Odd default gateway 25.255.255.254 added during installation on Windws (1.10.5 / 1.12.0)

Boilerplate4U · August 24, 2023, 1:24pm

It appears that this old issue has resurfaced (or hasn’t been resolved) where the installation adds a very odd default gateway on Windows, as shown below. According to whatismyipaddress.com, the IP address 25.255.255.254 belongs to the ISP 'UK Ministry of Defence (!).

Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0   25.255.255.254    10.147.10.173  10034

I have recently performed 3 new installations with ZT version 1.10.5 on Windows 10, all experiencing the same problem. Linux works fine, meaning it doesn’t add this IP address.

Question: Is there a way to get rid of this, or do I have to add a blackhole route to avoid routing to 25.255.255.254?

github.com/zerotier/ZeroTierOne

Big Windows adapter issues thread!

opened 04:36AM - 27 Feb 15 UTC

closed 03:49PM - 03 Aug 15 UTC

SharkyRawr

Type: Bug

Hi there, I keep having weird connectivity issues while running zerotier on Wind…ows. Sometimes websites wouldn't load or connections would be dropped at random (especially noticeable with instant messengers). Other times copying files in my local LAN would slow to a crawling 10mbit/s, the same bitrate as the zerotier adapter, while everything is connected with gigabit ethernet and I usually max out at ~800mbit/s. As far as I can tell, those anomalies happen because the ZeroTier adapter has a default gateway set: _25.255.255.254_ If I stop the ZeroTier service my problems go away and if I restart the service the problems will reoccur after a seemingly random length of time, could be anytime from a few minutes to a few days. My ZeroTier network runs on 10.251.251.0/24 and I'm not sure what the point of the gateway on a completely different and unreachable subnet is. My ZeroTier network configuration is as follows: - Access Control: [x] Private Network - Frame Types Allowed: [x] IPv4 - Have ZeroTier Assign IPv4 Addresses: 10.251.251.0/24 - Multicast Limit: 32 - Broadcast: [x] Enable Wildcard MAC My next step would be to see if I can host my own DHCP server to serve IP's to my ZeroTier network, without a gateway set. These problems have been around for as long as I can remember but I dismissed them as harmless bugs, at this point I've grown rather dependent on ZeroTier VPN and the connectivity issues are becoming major annoyances. Based on my observations running version 1.0.1.

Boilerplate4U · August 24, 2023, 3:37pm

Same problem goes with v1.12.0. A temporary workaround is simply to delete the erroneous route manually:

C:\> route delete 0.0.0.0 mask 0.0.0.0 25.255.255.254

zt-grant · August 24, 2023, 3:39pm

This is by design and not a bug. It’s a workaround that allows windows firewall to detect the interface. Without it, the interface is ignored by Windows Firewall.

You don’t have to do anything. Traffic won’t actually route there.

See the code & comments here:

github.com

zerotier/ZeroTierOne/blob/ffb63f3ee5616b069ab453427f4f62701b8ed802/osdep/WindowsEthernetTap.cpp#L1008


      
          			}
          
          			{
          				uint32_t tmpi = 1;
          				DWORD bytesReturned = 0;
          				DeviceIoControl(_tap,TAP_WIN_IOCTL_SET_MEDIA_STATUS,&tmpi,sizeof(tmpi),&tmpi,sizeof(tmpi),&bytesReturned,NULL);
          			}
          
          #ifdef ZT_WINDOWS_CREATE_FAKE_DEFAULT_ROUTE
          			{
          				/* This inserts a fake default route and a fake ARP entry, forcing
          				 * Windows to detect this as a "real" network and apply proper
          				 * firewall rules.
          				 *
          				 * This hack is completely stupid, but Windows made me do it
          				 * by being broken and insane.
          				 *
          				 * Background: Windows tries to detect its network location by
          				 * matching it to the ARP address of the default route. Networks
          				 * without default routes are "unidentified networks" and cannot
          				 * have their firewall classification changed by the user (easily).

Boilerplate4U · August 24, 2023, 3:51pm

Okay, I see. Have you tried binding the interface to a network profile using the Network::GetCategory (i.e. Network List Manager API and pals) and initially setting it to public?

Normally there is a class called “unidentified networks” that defaults to “public”.

Computer Policy → Windows Settings → Security Settings → Network List Manager Policies

zt-grant · August 24, 2023, 3:53pm

Can’t say we have. We’re open to pull requests though.

Boilerplate4U · August 24, 2023, 3:58pm

I’ll look into it (no promises though).

system · September 23, 2023, 3:59pm

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.