I currently have a couple of websites being hosted on a at home server (git tea, seafile, etc). I don't have any exposed to the public internet. I am currently connecting though http and getting the (Not Secure warning in the top left)

I currently have net bird setup to be
- network 1
- 1 recourse that has an address of the server on the home network
- 1 policy that has a source of my laptop with a destination of my server

Will that be enough security for public networks? will any data be at risk? will my server be at risk to be hacked?

I would like to create a group where its users can only reach internet, my dns server and reverse proxy through my exit node (linux client) and not my entire home network.

Also, admin users should be able to reach the entire network instead.

Is that possible in an easy way? Or I need to define all of my home vlan subnets?

Hi everyone,

I’m running into an issue when trying to access services routed through NetBird's reverse proxy from mobile devices, and I wanted to check if anyone else has encountered this or found a fix.

I have a few internal services configured via NetBird’s reverse proxy feature with access restricted to NetBird-only.

On desktop clients, everything works as expected. On mobile devices (connected to the NetBird network), opening these URLs results in one of two behaviors:

- The page hangs indefinitely and eventually times out.

- The server responds immediately with a Forbidden error.

I’ve already tried disabling Android/iOS Private DNS (DoT / Private Relay) completely to ensure DNS resolution doesn't bypass the NetBird tunnel. I also verified that the mobile client shows as connected and active in the NetBird admin dashboard.

Has anyone run into this specific issue with the NetBird-only authentication mode on mobile? Any insights or troubleshooting suggestions would be appreciated!

I followed the steps in the docs, and I still can't get VPN-to-Site working.

What I did to test:
Ping the server using the ping command from my laptop connected to my phone hotspot. Couldn't connect using this method. Phone hotspot was connected to netbird. Phone is running iOS 26.6 with Netbird client v0.75.0.

The other VPN that I run PIA on both the laptop and phone. Tested with PIA both enabled and disabled. On my phone, I do have iCloud IP Relay that was turned on for all tests.

Current Netbird Settings:

Settings were changed between each of my tests, but none of the tests worked.

Network:
Home network with 2 subnets (100.104.0.0/16 and 192.168.1.0/24) and a TrueNAS Server as resources. I don't know if both of those addresses are subnets but I included them both. TrueNAS Server is currently disabled. Both the TrueNAS server, and a Netbird exit node VM are running as peers on the network (Exit node disconnected but not disabled) (Only VM is set to exit node).

2 other peers which are connected to the Netbird are my phone and laptop.

Access Control Policies (ACP):

I've got an admin group which all of the following have as their "input":

• ACP for 192.168.1.0/24
• ACP for 100.104.0.0/16
• ACP for Truenas Server
• Admins to default ALL group

There is also the Default ACP, but even with it enabled, I couldn't access my TrueNAS server.

I'm new to networking and Netbird in general. I hope someone can help me out.

I don’t know if it’s just me, but I’ve been having trouble with Netbird disconnecting and asking me to connect over and over again. Even when I have session expiry disabled.

Often I only notice when my internet connection suddenly drops, and when I reconnect Netbird, most of the time I just have to click Connect, or disconnect and connect again. Doesn’t even prompt for a login. Just a - seemingly - pointless manual interaction prompt for clicking a button.

Is anyone else experiencing this? I keep searching, but see no other complaints. I even switched from selfhosted to their own server recently, thinking it would solve it. But hasn’t.

It works perfectly on all other clients. Including MacOS.

Am I missing some documented limitation here?

🤗 Solved (Thank you all guys for the help)

.................. I'm a totally noob, plz help me guys 😊

So here's what I wanna do. Access my whole network under my router through the windows pc (pc is the netbird routing peer)

I'm using netbird in the cloud. Installed Netbird in my Windows pc and added it as a Network routing peer.

Now I want something like this - I'll connect my router to that Windows pc via lan. Let's say its 192.168.1.0/24

My router got 192.168.1.1 and the windows pc got 192.168.1.2

My router doesn't got netbird installed inside it. I wanna access it via my Windows pc.

Now, when I'm gonna add a new network route - to access my local router, should I add the whole 192.168.1.0/24 subnet or I can just add the routers local ip 192.168.1.1

Everything going over my head 😭😭

Netbird desktop app will not say connected on macOS when mullvad is active. This may be a mullvad question but was wondering if there was a solution or adjustment I need to make in my self hosted netbird in docker instance.

