Subnet routes

A subnet router is a device in your Nardeboon network that also gives access to a subnet behind it. The machines in that subnet don't need Nardeboon: printers, NAS boxes and servers where you can't install anything become reachable from your other devices at their usual IP addresses.

Three parties take part: the router advertises its routes, an admin approves them, and each client opts in to use them.

Set up a subnet router

1. Enable IP forwarding on the router

   The router forwards packets between Nardeboon and the subnet, so Linux must allow IP forwarding. On most distributions:

   echo 'net.ipv4.ip_forward = 1' | sudo tee /etc/sysctl.d/99-ip-forward.conf
   echo 'net.ipv6.conf.all.forwarding = 1' | sudo tee -a /etc/sysctl.d/99-ip-forward.conf
   sudo sysctl -p /etc/sysctl.d/99-ip-forward.conf

   Nardeboon never changes this setting itself. If forwarding is off while the router carries approved routes, nardeboon status on the router says so.

   If the router takes its IPv6 route from router advertisements (ip -6 route show default ends in proto ra), Linux ignores those while IPv6 forwarding is on, and the router loses IPv6 when its route expires. Leave out the IPv6 line unless you route IPv6 subnets, or keep accepting them on that interface first: net.ipv6.conf.eth0.accept_ra = 2, with its name in place of eth0.

   If a firewall such as ufw or firewalld runs on the router, make sure it allows forwarded traffic too.

2. Advertise the routes

   On the router, list the subnets it can reach, separated by commas:

   sudo nardeboon up --advertise-routes=10.0.0.0/24,192.168.50.0/24

   Running up again changes only the flags you pass, so the router keeps its other settings. sudo nardeboon route advertise 10.0.0.0/24 192.168.50.0/24 sets the same thing without connecting or disconnecting the device.

   A device can offer up to 64 ranges. The default route (0.0.0.0/0) isn't a subnet route: to carry all internet traffic, use an exit node instead. Ranges that overlap the network's own addresses are left out, and so are loopback, link-local and multicast ranges.

3. Approve the routes

   An admin approves the routes on the router's page in the dashboard, under Subnet routes. Until then, no device uses them.

4. Accept routes on each client

   Devices don't use subnet routes until they opt in. On each device that needs the subnet:

   sudo nardeboon route accept

   sudo nardeboon up --accept-routes does the same, and sudo nardeboon route accept off stops using them. On Windows, turn on Use subnet routes in the app's settings, or run the same commands in any terminal, without sudo.

How the router carries traffic

The router translates the addresses of the traffic it carries (masquerading), so the machines in the subnet need no route back to Nardeboon: they see connections coming from the router itself. It keeps these rules in an nftables table of its own, nardeboon-snat, and never touches your other firewall rules, so it needs nft (the nftables package).

A device that's on the subnet itself, like a laptop in the office, reaches it directly instead: Nardeboon leaves out any route that covers a network the device is already on, and takes it back when the device moves to another network.

Two routers for one subnet

Approve the same route on two or more devices, and the subnet stays reachable when one of them goes down. One router carries the route at a time, its primary, and every device sends the subnet's traffic there. Once the primary has been offline for 10 seconds, the route moves to another of its routers that's online. It stays there when the first one comes back, so the connections through the new primary aren't cut again. A router that drops its connection for a moment and comes straight back keeps the route.

The routers waiting their turn stay ready: each forwards and masquerades for the route already, so it carries the subnet's traffic as soon as devices send it there. Connections that went through a router that went down end with it, since its masquerading is its own; new ones go through the next.

On a router that's waiting, nardeboon route list says which one carries the route now:

ROUTE        ROUTER     STATUS
10.0.0.0/24  gateway-2  approved; standby while gateway carries it
10.0.0.0/24  gateway    available (accept routes is off)

Each router counts towards your plan's subnet routers.

Check the routes

nardeboon route list

On the router:

ROUTE            ROUTER   STATUS
10.0.0.0/24      gateway  approved
192.168.50.0/24  gateway  waiting for approval

On a client:

ROUTE        ROUTER   STATUS
10.0.0.0/24  gateway  in use

Then reach machines in the subnet as you would from the LAN itself:

ping 10.0.0.20
ssh admin@10.0.0.20

nardeboon ping works for those addresses too, and says which router carried the echo:

pong from 10.0.0.20 (10.0.0.20): via gateway (subnet router), direct 203.0.113.7:41641, nb-udp, 12.3 ms

Who can use the routes

Subnet routes follow your access policy, and both the client and the router enforce it. A grant to everything (*), like the one every network starts with, includes approved subnet routes. To narrow it, grant access to an address range instead, such as cidr:10.0.0.0/24: only that grant's sources reach the range through the router.

The route command

route advertise and route accept change only that setting: a connected device stays connected and a disconnected one stays disconnected. Like every command, they accept --json. See the CLI reference.

Tips

• Advertise only what people need. Smaller subnets are easier to approve and to reason about.
• Stopping is a withdrawal. A route the router stops offering loses its approval too; offering it again needs a new approval.
• Internal names. If the subnet has its own DNS server, use split DNS to send its domains there, for example corp.example.com to 10.0.0.53.
• Approval is part of access control. Subnet routes and exit nodes always need an admin's approval. See Access control.