tunnels

Added in v1.9.6

tunnels configures tunnel lifecycle management, allowing Nebula to automatically drop tunnels that have been inactive for a period of time.

tunnels:
  drop_inactive: false
  inactivity_timeout: 10m

tunnels.drop_inactive

Reloadable Default: false

Controls whether inactive tunnels are maintained or dropped after the inactivity_timeout period has elapsed. In general, it is a good idea to enable this setting. It will be enabled by default in a future release.

tunnels.inactivity_timeout

Reloadable Default: 10m

Controls how long a tunnel must not see any inbound or outbound traffic before being considered inactive and eligible to be dropped. Only applies when tunnels.drop_inactive is enabled.

Automatic rekeying

Nebula rehandshakes a tunnel, which gives it new keys, after it has sent 2³⁴ (about 17 billion) packets. This keeps every tunnel well inside the safe usage limits of its cipher, and needs no configuration. If a tunnel somehow reaches its hard limit before the new handshake completes, Nebula stops sending on it, counts the dropped packets in the messages.tx.exhausted metric, and removes the tunnel with the log line Dropping tunnel, message counter is exhausted.