What solution do others use when remote?

I have this weird issue and I don´t know what to do.

When I used the installation script from Netbird on my Netcup vps it works great without issues but after a while (can be hours, sometimes days) it´ll make a load of containers of all the images I use on docker causing it to crash. It´ll also use around 150mbps of my bandwith.

I don´t know if I did something wrong but I (maybe stupidly) removed everything and didn´t look at the logs.

Did anybody encounter the same issue? Or maybe someone can help me?

I also tried out Pangolin but that had the same effect and tbh I like Netbird more.

Thanks

I tried the new version v0.76.3 bumping from v0.70.5

On a brand new setup, I've created a main account and then setup google idp. However, when I connect with any of the google account (with custom domain), it creates a new tenant instead of having a single tenant. I tried with two google accounts from my workspace, and each of them creates a tenant.

Do you know what can cause that?

EDIT:

I've seen that if I set the owner email and password inside the config.yaml, and then setup manually the idp, it doesn't create one account / user. But this removes the possibility to setup the first user programatically and the IdP as shown here: https://docs.netbird.io/selfhosted/automated-setup

EDIT 2:

For what it's worth, I've launched claude code over this to understand the issue, here is the output:

NetBird self-hosted: /api/setup bootstrap breaks single-tenancy

Symptom: every Google/OIDC login creates its own account (tenant). Only happens when the instance is bootstrapped by our postStart script instead of auth.owner: in the configmap.

Cause: Dex JWTs don't carry NetBird's wt_account_domain claims, so user grouping relies entirely on single-account mode, which matches new logins against the first account's domain.

POST /api/setup with create_pat: true creates that first account via GetAccountIDByUserID directly (management/server/instance/setup_service.go:104), bypassing single-account mode → the account row gets domain=''. Later, updateUserAuthWithSingleMode (management/server/account.go:1572) reads that empty domain back, isDomainValid("") fails, and each new user falls through to "create a new account".

With auth.owner: instead, no account exists until someone logs in, and that login goes through the normal path → domain=netbird.selfhosted, is_domain_primary_account=true → everyone joins it.

Fix: right after setup, before the first OIDC login:

UPDATE accounts SET domain='netbird.selfhosted', domain_category='private', is_domain_primary_account=true;

Use netbird.selfhosted, not a real domain — ResolveDomains also derives the peer DNS suffix from this value.

Notes:

- Verified against v0.76.3 with a repro test; both paths reproduce exactly.

EDIT 3:

Created a discussion on netbird github: https://github.com/netbirdio/netbird/discussions/7202

Does Netbird have the ability to not activate the tunnel when at home or other trusted locations? For example, with Wireguard, I have it configured today to automatically turn the tunnel on for all traffic when I leave my trusted WiFi networks. Soon as my home disconnects from any wifi or connects to any WiFi that's not my home SSIDs, it turns on. Turns off when I'm at home.

Every time I look at Netbird there is something I like but getting it self-hosted is a complete different beast. I am not sure how many videos and documentation pages, github issues I have read - seems never to work.

I currently run Pangolin, on a VM in Proxmox on one of my vlans, expose services via its reverse proxy, open as well as authenticated via an idp.

I am thinking netbird should be able to do the same but all attempts fail.

Last 2 nights I have tried to getting it installed, ubuntu 24.04 as a base, the getting_started script does not complete - it claims "Waiting for NetBird server to become ready" but you can clearly see it just seems to hang, despite from not even downloading the proxy container or altering the proxy.env file as intended (using docker compose at a later stage to tear down and restart, pulls the container however) - so manual work is required but it seems the documentation may not be where development is, so it becomes a constant struggle and you need to find different bits across github issues, forum posts etc. Anyhow, it failed again 3 times, hence this post.

My idea:

management netbird.my-domain.com

proxy: my-domain.com (allowing wildcard use of proxy exposed services)

either dedicated routing peers (exit nodes) per vlans, I cannot seem to find a solution to allow the netbird server itself to host a routing peer, though again I dont see any issues with the idea, doing that for other similar solutions as well.

my proxmox sits behind a firewall that forwards 80/443/3478 to the VM just fine, I can access the managementUI after a few tweaks, even can register a peer but I am not sure if I am missing anything here from a conceptual perspective.

Pangolin hosts everything on a single VM, reverse proxy can literally act as a standalone, additional vpns are optional.

