LoginSign Up
← Back to all sparks
N

Nebula

INFRA · APIS
Velocity2.5

Scalable overlay networking tool built on the Noise protocol framework

github.com/slackhq/nebula ↗

Nebula 1.12 adds optional offloading for throughput after a run of platform fixes.

mesh-vpnoverlay-networkipv6performancefirewall
◆Current state
Nebula is a peer-to-peer mesh VPN with its own certificate authority. Since v1.10.0 added IPv6 and multiple overlay addresses, releases have dealt with the fallout: v1.11.1 fixed an IPv6 firewall bypass, and v1.11.2 in September fixed IPv6 MTU on Windows, local address discovery on Android 11+, and checksums for traffic to a host's own IPv6 address on macOS. v1.12.0 on October 29 added optional UDP and TUN offloading, planned to become the default later, and stricter firewall rule parsing.
◆Where it's heading
The IPv6 work has moved from security fixes to per-platform correctness, and 1.12 turns to throughput. Offloading starting as opt-in, with a stated plan to make it default, sets up the next release cycle.
◆Prediction
Expect 1.12.x patches for offloading edge cases, and a later release that turns offloading on by default as announced.

◆Recent moves

  1. 11d ago

    Release v1.12.0

    Optional UDP and TUN offloading for throughput, planned to become default later, plus stricter firewall rule parsing that rejects malformed groups. Performance work with a config-breaking edge.

    View source ↗
  2. 1mo ago

    v1.11.2 fixes IPv6 MTU on Windows and address discovery on Android

    Three platform fixes from the IPv6 rework: Windows adapters were left at a 65535 IPv6 MTU, Android 11+ nodes advertised no underlay addresses, and macOS dropped TCP and UDP sent to its own IPv6 overlay address. An IPv6 overlay with tun.mtu under 1280 now refuses to start.

    View source ↗
  3. 2mo ago

    IPv6 firewall bypass: unparsed protocols matched TCP/UDP rules

    A crafted IPv6 payload could steer the classifier into reading an unparsed protocol such as SCTP, GRE or IP-in-IP as TCP or UDP, letting it match a TCP/UDP allow rule. These are now matched as their true protocol with no ports, which means only a proto: any rule passes them — an operational break for anyone whose traffic was flowing through the bypass. The release also enforces outbound message counter limits so a tunnel rehandshakes before nonce reuse becomes possible.

    View source ↗
  4. 3mo ago

    Breaking: slog logging, corrected firewall reject/drop direction

    Logging moves to Go's structured slog, breaking log parsing and the embedder API, and the inbound and outbound firewall action settings are corrected after each had been applied to the opposite direction. Windows gains WFP permit filters and a private network category by default. A release almost entirely about operational surface rather than the overlay itself.

    View source ↗
  5. 9mo ago

    P256 signature malleability allowed blocklist bypass

    Signature malleability in P256 let a blocked certificate be re-presented in altered form and evade the blocklist. One of the findings that traces directly back to the certificate work in v1.10.0.

    View source ↗
  6. 9mo ago

    Fix panic in use_system_route_table introduced by the previous release

    A single-panic regression fix cleaning up after the preceding release's route table changes.

    View source ↗