tunnels

Added in v1.9.6

tunnels configures tunnel lifecycle management, allowing Nebula to automatically drop tunnels that have been inactive for a period of time.

tunnels:
  drop_inactive: false
  inactivity_timeout: 10m

tunnels.drop_inactive

Reloadable Default: false

Controls whether inactive tunnels are maintained or dropped after the inactivity_timeout period has elapsed. In general, it is a good idea to enable this setting. It will be enabled by default in a future release.

tunnels.inactivity_timeout

Reloadable Default: 10m

Controls how long a tunnel must not see any inbound or outbound traffic before being considered inactive and eligible to be dropped. Only applies when tunnels.drop_inactive is enabled.

Automatic rekeying

A tunnel is rehandshaked with new keys after sending 2³⁴ (about 17 billion) packets, which keeps it well inside the safe usage limits of its cipher. No configuration is needed. A tunnel that reaches its hard limit before the new handshake completes is removed with the log line Dropping tunnel, message counter is exhausted, and the dropped packets are counted in the messages.tx.exhausted metric when stats.message_metrics is enabled.