[GH-ISSUE #631] Periphery: Support IPv4 CIDR notation (allowed_ips = "100.64.0.0/10") #25272

New Issue

GiteaMirror · 2026-06-21T22:38:06-05:00

GiteaMirror commented

2026-06-21 22:38:06 -05:00

Originally created by @TheLinuxGuy on GitHub (Jun 27, 2025).
Original GitHub issue: https://github.com/moghtech/komodo/issues/631

Komodo does not support allowed_ips = ["100.64.0.0/10"] which would ensure that only Tailscale or Netbird VPN mesh traffic is permitted to access the periphery API.

Looks like only explicit IP addresses are a permitted configuration variable, this is problematic for Tailscale or NetBird because there is no such thing a static IP in their networks. The workaround is to allow the entire netblock that we know will be used by the VPN an no external public IP should be permitted to access the API.

The alternative to adding CIDR support could be that periphery agent only allows traffic on a specific ethernet interface (e.g: wt0 or tailscale0) but I think supporting IPv4 CIDR notation is a better and simpler solution....

root@gw:~# toml-validator /etc/komodo/periphery.config.toml
Reading file /etc/komodo/periphery.config.toml.
No problems found parsing file /etc/komodo/periphery.config.toml!
root@gw:~# sudo journalctl -u periphery.service -f
Jun 27 13:12:19 gw sh[4760]: failed at parsing config from paths: ParseFinalJsonError { e: Error("invalid IP address syntax", line: 1, column: 293) }
Jun 27 13:12:19 gw sh[4760]: note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
Jun 27 13:12:19 gw sh[4760]: Error: task 2 panicked with message "failed at parsing config from paths: ParseFinalJsonError { e: Error(\"invalid IP address syntax\", line: 1, column: 293) }"
Jun 27 13:12:19 gw systemd[1]: periphery.service: Main process exited, code=exited, status=1/FAILURE
Jun 27 13:12:19 gw systemd[1]: periphery.service: Failed with result 'exit-code'.
Jun 27 13:12:19 gw systemd[1]: periphery.service: Scheduled restart job, restart counter is at 5.
Jun 27 13:12:19 gw systemd[1]: Stopped periphery.service - Agent to connect with Komodo Core.
Jun 27 13:12:19 gw systemd[1]: periphery.service: Start request repeated too quickly.
Jun 27 13:12:19 gw systemd[1]: periphery.service: Failed with result 'exit-code'.
Jun 27 13:12:19 gw systemd[1]: Failed to start periphery.service - Agent to connect with Komodo Core.

Originally created by @TheLinuxGuy on GitHub (Jun 27, 2025). Original GitHub issue: https://github.com/moghtech/komodo/issues/631 Komodo does not support `allowed_ips = ["100.64.0.0/10"]` which would ensure that only Tailscale or Netbird VPN mesh traffic is permitted to access the periphery API. Looks like only explicit IP addresses are a permitted configuration variable, this is problematic for Tailscale or NetBird because there is no such thing a `static IP` in their networks. The workaround is to allow the entire netblock that we know will be used by the VPN an no external public IP should be permitted to access the API. The alternative to adding CIDR support could be that periphery agent only allows traffic on a specific ethernet interface (e.g: `wt0` or `tailscale0`) but I think supporting IPv4 CIDR notation is a better and simpler solution.... ``` root@gw:~# toml-validator /etc/komodo/periphery.config.toml Reading file /etc/komodo/periphery.config.toml. No problems found parsing file /etc/komodo/periphery.config.toml! root@gw:~# sudo journalctl -u periphery.service -f Jun 27 13:12:19 gw sh[4760]: failed at parsing config from paths: ParseFinalJsonError { e: Error("invalid IP address syntax", line: 1, column: 293) } Jun 27 13:12:19 gw sh[4760]: note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace Jun 27 13:12:19 gw sh[4760]: Error: task 2 panicked with message "failed at parsing config from paths: ParseFinalJsonError { e: Error(\"invalid IP address syntax\", line: 1, column: 293) }" Jun 27 13:12:19 gw systemd[1]: periphery.service: Main process exited, code=exited, status=1/FAILURE Jun 27 13:12:19 gw systemd[1]: periphery.service: Failed with result 'exit-code'. Jun 27 13:12:19 gw systemd[1]: periphery.service: Scheduled restart job, restart counter is at 5. Jun 27 13:12:19 gw systemd[1]: Stopped periphery.service - Agent to connect with Komodo Core. Jun 27 13:12:19 gw systemd[1]: periphery.service: Start request repeated too quickly. Jun 27 13:12:19 gw systemd[1]: periphery.service: Failed with result 'exit-code'. Jun 27 13:12:19 gw systemd[1]: Failed to start periphery.service - Agent to connect with Komodo Core. ```

GiteaMirror added the done label 2026-06-21 22:38:06 -05:00

GiteaMirror closed this issue

2026-06-21 22:38:12 -05:00

GiteaMirror commented

2026-06-21 22:38:14 -05:00

@mbecker20 commented on GitHub (Aug 28, 2025):

Thanks @bpbradley

@mbecker20 commented on GitHub (Aug 28, 2025): Thanks @bpbradley

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/komodo#25272