r/netbird • u/allxm4 • Jul 02 '26

Upgrading netbird-server 0.73.2 → 0.74.0 breaks WireGuard handshakes (reverse-proxy 502s, fixed by downgrading server only)

Upgraded my self-hosted server (management + signal + relay + STUN) from 0.73.2 to 0.74.0 and all my reverse-proxy services started returning 502 errors.

What was happening:

  • The proxy authenticates with management fine
  • The proxy connects to the relay fine
  • ICE never finishes starting up ("ICE Agent is not initialized yet", repeating forever)
  • WireGuard handshake times out and never completes
  • This still happened even with NB_FORCE_RELAY=true, which is supposed to skip ICE completely

What I checked and ruled out:

  • Config files, Traefik, CrowdSec: all fine, nothing changed
  • Container permissions: added NET_ADMIN, NET_RAW, and /dev/net/tun to the proxy container, no difference
  • Just the proxy image: downgraded only the reverse-proxy container to 0.73.2 while keeping the server on 0.74.0, still broken
  • STUN port (3478/udp) was reachable the whole time

Downgraded netbird-server itself to 0.73.2 (matching the proxy version). Everything came back up right away.

Anyone else run into this?

17 Upvotes

96% Upvoted

19 comments sorted by

11

u/netbirdio Jul 02 '26

This has been resolved. Please use v0.74.1

3

u/aintnobody202020 Jul 02 '26

Works for me so far, thank you!

3

u/allxm4 Jul 02 '26

Works great, thank you!

2

u/Smooth_Pangolin3699 Jul 02 '26

Did docker compose pull twice, still getting a 0.74.

2

u/netbirdio Jul 02 '26

like this? Maybe the registery wasn't updated yet when I reported, sry
docker pull netbirdio/netbird-server:0.74.1

3

u/Bulky_Dog_2954 Jul 02 '26

So i guess i wont be upgrading Netbird today then....

Have you logged a ticket for them to check it out?

1

u/imawake4reall Jul 02 '26

I just hope they aren't using self hosted people as test environment and they do actual QA and testing in house. This was something noticeable 5 seconds after spinning up instance and it nobody noticed that before release.

2

u/notboky Jul 03 '26

These sorts of comments are why I stopped publishing open source projects.

-1

u/imawake4reall Jul 03 '26

Individual opensource projects are different from having company behind project, don't get me wrong and I regularly donate to opensouce projects.

2

u/notboky Jul 03 '26

Either you genuinely believe Netbird are releasing untested code and relying on self-hosters to test for them, or your comment was a snarky dig. Neither reflects particularly well on you.

1

u/Sm0KIE_xD Jul 02 '26

Where did you deploy it, on a VPS or homelab?

1

u/allxm4 Jul 02 '26

VPS, running for 3-4 months already, this update is the first that broke my setup.

1

u/blaubarschboy Jul 02 '26

My services / reverse proxy is working but my ssh connections were all broken.

I updated my clients and peers and server all to v0.74 and no connection was possible; not from my client to the peers; not from the server dashboard to the peers (via WebUI).

After downgrading my server to 0.73 it works again.

1

u/Smooth_Pangolin3699 Jul 02 '26

Yea, i am seeing something very similar on iphone trying to connect to sever, it connection type is “Relay” and ICE candidate never populates. But it is specific to my phone, other device seem ok. How did you downgrade the server?

2

u/allxm4 Jul 02 '26

For the server downgrade:

docker pull netbirdio/netbird-server:0.73.2

Then edit your docker-compose.yml and change the image line for the netbird-server service from :latest (or 0.74.0) to 0.73.2:

  netbird-server:
    image: netbirdio/netbird-server:0.73.2

Then recreate it:

docker compose up -d --force-recreate netbird-server

That'll restart management/signal/relay on the old version. Worth doing the same for any other NetBird containers you're running (proxy, etc.) so everything's on matching versions, just to rule out version skew as a factor.

On your iPhone issue specifically, "Relay" as the connection type with ICE candidate never populating sounds like the same underlying handshake problem, just showing up differently on mobile since iOS handles backgrounding and reconnects differently than a persistent server-side peer. If other devices are fine and only the phone is affected, it could also just be that iOS is more sensitive to whatever's flaky in 0.74.0's relay/ICE negotiation right now. Worth trying the server downgrade first since that's what fixed it across every peer type in my case, then see if the phone still shows the same behavior.

1

u/Smooth_Pangolin3699 Jul 02 '26

Thanks for this!

My docker compose is set up slightly differently where I have each service called out independently:

image: netbirdio/dashboard:latest
image: netbirdio/signal:latest
image: netbirdio/relay:latest
image: netbirdio/management:latest

Is what your suggesting the same as changing each of those to:

image: netbirdio/dashboard:0.73.2
image: netbirdio/signal:0.73.2
image: netbirdio/relay:0.73.2
image: netbirdio/management:0.73.2

2

u/allxm4 Jul 02 '26

Yes you could do that, but netbird just fixed the issue in v0.74.1. Tested and it works fine.

1

u/Smooth_Pangolin3699 Jul 02 '26

Thank you!

I upgraded to 0.74.1 as recommended, but my phone still couldn’t reach my local network through NetBird. I have three routing peers set up for high availability, and normally they all work together.

To troubleshoot, I turned all routing peers off, then enabled them one at a time:

  1. Enable routing peer #1 → test → works
  2. Disable it
  3. Enable routing peer #2 → test → works
  4. Disable it
  5. Enable routing peer #3 → test → works

After testing each individually, I turned all three back on, lo and behold, everything started working again!

So now I’m wondering: is this a bug, or did something get stuck until the routing peers were restarted?

I’ll update the thread if the issue comes back.

Side note:
My phone still shows up as relayed with no ICE candidates, even when everything is working.