3.18.2 - allowlist not persistent after reboot

[raffi78]

cat /etc/debian_version

11.9

nordvpn --version

NordVPN Version 3.18.2

1. set lan discovery to ON
2. Kill Switch ON

After reboot:
persistence OK ->ping to another OK

1. set lan discovery to OFF
2. Kill Switch ON
3. set Allowlist 192.168.1.0/24 -> ping to another OK

After reboot:

1. ping to another KO
2. Kill Switch ON
3. allowlist remove all
4. set Allowlist 192.168.1.0/24 -> ping to another KO
5. allowlist remove all
6. set lan discovery to ON -> ping to another KO
7. restart nordvpnd.service -> ping to another OK
8. set lan discovery to OFF -> ping to another KO
9. set Allowlist 192.168.1.0/24 -> ping to another OK

After reboot:

ping to another KO.

Conclusion: sniff

[ph202107]

I seem to have the same issue after wake from suspend. Adding a private subnet to the allowlist works fine until the computer sleeps, but I cannot ping other LAN devices after wake. Lan-discovery works fine so I am using that instead. Linux Mint 21.3, NordVPN 3.18.2.

[mariusSincovici]

Hi,
thanks for your feedback. we'll have a look over it and try to reproduce it.

[mariusSincovici]

We've reproduced it on our side and registered a bug for it. It will be fixed in the upcoming release.
Until then, could you try to see if LAN discovery works fine for you too?

[raffi78]

hi,
i comfirm the LAN discovery works fine

[mariusSincovici]

hi, @raffi78
3.18.3 was released with a possible fix for this. Could you give it a try and let us know if it works for you?

[raffi78]

hi, @raffi78 3.18.3 was released with a possible fix for this. Could you give it a try and let us know if it works for you?

hello
ok i'll try
thx

[raffi78]

hello, I'd like to introduce a new event in this testing: docker

root@nas:~# nordvpn version
NordVPN Version 3.18.3

root@nas:~# docker version
Client: Docker Engine - Community
Version: 27.1.1
API version: 1.46
Go version: go1.21.12
Git commit: 6312585
Built: Tue Jul 23 19:57:29 2024
OS/Arch: linux/amd64
Context: default

Server: Docker Engine - Community
Engine:
Version: 27.1.1
API version: 1.46 (minimum version 1.24)
Go version: go1.21.12
Git commit: cc13f95
Built: Tue Jul 23 19:57:29 2024
OS/Arch: linux/amd64
Experimental: false
containerd:
Version: 1.7.19
GitCommit: 2bf793ef6dc9a18e00cb12efb64355c2c9d5eb41
runc:
Version: 1.7.19
GitCommit: v1.1.13-0-g58aa920
docker-init:
Version: 0.19.0
GitCommit: de40ad0

i start testing with this parameters of nordvpn

root@nas:~# nordvpn settings
Technology: NORDLYNX
Firewall: enabled
Firewall Mark: 0xe1f1
Routing: enabled
Analytics: enabled
Kill Switch: enabled
Threat Protection Lite: disabled
Notify: disabled
Tray: enabled
Auto-connect: enabled
IPv6: disabled
Meshnet: disabled
DNS: disabled
LAN Discovery: enabled
Virtual Location: enabled

and docker service on startup false.

1. nordpvn set lan discovery to OFF
2. nordvpn allowlist add subnet 192.1681.1.0/24 -> ping to another OK, but another services on subnet 192.168.1.xxx it's unreacheable (port 80, 9001, 22)

After reboot:

root@nas:~# systemctl status docker
● docker.service - Docker Application Container Engine
Loaded: loaded (/lib/systemd/system/docker.service; disabled; vendor preset: enabled)
Drop-In: /etc/systemd/system/docker.service.d
└─waitAllMounts.conf
Active: inactive (dead)
TriggeredBy: ● docker.socket
Docs: https://docs.docker.com

root@nas:~# nordvpn settings
Technology: NORDLYNX
Firewall: enabled
Firewall Mark: 0xe1f1
Routing: enabled
Analytics: enabled
Kill Switch: enabled
Threat Protection Lite: disabled
Notify: disabled
Tray: enabled
Auto-connect: enabled
IPv6: disabled
Meshnet: disabled
DNS: disabled
LAN Discovery: disabled
Virtual Location: enabled
Allowlisted subnets:
192.168.1.0/24

persistence OK ->ping to another OK, another services on subnet 192.168.1.xxx all it's OK (port 80, 22)

1. systemctl start docker -> ping to another OK, but all services on the subnet 192.168.1.xxx it's KO (port 80, 9001, 22)
2. nordvpn d -> ping to another OK, all services on the subnet 192.168.1.xxx it's OK (port 80, 9001, 22)
3. nordvpn c -> ping to another OK, but all services on the subnet 192.168.1.xxx it's KO (port 80, 9001, 22)
4. systemctl stop docker -> ping to another OK, but all services on the subnet 192.168.1.xxx it's KO (port 80, 9001, 22)
5. nordvpn d -> ping to another OK, all services on the subnet 192.168.1.xxx it's OK (port 80, 9001, 22)
6. nordvpn c -> ping to another OK, but all services on the subnet 192.168.1.xxx it's KO (port 80, 9001, 22)
7. systemctl start docker -> ping to another OK, but all services on the subnet 192.168.1.xxx it's KO (port 80, 9001, 22)
8. nordvpn d -> ping to another OK, all services on the subnet 192.168.1.xxx it's OK (port 80, 9001, 22)
9. nordvpn allowlist remove all
10. nordvpn set lan-discovery on -> ping to another OK, all services on the subnet 192.168.1.xxx it's OK (port 80, 9001, 22)

After reboot:

persistence OK ->ping to another OK, another services on subnet 192.168.1.xxx all it's OK (port 80, 22)
systemctl start docker -> ping to another OK, all services on the subnet 192.168.1.xxx it's OK (port 80, 9001, 22)

What's wrong allowlist with docker ?

[mariusSincovici]

Hi,
There was another ticket reported for allowlist and VM, #512.
I think it might be related to what you're experiencing with your VM.

[raffi78]

Hi, There was another ticket reported for allowlist and VM, #512. I think it might be related to what you're experiencing with your VM.

thx for the job

[mariusSincovici]

@raffi78 Could you please try with the latest version 3.18.4?

[mariusSincovici]

Closing it for now. If there are still issues please reopen it.
Thanks.