Add reversible systemd-resolved integration and test NetworkManager, split domains and resume.
IPv6, kernel WireGuard and old kernels	Can prevent startup or connectivity	Partial: dual-stack addresses/routes; kernel WireGuard only	Improve capability/kernel diagnostics; measure engine options for owner review and test enterprise kernels.
Keepalive, idle CPU and battery	Degrades battery and scale	Partial; no accepted scale-cost result	Measure idle and path-transition cost at expected peer counts, then tune keepalives.
Containers, LSMs and distro variance	Can prevent startup or routing	Partial: `/dev/net/tun` is unnecessary; kernel WireGuard and network-admin rights are required.	Test D161 enterprise Linux, Alpine, LXC, SELinux and AppArmor; report missing capabilities.
Restarts, upgrades, certificate time and multi-interface recovery	Interrupts or blocks reconnection	Partial	Test restart/renewal boundaries and refresh addresses after interface/default-route changes.

Read-only survey at repository snapshot 5abc64bb8f96f531b74ddb65c86517bbba61271f; autoswitch branch reviewed at 49d5e2217c5df8e23dfe0f0895b1f928e9df5315. Search totals are keyword matches, not unique incidents. The report records exact queries and pagination limits.

Survey of Linux-labelled and Linux-text issues in Tailscale and NetBird, grouped by recurring problem class. The full report, representative issue links and comment counts, project mitigations, source locations and proof proposals are attached. | Class | Severity | Our status | Proposed fix | |---|---|---|---| | NAT traversal, blocked UDP, relay fallback and direct recovery | Breaks connections | Not handled for mesh peer traffic | Implement D196 relay and direct-path recovery, including TCP/TLS 443 relay; test hard NAT and UDP-blocked paths. | | Roaming, link changes, flapping and default routes | Breaks or interrupts connections | Partial on server control path; absent for peer path discovery | Observe Linux link/route changes, refresh endpoints with hysteresis, and test Wi-Fi/LTE and suspend/resume. | | Firewalls, Docker/Kubernetes ordering, `rp_filter` and conntrack | Breaks connections or forwarding | Partial | Validate firewall coexistence and strict reverse-path behavior across frontends and container rules. | | MTU, PMTU blackholes, segmentation offload and throughput | Degrades or blackholes large traffic | Partial: fixed 1380-byte MTU, no adaptation found | Add bounded MTU recovery and real-kernel IPv4/IPv6 blackhole and offload tests. | | DNS managers, resolv.conf ownership and split DNS | Breaks name resolution | Partial: name model only, no host resolver integration | Add reversible systemd-resolved integration and test NetworkManager, split domains and resume. | | IPv6, kernel WireGuard and old kernels | Can prevent startup or connectivity | Partial: dual-stack addresses/routes; kernel WireGuard only | Improve capability/kernel diagnostics; measure engine options for owner review and test enterprise kernels. | | Keepalive, idle CPU and battery | Degrades battery and scale | Partial; no accepted scale-cost result | Measure idle and path-transition cost at expected peer counts, then tune keepalives. | | Containers, LSMs and distro variance | Can prevent startup or routing | Partial: `/dev/net/tun` is unnecessary; kernel WireGuard and network-admin rights are required. | Test D161 enterprise Linux, Alpine, LXC, SELinux and AppArmor; report missing capabilities. | | Restarts, upgrades, certificate time and multi-interface recovery | Interrupts or blocks reconnection | Partial | Test restart/renewal boundaries and refresh addresses after interface/default-route changes. | Read-only survey at repository snapshot `5abc64bb8f96f531b74ddb65c86517bbba61271f`; autoswitch branch reviewed at `49d5e2217c5df8e23dfe0f0895b1f928e9df5315`. Search totals are keyword matches, not unique incidents. The report records exact queries and pagination limits.

report.md

29 KiB

report.md

30 KiB

kayg referenced this issue

2026-10-15 07:44:25 +00:00

New machines switch to the mesh automatically and fast after add-host (D263) #201

kayg commented

2026-10-15 07:45:30 +00:00

Author

Owner

Survey complete. The latest report attachment is report.md; it includes the exact topic query terms, pagination limits, representative comment counts, code references, status, severity and proof proposals. The summary table is in the issue body.

