Netbird + PFSense 25.07.1 (FreeBSD-15)

[PowershellScripter]

I assume we wont be able to get an updated netbird pfsense client for a bit since FreeBSD hasnt updated the package ports for git and other necessary build utilities for "make" to work, correct?

[PowershellScripter]

Got it back to working on 25.07.1 but once the service is running and NetBird is connected, whenever I go to the NetBird settings or Update section settings (to get updates for PFSense) there is still massive delays and sometimes even full on timeouts for those pages.

[PowershellScripter]

I managed to build the packages on FreeBSD-15 arch, but still run into the heavy delays.

What I have noticed is that if you dont enable the wt0 ineterface, then only the netbird page is delayed. But, if you enable it, then it effects both the update and netbird pages

[PowershellScripter]

SSH to the firewall also seems to not be working

[mlsmaycon]

@PowershellScripter could you please test the build from #10 ?

You can download the packages here: https://github.com/netbirdio/pfsense-netbird/actions/runs/17505571873?pr=10

FreeBSD-package is the NetBird client and pfSense-package is the pfSense package.

[PowershellScripter]

@PowershellScripter could you please test the build from #10 ?

You can download the packages here: https://github.com/netbirdio/pfsense-netbird/actions/runs/17505571873?pr=10

FreeBSD-package is the NetBird client and pfSense-package is the pfSense package.

Got it installed and its still doing the same thing. Once connected, if the service is running, it hangs for about 20 seconds before letting me in or timing out. SSH to the firewall also doesnt work. (tested open firewall policy in netbird and tried ssh access on and off. I cant even ping the firewall's lan ip when connected to netbird. The conenction is great and doesnt drop, its just the service settings page timeout and ssh access issue

[mlsmaycon]

@PowershellScripter, can you follow the new steps for interface assignment and rules example?

https://docs.netbird.io/how-to/installation/pfsense#assign-net-bird-interface

Rules there are just suggestions; you should be able to add any custom rules to the interface. Using a more permissive rule leaves access management to NetBird only, which should also be fine.

[PowershellScripter]

@PowershellScripter, can you follow the new steps for interface assignment and rules example?

https://docs.netbird.io/how-to/installation/pfsense#assign-net-bird-interface

Rules there are just suggestions; you should be able to add any custom rules to the interface. Using a more permissive rule leaves access management to NetBird only, which should also be fine.

I will have to try this in a little bit since I have employees still at the office and the last time I tried assigning the adapter, it broke pfsense being able to look for updates and also caused a bunch of more highly aggressive timeouts. If that happens again, id rather not do it until everyone is done for the evening which should be in the next 2 hours. I can test then and let you know.

[PowershellScripter]

@PowershellScripter, can you follow the new steps for interface assignment and rules example?

https://docs.netbird.io/how-to/installation/pfsense#assign-net-bird-interface

Rules there are just suggestions; you should be able to add any custom rules to the interface. Using a more permissive rule leaves access management to NetBird only, which should also be fine.

I was finally able to get around to testing the update and after assigning the adapter, I can confirm that it does route ICMP and SSH to the firewall and the update section of the firewall is no longer broken (only happened previously when assigning interface).

During setup and testing:

1. Im still getting severe lag when trying to go back into the Netbird settings after making the intial connection. I also cant get to the status page at all without getting a 504 gateway timeout.

2. When I first connect to Netbird, then go to assign the adapter, the connection drops and I have to reconnect. (But, it stays connected after I reconnect.)

3. Because the secret key gets asterisked out after connecting, if the connection drops and a reconnection is required, I have to re-enter the key. Although it may be thought of as more secure, its not very beneficial if a one time key gets used for the connection and this happens due to the adapter assignment dropping the connection because then you have to go create another key to make the same connection a second time. I can see the need to privatize the key on interactive clients, but since firewalls should be locked down to limited (admin) access in the first place, this doesnt seem very necessary IMO 🤷‍♂️

[PowershellScripter]

Disclaimer** This information is not meant to discredit efforts made thus far on the FreeBSD package as I understand this package is still in the experiemental phase and has alot of stabilizing and optimizing to do. I am merely showing the results of where it currently stands as far as the latest update release.
The progress and stability made so far and so quickly has been fantastic, great work!

Did some iperf speed testing between netbird and headscale / tailscale. Netbird is running into major performance bottlnecks and higher latency.

To test, I used the same testing numbers for both VPNs. Netbird was averaging half the speed which resulted in 1/3 of the data transfer over the 30 second interval.

 
 
 

: Headscale / Tailscale Testing :
 

ICMP Average -

 

iPerf Runs -

 
 
 
: NetBird :
 

ICMP Average -

 

iPerf Runs -

[mlsmaycon]

@PowershellScripter can you run netbird debug bundle -A -U and share the upload key?

[PowershellScripter]

@mlsmaycon

I saw that there was an update available for windows to v0.56.0. After upgrading, the saturations tests were looking ALOT better. I got small drop outs here and there but overall, 3 tests showed alot more consistency and bandwidth output.

A little bit higher in throughput since I ups the simultaneous connections from 10 up to 15, but even at 10 I was sitting close to right below 200. Seems that windows client update made alot better difference.

 

latency is still relatively higher at 100ms average compared to 30ms average with headscale

 

 

Here are the file incase youd still like to see them -

 

Windows: 44ea7403a9a1fd7c2fc7f56fa6bb372b0b1260b0fd4c95938cb25cc792a9f24a/1180f417-471f-46a8-afc1-43cabe8ff2bb

netbird.debug.1340137984.zip

 

PFSense: 44ea7403a9a1fd7c2fc7f56fa6bb372b0b1260b0fd4c95938cb25cc792a9f24a/554df653-5241-4dbc-bbf0-5257ff878b9f

netbird.debug.19553081.zip

[PowershellScripter]

@mlsmaycon

is v0.1.3 a newer version than the one you had me test? I saw it just recently came out, but because the pkg version doesnt match the tag version (still references 0.1.0) I cant tell. I can upgrade to this one and test if you need or want me to.

[mlsmaycon]

Hello @PowershellScripter the version has the same content with the exception for a newer client.

We will be preparing a new version tomorrow with arm support too

[mlsmaycon]

I don't expect any changes on performance at this point, since there was no substantial client changes for that