systemd 259) due to cgroup v2, iptables-nft, and FIB issues #1281

New issue

Open

opened 2026-10-13 20:39:23 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-13 20:39:23 +00:00

Owner

Originally created by @Geo2005 on GitHub (Jul 5, 2026).
Original GitHub issue: https://github.com/amnezia-vpn/amnezia-client/issues/2804

Description:
After upgrading to a modern Linux distribution (Ubuntu 26.04 LTS base, Kernel 7.0.0, systemd 259), AmneziaVPN gets stuck in an infinite "Connecting..." loop. The UI spinner never stops, and the handshake never completes.
An analysis of the daemon logs (journalctl -u AmneziaVPN.service -f) reveals that the Linux networking stack has evolved (shift to unified cgroup v2, strict iptables-nft backend, and changes in systemd-resolved DBus APIs). The current Amnezia LinuxFirewall and LinuxRouteMonitor implementations fail silently or throw warnings that break the connection state.

System Information
=== OS ===
PRETTY_NAME="Ubuntu 26.04 LTS"
=== Kernel & Arch ===
7.0.0-27-generic
x86_64
=== Systemd ===
systemd 259 (259.5-0ubuntu3)
=== iptables ===
iptables v1.8.11 (nf_tables)
=== cgroup type ===
cgroup2fs
=== Amnezia Package ===
Not found via dpkg (using portable/AppImage/GitHub binary)

Relevant Logs & Root Cause Analysis
Here are the exact failure points observed in the daemon logs:

Split Tunneling fails on cgroup v2
Modern systems use unified cgroup v2 (cgroup2fs) by default. The net_cls controller from cgroup v1 no longer exists as a mountable directory.
text
123
Proposed Fix: In LinuxFirewall, add a check for /sys/fs/cgroup/cgroup.controllers or mount type. If cgroup v2 is detected, gracefully bypass the net_cls setup or fallback to eBPF (cgroup-bpf) for socket marking. Alternatively, hide/disable the Split Tunneling toggle in the Qt UI if cgroup v1 is absent to prevent daemon crashes.
iptables-nft strict chain creation
Ubuntu 26.04 uses iptables-nft instead of iptables-legacy. The nftables backend strictly requires custom chains to be created (-N) before appending (-A) or checking (-C) rules.
text
12
Proposed Fix: Update the firewall initialization script in LinuxFirewall to explicitly create all custom chains (iptables -N 2>/dev/null) before applying the rule sets. Also, suppress errors during the teardown phase if a chain has already been deleted.
Routing Table Aliases (FIB Error)
The daemon relies on the string alias amnvpnrt in /etc/iproute2/rt_tables. On minimal/fresh installs, this file might be missing or the FIB cache isn't updated, causing ip route commands to fail.
text
12
Proposed Fix: In LinuxRouteMonitor, hardcode the numeric table ID (e.g., 200) instead of using the string alias amnvpnrt for all ip route and ip rule commands. This removes the dependency on user-space iproute2 configuration files.
CIDR Parsing Bug (/999999)
There is a parsing bug when reading AllowedIPs or exclusion routes, resulting in invalid CIDR prefixes being passed to Netlink.
text
12
Proposed Fix: Add string validation in the route parsing logic. If the prefix is empty or > 32 (for IPv4), default to /32 or drop the route silently instead of passing malformed data to the kernel.
DNS Manager Discovery (systemd 259)
The daemon fails to hook into the system DNS resolver.
text
1
Proposed Fix: Update DBus queries in DnsUtilsLinux to match modern systemd-resolved APIs (org.freedesktop.resolve1). Add a fallback mechanism to directly manage /etc/resolv.conf if DBus fails.

I hope this detailed breakdown helps the team update the Linux networking backend. Thank you for your great work on Amnezia! Let me know if you need me to test any PRs or beta builds on Ubuntu 26.04.

Originally created by @Geo2005 on GitHub (Jul 5, 2026). Original GitHub issue: https://github.com/amnezia-vpn/amnezia-client/issues/2804 Description: After upgrading to a modern Linux distribution (Ubuntu 26.04 LTS base, Kernel 7.0.0, systemd 259), AmneziaVPN gets stuck in an infinite "Connecting..." loop. The UI spinner never stops, and the handshake never completes. An analysis of the daemon logs (journalctl -u AmneziaVPN.service -f) reveals that the Linux networking stack has evolved (shift to unified cgroup v2, strict iptables-nft backend, and changes in systemd-resolved DBus APIs). The current Amnezia LinuxFirewall and LinuxRouteMonitor implementations fail silently or throw warnings that break the connection state. System Information === OS === PRETTY_NAME="Ubuntu 26.04 LTS" === Kernel & Arch === 7.0.0-27-generic x86_64 === Systemd === systemd 259 (259.5-0ubuntu3) === iptables === iptables v1.8.11 (nf_tables) === cgroup type === cgroup2fs === Amnezia Package === Not found via dpkg (using portable/AppImage/GitHub binary) Relevant Logs & Root Cause Analysis Here are the exact failure points observed in the daemon logs: 1. Split Tunneling fails on cgroup v2 Modern systems use unified cgroup v2 (cgroup2fs) by default. The net_cls controller from cgroup v1 no longer exists as a mountable directory. text 123 Proposed Fix: In LinuxFirewall, add a check for /sys/fs/cgroup/cgroup.controllers or mount type. If cgroup v2 is detected, gracefully bypass the net_cls setup or fallback to eBPF (cgroup-bpf) for socket marking. Alternatively, hide/disable the Split Tunneling toggle in the Qt UI if cgroup v1 is absent to prevent daemon crashes. 2. iptables-nft strict chain creation Ubuntu 26.04 uses iptables-nft instead of iptables-legacy. The nftables backend strictly requires custom chains to be created (-N) before appending (-A) or checking (-C) rules. text 12 Proposed Fix: Update the firewall initialization script in LinuxFirewall to explicitly create all custom chains (iptables -N <chain> 2>/dev/null) before applying the rule sets. Also, suppress errors during the teardown phase if a chain has already been deleted. 3. Routing Table Aliases (FIB Error) The daemon relies on the string alias amnvpnrt in /etc/iproute2/rt_tables. On minimal/fresh installs, this file might be missing or the FIB cache isn't updated, causing ip route commands to fail. text 12 Proposed Fix: In LinuxRouteMonitor, hardcode the numeric table ID (e.g., 200) instead of using the string alias amnvpnrt for all ip route and ip rule commands. This removes the dependency on user-space iproute2 configuration files. 4. CIDR Parsing Bug (/999999) There is a parsing bug when reading AllowedIPs or exclusion routes, resulting in invalid CIDR prefixes being passed to Netlink. text 12 Proposed Fix: Add string validation in the route parsing logic. If the prefix is empty or > 32 (for IPv4), default to /32 or drop the route silently instead of passing malformed data to the kernel. 5. DNS Manager Discovery (systemd 259) The daemon fails to hook into the system DNS resolver. text 1 Proposed Fix: Update DBus queries in DnsUtilsLinux to match modern systemd-resolved APIs (org.freedesktop.resolve1). Add a fallback mechanism to directly manage /etc/resolv.conf if DBus fails. I hope this detailed breakdown helps the team update the Linux networking backend. Thank you for your great work on Amnezia! Let me know if you need me to test any PRs or beta builds on Ubuntu 26.04.

No labels

pull-request

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

amnezia-vpn/amnezia-client#1281

No description provided.

Rows
Columns