Key findings: peer NAT traversal and relay runtime are absent; Linux DNS manager integration is absent; firewall/rp_filter coexistence is only partly covered; WireGuard uses a fixed 1380-byte interface MTU and kernel-only engine; and the autoswitch branch’s latest 1,000-pair health-guard cohort is explicitly failed, with final healthy-scale acceptance still outstanding. See the report for sources and details.

Finished at repository snapshot 5abc64bb8f (detached worktree, no code changes). No verification gate was run because this was a read-only research task.

Survey complete. The latest report attachment is [report.md](https://git.kayg.org/attachments/773d3b29-5042-434a-af6a-852fff6968ff); it includes the exact topic query terms, pagination limits, representative comment counts, code references, status, severity and proof proposals. The summary table is in the issue body. Key findings: peer NAT traversal and relay runtime are absent; Linux DNS manager integration is absent; firewall/rp_filter coexistence is only partly covered; WireGuard uses a fixed 1380-byte interface MTU and kernel-only engine; and the autoswitch branch’s latest 1,000-pair health-guard cohort is explicitly failed, with final healthy-scale acceptance still outstanding. See the report for sources and details. Finished at repository snapshot 5abc64bb8f96f531b74ddb65c86517bbba61271f (detached worktree, no code changes). No verification gate was run because this was a read-only research task.

kayg referenced this issue

2026-10-15 07:45:31 +00:00

New machines switch to the mesh automatically and fast after add-host (D263) #201

kayg referenced this issue

2026-10-15 08:17:20 +00:00

Mesh: NAT traversal and relay for mesh peers #220

kayg referenced this issue

2026-10-15 08:17:28 +00:00

Mesh: NAT traversal and relay for mesh peers #222

kayg referenced this issue

2026-10-15 08:19:02 +00:00

Mesh: SSH over the mesh (D197 M1, D235) #221

kayg referenced this issue

2026-10-15 08:19:17 +00:00

Mesh: NAT traversal and relay for mesh peers #220

kayg referenced this issue

2026-10-15 08:24:21 +00:00

Mesh: SSH over the mesh (D197 M1, D235) #221

kayg referenced this issue

2026-10-15 08:24:59 +00:00

Mesh: NAT traversal and relay for mesh peers #220

kayg referenced this issue

2026-10-15 08:27:32 +00:00

Mesh: NAT traversal and relay for mesh peers #220

kayg referenced this issue

2026-10-21 11:30:43 +00:00

Mesh: NAT traversal and relay for mesh peers #220

kayg commented

2026-10-28 17:53:19 +00:00

Author

Owner

Closed by the orchestrator during the 2026-10-28 handover (#254), on the owner's request to close finished issues. Evidence: Linux mesh problem survey completed (report attached, snapshot 5abc64bb8); its findings drive the relay work in #220. Reopen if anything is still missing.

Closed by the orchestrator during the 2026-10-28 handover (#254), on the owner's request to close finished issues. Evidence: Linux mesh problem survey completed (report attached, snapshot 5abc64bb8); its findings drive the relay work in #220. Reopen if anything is still missing.

kayg closed this issue

2026-10-28 17:53:19 +00:00

~~kayg referenced this issue 2026-10-28 17:53:55 +00:00~~

Orchestrator handover 2026-10-28: moving to a new machine #254

kayg referenced this issue

2026-10-28 18:00:45 +00:00

Orchestrator handover 2026-10-28: moving to a new machine #254

Rows
Columns

Mesh: problems other Linux meshes hit, and whether we handle them #219