nebula-multicast

Fork of the Nebula CLI that forwards multicast traffic seen on the Nebula interface to selected Nebula peers as unicast packets. This is intended for service discovery protocols that rely on multicast.

Multicast Configuration

Add a multicast section to your normal Nebula config.

multicast:
  enabled: true
  groups:
    - discovery

groups are Nebula certificate groups. When this node sees an outbound multicast packet on the Nebula interface, it forwards a unicast copy to every currently known Nebula host whose certificate includes one of the configured groups.

Keys

multicast.enabled : Enables multicast forwarding. Defaults to true when any multicast group/tag key is configured, otherwise false.

multicast.groups : List of Nebula certificate groups to receive forwarded multicast packets.

multicast.group : Single-group shorthand for multicast.groups.

multicast.tags : Alias for multicast.groups.

multicast.tag : Alias for multicast.group.

At least one group/tag must be set when multicast.enabled is true.

Examples

Forward multicast traffic to hosts in the discovery group:

multicast:
  group: discovery

Forward multicast traffic to hosts in either discovery or printers:

multicast:
  groups:
    - discovery
    - printers

Using the tag aliases:

multicast:
  tags:
    - discovery

Behavior

• IPv4 and IPv6 multicast destination packets are intercepted from the local Nebula interface.
• The original multicast packet is not sent through Nebula.
• A cloned packet is created per matching peer, with the destination rewritten to that peer's Nebula VPN address.
• Checksums are recalculated for IPv4, IPv6, UDP, TCP, ICMP, and ICMPv6 where applicable.
• Matching peers must already be known in Nebula's hostmap. Normal Nebula discovery and tunnel establishment still apply.
• Enabling multicast disables Nebula multiqueue use for the wrapped interface.

Limitations

• IPv6 fragment headers are not forwarded because the full upper-layer payload may not be available for correct checksum recalculation.
• IPv6 Hop-by-Hop Options, Routing, Destination Options, and AH extension headers are skipped when locating the transport header.
• This feature forwards multicast as unicast fan-out; it does not create a true multicast overlay.