The e2b sandbox cannot access external networks when building templates

[baowj-678]

I have deployed e2b infrastructure on my local server, including API, orchestrator, and client-proxy. However, I encountered an error when building the template in this environment.
The e2b sandbox cannot access DNS, but it can be accessed on the host machine.
When capturing packets using netns, it was found that packets could be captured on tap0, but not on eth0.

capturing packets results:

[🤗L40S] ➜  ~ ip netns exec ns-10 tcpdump -i tap0 -n host 10.40.8.8 and port 53
ERROR: ld.so: object '/usr/local/lib/anti_lpe.so' from /etc/ld.so.preload cannot be preloaded (cannot open shared object file): ignored.
libibverbs: Warning: couldn't open config directory '/etc/libibverbs.d'.
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on tap0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
15:10:40.174075 IP 169.254.0.21.42729 > 10.40.8.8.53: 26356+ A? deb.debian.org. (32)
15:10:40.174151 IP 169.254.0.21.42729 > 10.40.8.8.53: 50926+ AAAA? deb.debian.org. (32)
15:10:45.179897 IP 169.254.0.21.53732 > 10.40.8.8.53: 42462+ SRV? _http._tcp.deb.debian.org. (43)
15:10:50.185139 IP 169.254.0.21.53732 > 10.40.8.8.53: 42462+ SRV? _http._tcp.deb.debian.org. (43)
15:10:55.190843 IP 169.254.0.21.32826 > 10.40.8.8.53: 34241+ A? deb.debian.org. (32)
15:10:55.190850 IP 169.254.0.21.32826 > 10.40.8.8.53: 7878+ AAAA? deb.debian.org. (32)
15:11:00.195992 IP 169.254.0.21.32826 > 10.40.8.8.53: 34241+ A? deb.debian.org. (32)
15:11:00.196075 IP 169.254.0.21.32826 > 10.40.8.8.53: 7878+ AAAA? deb.debian.org. (32)
15:11:05.201572 IP 169.254.0.21.57720 > 10.40.8.8.53: 60761+ SRV? _http._tcp.deb.debian.org. (43)
15:11:10.206395 IP 169.254.0.21.57720 > 10.40.8.8.53: 60761+ SRV? _http._tcp.deb.debian.org. (43)
15:11:15.211914 IP 169.254.0.21.56462 > 10.40.8.8.53: 34687+ A? deb.debian.org. (32)
15:11:15.211921 IP 169.254.0.21.56462 > 10.40.8.8.53: 44646+ AAAA? deb.debian.org. (32)
15:11:20.217002 IP 169.254.0.21.56462 > 10.40.8.8.53: 34687+ A? deb.debian.org. (32)


[🤗L40S] ➜  packages git:(35f581400) ✗ ip netns exec ns-10 tcpdump -i eth0 -n host 10.40.8.8 and port 53
ERROR: ld.so: object '/usr/local/lib/anti_lpe.so' from /etc/ld.so.preload cannot be preloaded (cannot open shared object file): ignored.
libibverbs: Warning: couldn't open config directory '/etc/libibverbs.d'.
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
^C
0 packets captured
0 packets received by filter
0 packets dropped by kernel

e2b log:

2026-02-28T16:04:14.395+0800  DEBUG  W: Failed to fetch http://deb.debian.org/debian/dists/bookworm/InRelease  Temporary failure resolving 'deb.debian.org'  {"service": "build-template", "internal": true, "pid": 1432058, "envID": "local-template", "buildID": "7cd46e3b-482f-4964-8e9c-455e2cb88300", "phase": "base", "step_type": "base", "step_number": null, "step": "base"}
2026-02-28T16:04:14.396+0800  INFO  [external] W: Failed to fetch http://deb.debian.org/debian/dists/bookworm-updates/InRelease  Temporary failure resolving 'deb.debian.org  {"service": "build-template", "internal": true, "pid": 1432058, "sandbox.id": "bnjvha2aotil4ilxug360", "template.id": "local-template", "team.id": "", "instanceID": "bnjvha2aotil4ilxug360", "envID": "local-template"}
2026-02-28T16:04:14.396+0800  DEBUG  W: Failed to fetch http://deb.debian.org/debian/dists/bookworm-updates/InRelease  Temporary failure resolving 'deb.debian.org'  {"service": "build-template", "internal": true, "pid": 1432058, "envID": "local-template", "buildID": "7cd46e3b-482f-4964-8e9c-455e2cb88300", "phase": "base", "step_type": "base", "step_number": null, "step": "base"}
2026-02-28T16:04:14.397+0800  INFO  [external] W: Failed to fetch http://deb.debian.org/debian-security/dists/bookworm-security/InRelease  Temporary failure resolving 'deb.  {"service": "build-template", "internal": true, "pid": 1432058, "sandbox.id": "bnjvha2aotil4ilxug360", "template.id": "local-template", "team.id": "", "instanceID": "bnjvha2aotil4ilxug360", "envID": "local-template"}
2026-02-28T16:04:14.397+0800  DEBUG  W: Failed to fetch http://deb.debian.org/debian-security/dists/bookworm-security/InRelease  Temporary failure resolving 'deb.debian.org'  {"service": "build-template", "internal": true, "pid": 1432058, "envID": "local-template", "buildID": "7cd46e3b-482f-4964-8e9c-455e2cb88300", "phase": "base", "step_type": "base", "step_number": null, "step": "base"}
  {"service": "build-template", "internal": true, "pid": 1432058, "sandbox.id": "bnjvha2aotil4ilxug360", "template.id": "local-template", "team.id": "", "instanceID": "bnjvha2aotil4ilxug360", "envID": "local-template"}

other network info:

[🤗L40S] ➜  ~ ip netns exec ns-10 sysctl net.ipv4.ip_forward

net.ipv4.ip_forward = 1
[🤗L40S] ➜  ~ ip netns exec ns-10 ip route
default via 10.12.0.20 dev eth0 
10.12.0.20/31 dev eth0 proto kernel scope link src 10.12.0.21 
169.254.0.20/30 dev tap0 proto kernel scope link src 169.254.0.22 linkdown 
[🤗L40S] ➜  ~ ip netns exec ns-10 iptables -t nat -L -v -n
Chain PREROUTING (policy ACCEPT 2 packets, 1822 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 DNAT       0    --  eth0   *       0.0.0.0/0            10.11.0.10           to:169.254.0.21

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 SNAT       0    --  *      eth0    169.254.0.21         0.0.0.0/0            to:10.11.0.10

root@host-node10-166-192-142:~# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: eth0@if214: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default 
    link/ether d6:8b:d9:30:24:bf brd ff:ff:ff:ff:ff:ff link-netnsid 0
    inet 10.12.0.21/31 scope global eth0
       valid_lft forever preferred_lft forever
    inet6 fe80::d48b:d9ff:fe30:24bf/64 scope link 
       valid_lft forever preferred_lft forever
4: tap0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 62:38:4f:a5:86:5d brd ff:ff:ff:ff:ff:ff
    inet 169.254.0.22/30 brd 169.254.0.23 scope global tap0
       valid_lft forever preferred_lft forever
    inet 169.254.0.21/32 scope global tap0
       valid_lft forever preferred_lft forever
    inet6 fe80::6038:4fff:fea5:865d/64 scope link 
       valid_lft forever preferred_lft forever

[linear]

ENG-3554

[baowj-678]

e2b is blocking traffic in the 10.0.0.0 network segment in nftables.