Nebula vs Expo

Nebula is a peer-to-peer mesh VPN built around a certificate authority model. v1.10.0 was the pivot — IPv6 and multiple addresses in the overlay, plus a v2 ASN.1 certificate format with a unified interface for external implementations — and everything since has been consequence management. v1.11.0 shifted to the operational surface with structured slog logging, corrected firewall reject-versus-drop semantics, and Windows WFP filters by default. v1.11.1 returns to the packet classifier: IPv6 packets whose next header Nebula does not parse were being misread as TCP or UDP and matched against TCP/UDP firewall rules, and are now classified as their true protocol with no ports.

The security findings since v1.10.0 map onto the same seam — the IPv6 support that release added widened what the classifier and the certificate validator have to handle, and each subsequent release has closed another gap in that widened surface. v1.11.1 is notable for making the fix a deliberate operational break: carrying SCTP, GRE or IP-in-IP over the overlay may have been working only through the bypass, so operators must add a proto: any rule before upgrading. That the project chose correct classification over compatibility, and said so plainly in the notes, is consistent with how the firewall direction fix was handled one release earlier.

The stated plan to assert low-s signature form when validating certificates remains the concrete next step visible in these entries; expect it as a breaking validation change. The classifier work suggests remaining IPv6 extension-header handling is the other likely source of findings.