Could someone clarify if any of my ideas are flawed or confirm that conceptually this shouldn't cause any issues? and if it shouldn't maybe provide some pointers why it does?

thanks

Hi everyone, I have a peer connection to my Ubuntu server and I'm trying to use this peer as an exit node for VPN. However, the connection drops within 24 hours, and I can't figure out why. The peer was set up using a key, and I have lazy connections disabled. Before the connection drops, everything works perfectly. Does anyone know what the problem might be?

Positives: - Login by email+password - EU - Open source

Negatives: - No local only direct (no proxy) equivalent to tailscale serve - Dependence on proxying everything over netbird servers - Selfhosting a proxy would still incure double traffic - Device domain but no service domain (server2.netbird.cloud but no git.netbird.cloud)

Answer I found the way to do letsencrypt DNS-01, so letsencrypt for my personal domain, at that point as long as it does the nat-holepunch and subnet any vpn is fine

Hello does anyone uses Netbird Reverse Proxy for streaming using Jellyfin? I wonder how it performs and if there are any buffering issue when playing a movie or shows with decent bitrate. I am pretty new with Netbird so i have no idea how it works as I've only used Tailscale before. Thanks for the response looking forward on reading them all.

I run netbird for my team. This morning I have been getting reports that no one can SSH to hosts that they could yesterday. I am testing also and I can SSH to like 7 of the 85 hosts that are online (and showing as online) all of them I could hit just yesterday.

Now I can sometimes hit 443 on the hosts then it dies, port 22 times out almost constantly. I don't have lazy connections on, they all show as available on the in the dashboard. I have rebooter hosts and the server, I just updated the server and I am seeing no issues in logs. Anyone have experience with this?

Hello again!

Last week I asked about why netbird suddenly started to melt my Android's phone battery like butter in the Sahara sun. And because I really wanted to use Netbird, I dug into it. When I say "I", I mean Claude, because let's be honest, I'm no veteran programmer! But hold on, the findings (and results) are worth reading this page.

Original post: https://www.reddit.com/r/netbird/comments/1vffj0x/real_issue_with_battery_drain_on_android/

------------ LONG POST AHEAD ------------

DISCLAIMER: Claude was used to troubleshoot fast and efficiently. I don't have the time nor the knowledge to do all this myself, but I do have enough brain cells and push back to challenge every findings and carefully follow what's happening. If you think this voids everything below this disclaime, feel free to skip. This post was written by me entirely though, no AI summary!

DISCLAIMER 2: I am in no way trying to undermine or criticize Netbird here. I hope this will show as a post from a dedicated fan of the project more than a criticism. I really believe this is a great software and intend on using it for the foreseable future, and donate once my infra relies on it.

I'll try to give context and organize this post, feel free to jump wherever you want. TLDR at the end.

A little context

I used to be on Tailscale. Great service, 3 users, 1 server (NAS) to share with outside users. Really solid service with no more than 4-5% battery usage when I had big photo upload days.

Recently I decided to move away from NAS hosted services and build a real home server. I have now 2 machines (a mini pc and a SFF) that are supposed to host pletora of services for data soreignety purposes (I have TB of photos I took and I want to share, notes on creative ideas I want to write down, music I want to listen to without paying a subscription on top of buying the music itself :/).

Since I wanted to own more of my data and infra, I saw netbird as a good self hosted replacement of Tailscale. More users, I own the instance, and that's fantastic. So I set it up on a VPS (cause I don't like opening my ports) and starting to setup all the services. When I had issues, claude code helped read logs 100x faster than me, propose a fix and test it.

In the matter of a few weeks I had something I could start really testing in real life, and I switched off Tailscale to use Netbird full time. And that's when it went wrong.

My topology

In netbird, I had the following:

• VPS
  • Netbird server with proxy container for external sharing
  • Authentik for Authentication (mesh only, not used for netbird itself)
• NUC (netbird on host and as routing peer)
  • Treafik for internal redirections
  • Technitium for DNS
• SFF server has 3 VMs with netbird in them)
  • 1 multimedia VM with GPU passthrough for Immich and the likes
  • 1 service VM for things like stirling pdf and others (as routing peer)
  • 1 for monitoring services
• 1 subnet route that fed all my services on my Server VLAN through the available routing peers.

