Update the new version 1.10.2

[yokeshkumar162001]

We have updated to the latest Nebula version (1.10.2). It is working with a single local CIDR configuration, but in our case we need to configure multiple CIDRs. How can we configure the forwarded VM for multiple CIDRs

i tried in mutiple cidr added in forwarded vm but it's not working

[nbrownus]

You can assign multiple networks and/or unsafe networks to a certificate by providing a comma separated list of CIDRs:

• nebula-cert sign -networks '10.10.0.1/24, fd99:1234::1/64' -unsafe-networks '0.0.0.0/0, ::/0'

[yokeshkumar162001]

I’ve assigned multiple networks, and below are the configuration details.
The following command was used to create the rule:

./nebula-cert sign -name "accountinternal" -ip "192.168.105.168/24" -subnets "10.1.0.4/32, 172.16.25.10/32" --groups "staging"

Inbound route in forwarder vm

port: 443
proto: tcp
group: staging
local_cidr:

• 10.200.0.4/32
• 172.25.0.25/32

Unsafe route details

• route: 10.200.0.0/24
  via: 192.168.150.2
  mtu: 1300
  metric: 100

route: 172.25.0.0/24
via: 192.168.150.2
mtu: 1300
metric: 100
It works correctly when I use only a single subnet IP address and use multiple subnet ip address it not working

[johnmaguire]

@yokeshkumar162001 We'll need correlated logs around the time you tested, as well as a clear explanation of the behavior you're expecting to see and what you saw, then we can dig in. That said, neither route you listed under unsafe_routes matches a subnet in -subnets, so the router will refuse to serve for those CIDRs. Make sure you pass the unsafe routes in your -subnets command when generating the router's cert. As it stands, the cert will only route traffic for 10.200.0.4 and 172.16.25.10 but your unsafe_routes mentions /24's, and your local_cidr firewall rule mentions yet another completely different CIDR.