🐛 BUG: wintun driver upgrade removes adapters from other wintun-based products

[SOglf]

What version of nebula are you using? (nebula -version)

latest

What operating system are you using?

Windows

Describe the Bug

WARNING for those who think a preproduction tests went OK in windows environment:

There is a bug in wintun driver, which causes ALL EXISTING WINTUN INSTANCES to be DELETED, all routes, all interface setting, names, FW settings.

At least add a warning, that this may happen

Logs from affected hosts

Config files from affected hosts

[JackDoan]

Hi @SOglf

This is troubling news. Are you able to provide more details (exact steps would be best) so we can try to reproduce?

[SOglf]

Hello @JackDoan

This is a known issue with wintun driver. Because wintun creator has some problems with openvpn guys, openvpn uses an old wintun 0.8.x
The new wintun driver 0.14, when loading/creating an interface, DELETES all "older" wintun instances.

I tried to bypass this in overlay/tun_windows.go, just attaching to an existing interface, but it seems it's impossible to block the interface removal.

One dirty hack is to change windows interface HWID from "wintun" to any other name like "wintun_do_not_delete" for older wintun driver interfaces (and it works).
The issue is described here: https://gitlab.com/openconnect/openconnect/-/work_items/699

[nbrownus]

This is a known issue with wintun and the solution is to have your other wintun based products reassert their device config or have them upgrade their version of wintun.

[SOglf]

A BATCH coded by a dumb LLM (careful), to check and change HWID based on an interface name prefix:
Run just before starting nebula to make sure no important wintuns (with proper names set earlier!) are blown up. Works in at least one case.

setlocal enabledelayedexpansion

:: ==========================================
:: CONFIGURATION: Set your target interface name prefix here
:: ==========================================
set "TargetPrefix=otunnel"


:: 1. FORCE ELEVATION (The script must run with true Administrator rights to write to HKLM)
openfiles >nul 2>&1
if %errorlevel% neq 0 (
    echo [!] ERROR: This script must be run as an Administrator.
    echo [!] Right-click this file and select "Run as administrator".
    pause
    exit /b
)

echo [*] Initializing Hardware ID Sandbox Patch...
echo [*] Target interface prefix set to: %TargetPrefix%
echo [*] Scanning Windows Network Connections for custom names...
echo -------------------------------------------------------------------------

:: 2. SCAN ENGINE STEP A: Loop through Windows Network Connection Profiles to find your custom name
set "NetKey=HKLM\SYSTEM\CurrentControlSet\Control\Network\{4d36e972-e325-11ce-bfc1-08002be10318}"

for /f "tokens=*" %%N in ('reg query "%NetKey%" 2^>nul ^| findstr /i /r "Control\\Network\\.*\\{.*}"') do (
    set "ConnKey=%%N\Connection"
    
    :: Check the "Name" property (This holds your custom "otunnel2" name string)
    reg query "!ConnKey!" /v "Name" >nul 2>&1
    if !errorlevel! equ 0 (
        for /f "tokens=2*" %%B in ('reg query "!ConnKey!" /v "Name" 2^>nul ^| findstr "Name"') do (
            set "FriendlyName=%%C"
            
            :: See if this user-defined connection name matches your prefix
            echo !FriendlyName! | findstr /i "^%TargetPrefix%" >nul
            if !errorlevel! equ 0 (
                
                :: Grab the unique PnP ID linking it back to the hardware device tree
                for /f "tokens=3" %%P in ('reg query "!ConnKey!" /v "PnpInstanceID" 2^>nul ^| findstr "PnpInstanceID"') do (
                    set "TargetPnpID=%%P"
                    
                    echo [+] MATCH FOUND: "!FriendlyName!" mapped to PnP ID: !TargetPnpID!
                    
                    :: Call Step B to patch the actual hardware entry
                    call :PatchHardwareID "!TargetPnpID!"
                )
            )
        )
    )
)

echo [*] Scan and patch process complete.
pause
exit /b


:: 3. SCAN ENGINE STEP B: Target the localized subkey inside ROOT\NET and patch it
:PatchHardwareID
set "PnpString=%~1"
:: Convert the PnP path syntax back to standard registry formatting
set "PnpString=!PnpString:\=\\!"
set "BaseKey=HKLM\SYSTEM\CurrentControlSet\Enum\ROOT\NET"

for /f "tokens=*" %%A in ('reg query "%BaseKey%" 2^>nul ^| findstr /i /r "ROOT\\NET\\[0-9]"') do (
    set "SubKey=%%A"
    
    :: Match the root network key to our specific target PnP ID
    echo !SubKey! | findstr /i "!PnpString!" >nul
    if !errorlevel! equ 0 (
        
        :: Read out the current hardware ID 
        for /f "tokens=2*" %%D in ('reg query "!SubKey!" /v "HardwareID" 2^>nul ^| findstr "HardwareID"') do (
            set "CurrentHWID=%%E"
            
            echo [ ] Target Registry Key: !SubKey!
            echo [ ] Current HardwareID: !CurrentHWID!
            
            :: INSTANT PARSE: Strip out all historical '_do_not_delete' strings instantly
            set "BaseHWID=!CurrentHWID!"
            set "BaseHWID=!BaseHWID:_do_not_delete=!"
            
            :: Clean any trailing underscores that might be left over from broken replacements
            if "!BaseHWID:~-1!"=="_" set "BaseHWID=!BaseHWID:~0,-1!"
            
            :: Run the write modifications with a deterministic single append
            reg add "!SubKey!" /v "HardwareID" /t REG_SZ /d "!BaseHWID!_do_not_delete" /f >nul
            if !errorlevel! equ 0 (
                echo [!] SUCCESS: Patched HardwareID to '!BaseHWID!_do_not_delete'
            ) else (
                echo [X] FAILED: Could not update the registry key values.
            )
            echo -------------------------------------------------------------------------
        )
    )
)