{"record":{"id":"15c5ecf3f7b455be","repo":"netbirdio/netbird","slug":"address-s-is-part-of-the-netbird-network-s-refu","errorCode":null,"errorMessage":"address %s is part of the NetBird network %s, refusing to write","messagePattern":"address (.+?) is part of the NetBird network (.+?), refusing to write","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"client/iface/udpmux/universal.go","lineNumber":131,"sourceCode":"\tmux     *UniversalUDPMuxDefault\n\tlogger  logging.LeveledLogger\n\taddress wgaddr.Address\n}\n\n// GetPacketConn returns the underlying PacketConn\nfunc (u *UDPConn) GetPacketConn() net.PacketConn {\n\treturn u.PacketConn\n}\n\nfunc (u *UDPConn) WriteTo(b []byte, addr net.Addr) (int, error) {\n\tudpAddr, ok := addr.(*net.UDPAddr)\n\tif !ok {\n\t\treturn u.PacketConn.WriteTo(b, addr)\n\t}\n\tdst := udpAddr.AddrPort().Addr().Unmap()\n\tif (u.address.Network.IsValid() && u.address.Network.Contains(dst)) || (u.address.IPv6Net.IsValid() && u.address.IPv6Net.Contains(dst)) {\n\t\tlog.Warnf(\"address %s is part of the NetBird network %s, refusing to write\", addr, u.address)\n\t\treturn 0, fmt.Errorf(\"address %s is part of the NetBird network %s, refusing to write\", addr, u.address)\n\t}\n\treturn u.PacketConn.WriteTo(b, addr)\n}\n\n// GetSharedConn returns the shared udp conn\nfunc (m *UniversalUDPMuxDefault) GetSharedConn() net.PacketConn {\n\treturn m.params.UDPConn\n}\n\n// GetListenAddresses returns the listen addr of this UDP\nfunc (m *UniversalUDPMuxDefault) GetListenAddresses() []net.Addr {\n\treturn []net.Addr{m.LocalAddr()}\n}\n\n// GetRelayedAddr creates relayed connection to the given TURN service and returns the relayed addr.\n// Not implemented yet.\nfunc (m *UniversalUDPMuxDefault) GetRelayedAddr(turnAddr net.Addr, deadline time.Duration) (*net.Addr, error) {\n\treturn nil, fmt.Errorf(\"not implemented yet\")","sourceCodeStart":113,"sourceCodeEnd":149,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/client/iface/udpmux/universal.go#L113-L149","documentation":"UDPConn.WriteTo on the universal UDP mux refuses datagrams whose destination falls inside the NetBird overlay network (the v4 Network or v6 IPv6Net prefixes attached to that shared underlay socket). The mux carries peer/ICE underlay traffic; writing to an overlay address would send underlay packets into the tunnel and create a routing loop, so the guard logs a warning and returns this error with zero bytes written.","triggerScenarios":"WriteTo with a destination inside the configured NetBird range: a relay or peer endpoint resolved to its overlay IP (100.64/10-style or the v6 ULA), or application code reusing the shared conn (GetSharedConn) to dial overlay addresses.","commonSituations":"DNS returning the overlay IP for a management or relay hostname; a stale network map mixing overlay IPs into underlay candidates; user code grabbing the shared conn for application data.","solutions":["Ensure relay/management/peer hostnames resolve to underlay addresses, not overlay IPs","Do not reuse the mux's shared conn for application traffic","Check the configured network ranges for accidental overlap with the intended destination space","After fixing, verify WriteTo destinations sit outside both overlay prefixes"],"exampleFix":"// before\ntarget := resolve(\"relay.example.net\") // returned 100.96.4.7, an overlay IP\n_, err := sharedConn.WriteTo(pkt, target) // refused, 0 bytes\n\n// after\ntarget := resolveUnderlay(\"relay.example.net\") // public/underlay IP enforced\n_, err := sharedConn.WriteTo(pkt, target)","handlingStrategy":"validation","validationCode":"func isOverlayDestination(dst netip.Addr, v4, v6 netip.Prefix) bool {\n    dst = dst.Unmap()\n    return (v4.IsValid() && v4.Contains(dst)) || (v6.IsValid() && v6.Contains(dst))\n}\n\nif isOverlayDestination(udpAddr.AddrPort().Addr(), overlayV4, overlayV6) {\n    return fmt.Errorf(\"refusing overlay destination %s\", udpAddr)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Never dial overlay IPs over the shared underlay conn","Keep DNS for management and relay hostnames pointing at underlay addresses","Re-check network ranges whenever the overlay address space changes"],"tags":["go","netbird","routing-loop","udp","security"],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}