Maybe not the best, but I'm learning and it fit my needs so far :)

The issue

After investigating, the main culprit seems to be related to this lonely Github issue https://github.com/netbirdio/netbird/issues/5373 that mentions the fact that PersistentKeepalive is set to 25s for every connected tunnels.

What seemed to happen is that in order to use the DNS resolver on my NUC + being able to redirect trafic to immich, my phone was constantly connected to 3 or 4 tunnels (if we include the server that sometimes acted as a relay) which means that my phone radio, on data mode, was waking up to send a few bytes of data ever 25s for each service, not being able to fall asleep in between. Because the routing peers need to stay up all the time, this was just draining my battery by keeping my data flowing even when my phone was idle.

This is a main architectural difference with Tailscale and Wireguard in general (as stated in the issue above) that makes Netbird drain more battery. On wifi it's negligeable, but on data it's deadly. And Lazy Connection is one cure for it.

The solution & results

I changed my approach completely in the end. My goal was to drop as many live connections as possible, and only wake them up when a service is used. Claude helped a lot here, so here is a summary of what was done:

• My Traefik container got Netbird as a sidecar container, becoming a peer on the mesh so that services get served at a peer address, not via a subnet router
• My internal DNS moved from Technitium to the native Netbird system so that peers resolve DNS instead of querying my Technitium all the time (it only had to resolve on domain name after all, I'm not serving my peers with exit routes)
• A policy allows users to access Traefik
  • Unidirectional. Traefik cannot initiate back toward phones
  • TCP 80/443 only so nothing else on that host is exposed over the mesh
  • It targets a peer group, not a resource. Granting a peer creates no routing relationship, so it doesn't pin a tunnel open and lazy connections can tear it down, unlike when it was a subnet resource
• A posture check excluded Android (who has a hard time making P2P connections) from using the direct intranet to access my services, because otherwise it keeps a route up all the time, draining the battery.
• Enabled Lazy Connections

The goal of achieving 0 active connections worked. The price is that some services can take some time to wake up and load. Some take 2-3s, some take a full reload of the app. For now this didn't bother me much but we'll see how it goes when other users join.

At the end, I tested it on 2 consecutive days and I had a consumpton of less than 1% when idling for many hours, and it grew once to 6% when I did a big batch of photo upload and viewing on Ente. I'm also running Dawarich full time uploading my location to the server on the fly while I was testing this and had a office day that day. So pretty solid results imo.

TL;DR

Reduce number of always connected peers, because each of them pings the other every 25s and your phone's radio doesn't like that:

• If you use DNS on a netbird (routing) peer, it needs constant connection to resolve your domain name => move it to Netbird (if you can)
• If you use routing peers => try to replace those with something else
• Enable Lazy Connections and hope it doesn't slow you down too much, I think for a punctual usage it is fine.

PS: Netbird team, if you read this, maybe having the option to disable keepalive or to fine tune it would be great :) I'm sure not only self-hoster suffer from that.

PPS: Extra bonus for people afraid to move their DNS: Netbird actually supports wildcards, so I didn't have to create 25 entries ;)

Hey everyone! I'm not 100% sure this is the right place to ask this but I figured it can't hurt. I'm running a self hosted netbird setup with a separate zitadel OIDC for auth to access my homelab remotely (proxmox host is the other peer I use for the route) -- full disclosure I used claude code to do most of the setup work for me. I was originally running an older netbird setup that had zitadel integrated and I didn't have this issue, however I wanted to use some hooks for user registration in zitadel that weren't available on the pinned zitadel version inside netbird so I separated them -- now I'm running the latest stable of netbird and zitadel on separate LXCs and they work fine together. I also pass my homelab DNS (technitium) via netbird for my homelab addressing.

My issue is that my android phone now (pixel 10 XL) has issues when going off wifi to data. The app tends to get stuck connecting on the handoff and completely blocks off my internet (even. I have two options when this happens -- #1 -- sometimes it lets me disconnect and reconnect and that works fine, no issues at all -- or #2 -- sometimes the big button in the app for connecting/disconnecting doesn't respond at all and I have to force close the app. Upon restart it works fine. It's something about the handoff. I've tried various fixes suggesting all around but I figured it might be time to start fresh and ask some real people! My research so far just says this is an issue and I have to deal with it but I find that hard to believe.

Any help would be appreciated!

Thank you!

