1.10.3 unsafe route not working

[daiwei-china]

What version of nebula are you using? (nebula -version)

1.10.3

What operating system are you using?

linux arm64 windows

Describe the Bug

router(linux arm64,opwrt ) has sign subnets in crt, pc (win10) has add unsafe route, pc can ping nebula's ip but cannot ping router's local lan ips.

Logs from affected hosts

```when pc ping 192.168.66.1 (can't success), in windows nebula log i can see

 level=info msg="Handshake message received" certName=DwOpwrt.ne certVersion=1 ******="180.****161" handshake="map[stage:2 style:ix_psk0]" initiatorIndex=** remoteIndex=** responderIndex=**sentCachedPackets=6 vpnAddrs="[10.10.16.8]"

### Config files from affected hosts

``` pc   yaml:
pki:
  ca: "D:/Nebula/ca.crt"
  cert: "D:/Nebula/1.crt"
  key: "D:/Nebula/1.key"

static_host_map:
     "10.10.16.1": ["106.******:61668"]

lighthouse:
  am_lighthouse: false
  dns:
      host: 10.10.16.1
      port: 53
  interval: 60
  hosts:
    - "10.10.16.1"

listen:
  host: "0.0.0.0"
  port: 0

punchy:  
  punch: true
  respond: true

cipher: aes

preferred_ranges: ["192.168.1.0/24"]

relay:
  relays:
    -10.10.16.1
  am_relay: false
  use_relays: false

tun:
  disabled: false
  dev: nebula1
  drop_local_broadcast: true
  drop_multicast: true
  tx_queue: 500
  mtu: 1300
  routes:
  unsafe_routes:
      - route: 192.168.66.0/24
        via: 10.10.16.8


logging:
  level: info
  format: text
  disable_timestamp: true


firewall:
  outbound_action: drop
  inbound_action: drop

  conntrack:
    tcp_timeout: 12m
    udp_timeout: 3m
    default_timeout: 10m
  outbound:
    - port: any
      proto: any
      host: any
  inbound:
    - port: any
      proto: any
      host: any
  

```router  yaml:
pki:
  ca: "/etc/nebula/ca.crt"
  cert: "/etc/nebula/1.crt"
  key: "/etc/nebula/1.key"

static_host_map:
     "10.10.16.1": ["106.******:61668"]

lighthouse:
  am_lighthouse: false 
  interval: 60
  hosts:
    - "10.10.16.1"

listen:
  host: "0.0.0.0"
  port: 0

punchy:  
  punch: true
  respond: true

cipher: aes

preferred_ranges: ["192.168.66.0/24"]

relay:
  relays:
    - 10.10.16.1
  am_relay: false
  use_relays: false

tun:
  disabled: false
  dev: nebula1
  drop_local_broadcast: false
  drop_multicast: false
  tx_queue: 500
  mtu: 1300
  routes:
  unsafe_routes:

logging:
  level: info
  format: text
  disable_timestamp: true

firewall:
  outbound_action: drop
  inbound_action: drop

  conntrack:
    tcp_timeout: 12m
    udp_timeout: 3m
    default_timeout: 10m
  outbound:
    - port: any
      proto: any
      host: any

  inbound:
    - port: any
      proto: any
      host: any

[johnmaguire]

Hi @daiwei-china - I don't see a bug yet, so I'm moving this to discussions for triage.

The log you showed indicates a succesful handshake - this is good! However, setting up unsafe_routes in the Nebula config is not sufficient to route traffic. The router will need additional config to forward the traffic. Please follow this guide, and let me know if you are still having trouble: https://nebula.defined.net/docs/guides/unsafe_routes/

For one thing, I can see that your inbound firewall rules on the router do not specify a local_cidr, so no traffic will pass the firewall. I suspect you will also need to enable IP forwarding sysctl, and setup iptables or similar rules.