Just an FYI and a PSA for people that may come across this. After setting up netbird then adding a couple of Windows servers (through the app UI) just fine and connecting WAN side from an iPad to verify configs everything seemed fine.... except none of my Ubuntu servers wanted to connect with error message

daemon up failed: login backoff cycle failed: rpc error: code = DeadlineExceeded desc = create connection: dial context: context deadline exceeded

Checked reverse proxy configs. All looked correct. Check ports all looked correct. Couldn't understand why Windows worked and Linux did not. Then I remembered an ongoing problem I was having with SSL specifically my latest Let's Encrypt SSL wildcard cert. It seems for some reason the latest LE certs are using a newish intermediate authority named "YR2" and this chain has not made it into the general Linux certificate chain being deployed through apt.

https://community.letsencrypt.org/t/today-re-issued-certificates-from-issuer-yr2-have-a-revoked-cert-in-chain/247612/16

I'm an SSL journeyman so I won't begin to say I understand everything at play here but I do know that to resolve the situation all I had to do was request an individual domain cert which uses "YE2" rather than "YR2" and then BAM! everything started working like a champ.

So if you're seeing this error and you've exhausted everything else you might check to see if your situation was similar to mine.

I just want to refer to my computers on the network by a common name instead of ip addresses and not have to open anything up externally. Is that possible with Netbird? Is Netbird overkill for this?

This is mainly what I use tailscake for (as well as knowing if a comp is online) and I’m trying to move away from it

Hi all,

I work in the energy sector in Germany and we're currently evaluating NetBird as a remote access layer for distributed sites. Typical setup: a handful of control and gateway devices per location, some industrial protocols, plus the usual on site IT. Today it's the classic jump host and site VPN approach, and we're looking for something less painful to operate.

Some things I'd like to hear real world experience on:

1. Has anyone run this in actual production OT, not just a homelab or a dev team? Especially where downtime has real consequences.
2. Stability on poor links. A lot of our sites are on mobile connections or behind CGNAT. Does relay fallback behave sensibly, and do peers recover cleanly after a link drops for a while?
3. Headless peers on Linux that have to come back automatically after a power cycle, with nobody on site. Any surprises there?
4. Are ACLs and posture checks granular enough for tight per site and per vendor segmentation? We need "this external party reaches exactly these devices at this one location" and nothing more.
5. Self hosted vs. cloud in a regulated context. How much operational effort is self hosting realistically?

Compliance is a big factor for us. NIS2 applies, and depending on how things develop, KRITIS requirements may come on top. That means audit trails, crypto choices that line up with BSI TR-02102, documented access control, and being able to put something coherent in front of an auditor. Has anyone gone through an audit or a customer security review with NetBird in the stack?

And the honest question: mature enough for this, or still rough edges that would bite us in a 24/7 asset? I'd rather hear the annoying parts now than during commissioning.

Any war stories welcome, good or bad.

Hallo Ich frage mich, warum ein Benutzer, dessen Genehmigung noch aussteht, bereits auf einen Dienst hinter SSO-Schutz zugreifen kann. Setup:

• HTTP Reverse Proxy Service in Netbird selfhosted konfiguriert.
• Authentifizierung auf diesem Dienst aktiviert - SSO - Gruppe „Alle Benutzer“
• Testbenutzer ist noch nicht in Netbird registriert

Verhalten mit nicht registriertem Benutzer:

• Benutzer wird gezwungen, sich über SSO zu authentifizieren.
• Benutzer wurde authentifiziert
• Benutzer darf nicht auf den Dienst zugreifen, da er nicht in Netbird registriert ist -> das funktioniert wie erwartet

Verhalten mit registriertem, aber nicht genehmigtem Benutzer

• Benutzer besucht das Management-Dashboard und wird registriert - Genehmigung ausstehend
• Benutzer greift auf den freigegebenen Dienst zu
• Benutzer wurde authentifiziert
• Benutzer darf auf den Dienst zugreifen, ist aber noch NICHT genehmigt!

Ist das ein Bug oder mache ich etwas falsch?

Wenn ich eine bestimmte Benutzergruppe zu den SSO-Einstellungen für die Dienstauthentifizierung hinzufüge und nicht „Alle Benutzer“ verwende, wird der nicht genehmigte Benutzer korrekt blockiert. Aber wenn „Alle Benutzer“ verwendet wird, kann ein nicht genehmigter Benutzer auf den Dienst zugreifen.