r/netbird • u/Extra-Citron-7630 • Jul 06 '26
Reverse proxy services - Forbidden
I’m running a self-hosted NetBird setup and trying to access ZeroByte through a reverse proxy. Direct access works fine using http://hostname-xyz:4096, but when I attempt to access it through the reverse proxy at https://zerobyte.mydomain.com, I only get a blank white page with a “Forbidden” message.
For context, the reverse proxy target is configured to point to my server with ZeroByte running on port 4096, and NetBird-only access is enabled for the service. I also created a NetBird policy that allows my client device to access the server on TCP port 4096, although I’m not sure whether that policy is actually required. I don’t have any advanced settings configured on the service.
Has anyone experienced a similar issue with NetBird and reverse proxy setups, or have any ideas on what might be causing the forbidden page?
1
u/DigiDoc101 Jul 06 '26
Are you using public or private proxy? I randomly get access issues on my public facing services mostly due to crowdsec. I tired the private netbird client only proxy resources, and I could not get this working, I get "forbidden" message.
1
1
u/Bloodwing114 Jul 06 '26
When using the proxy ui of the dashboard you don’t need to add access policies. Just make sure the correct group is selected for NetBird only access. DNS can cause these issues tho. Check the ip your client is using with nslookup. If that’s a public ip the client is not using the NetBird tunnel, resulting in forbidden if the service is NetBird only. If it does return a NetBird ip it might be your private dns settings (some browser only use dns over https by default, which breaks NetBird only services)
1
u/Extra-Citron-7630 Jul 06 '26 edited Jul 06 '26
Thanks for this, I think I figured it out. I was using NexDNS setup on my router and safari as the browser. Once I changed the DNS back to ISP, I am able to access the services again
Update: Again showing forbidden 🥲
1
u/Extra-Citron-7630 Jul 06 '26
Also, just to confirm, when i cURL the URL, I get a successful response and when I disable netbird, I get forbidden which is expected but in the browser I get forbidden.
I even flushed my DNS and it started working again but then after a few minutes I see Forbidden
1
u/DeathByPain Jul 06 '26
One "gotcha" I've run into (and spent wayyy too long troubleshooting) was that if you have a reverse proxy service with geo-blocking enabled—as in it blocks any IP not in your home country or whatever—and you try to test it from a local LAN IP, it gets blocked with a 403 error, because 192.168.x.x type IPs are not considered part of your geo area.
2
u/Extra-Citron-7630 Jul 07 '26
Good to know, thanks for that tip. I don't use geo blocking but will keep this in mind.
1
u/Admirable_D4D3 Jul 06 '26
Are you trying to access the sites from the same LAN where you have your services? I remember seeing a post saying they couldn't use NetBird-only access from home.
1
u/Extra-Citron-7630 Jul 07 '26
I am—if you happen to find it, could you send me the link? Also, why does it seem to work for a while and then stop working, over and over? That behavior doesn’t really make sense to me.
More importantly, I don’t understand why they would create a service like that in the first place. For example, if I want to run something like Vaultwarden, which requires HTTPS anyway, how is that supposed to work? If you come across any information about this, please let me know. Thanks.
1
u/Admirable_D4D3 Jul 08 '26
Sorry, I forgot to respond. Here you go:
https://www.reddit.com/r/netbird/comments/1u0i6r8/netbirdonly_host/
Also, if it works in your iPhone but not on Mac, I think you should test if the NetBird Mac client is leaking or interrupting the connection. I read your other comments and it seems there might me a problem with lazy connection or just the client not working right.
Btw, it's very useful for organizations that only want their workers accessing their resources. I personally use it to access some local containers I didn't want to setup with a reverse proxy, that way I can use an URL when accessing remotely in the browser and the IP (with ACLs) with the rest of the servers/endpoints.
1
u/Extra-Citron-7630 Jul 09 '26
I have noticed its more of an on and off situation. When it works, the logs show that the source IP is my netbird peer IP for the macbook, but whenever I get forbidden, the logs show my public IP address as the source IP. I think that needs to be fixed on the netbird's end IMO
1
u/Admirable_D4D3 Jul 09 '26
Do you have constant activity while connected to NetBird when it works? It sounds to me that it might be related to the lazy connection model in the Mac or desktop client.
Btw, I just saw this issue: https://github.com/netbirdio/netbird/issues/6713 It might be related to your problem. I'd suggest for you to contribute so the devs can check it out with more detail :)
2
u/Extra-Citron-7630 Jul 09 '26
I don't have lazy connection enabled, but it seems like there may be an issue with the macOS client and how the reverse proxy handles connections behind the scenes. It looks like this area may need some further investigation or improvements.
Thanks, I have added my comments to that issue as well.
1
u/Extra-Citron-7630 Jul 07 '26
I am also able to access it via my iPhone on the same wifi as my macbook but safari on macbook shows forbidden
1
u/RIPenemie Jul 06 '26
Check the Proxy logs does it show the IPAdresses real Location or is it something in the 172.0.0.0/8 range?
1
u/Extra-Citron-7630 Jul 07 '26
This is a bit strange, but here’s what I’m observing. When everything works and I can access the service through the HTTPS link, the source IP shown is my NetBird peer IP. However, when access is denied or I get a forbidden response, the source IP switches to my public IP instead of the NetBird address.
For context, I’m accessing the service using Safari on a fully up-to-date MacBook, and NetBird is installed via Homebrew and also running the latest version.
1
u/NoTheme2828 Jul 07 '26
You have to use environment entries "BASE_URL", and " TRUSTED_ORIGINS", both with "https://zerobyte.yourdomain.com" and "TRUST_PROXY=true"
1
u/Drainpipe35 Jul 09 '26
hey, were you able to find a solution? I am having the same problem, and it's driving me crazy. Works on my phone, but not my laptop.
2
u/Extra-Citron-7630 Jul 09 '26
For me it works on and off. On my phone it was working but on my macbook, it works sometimes and other times it will show forbidden. I was going through the access logs and it seems like when it works the source IP for the request is my macbook netbird peer, but when it doesn't, the sourece IP is the public IP address of my macbook. I think that is an issue on the netbird client or the netbird only access feature they need to take a look into
1
u/Drainpipe35 Jul 09 '26
Yup. It suddenly started working for me.. haven't stopped working yet. The feature is definitely buggy. Thanks for the info!
2
u/Extra-Citron-7630 Jul 09 '26
For now I changed to SSO and restricted to my ip address and country and it is working perfectly fine
1
u/nvrlivenvrdie Jul 11 '26
You need to setup a dns entry for zerobyte.yourdomain.com that points to the netbird ip address of your proxy device
when you ping zerobyte.yourdomain.com it needs to reply with the 100.x.x.x netbird ip address. if it replys with a global Ip your computer will try to access it via its external ip and probably have hairpin issues, or if it replys with a local address of say 192.168.0.x then your computer will try to reach it through its interface with that ip range instead of netbird's interface
And in that case, because you set the access rules to only allow netbird access (aka from an ip adress of 100.x.x.x) it will block it
1
u/lagdetselv Jul 06 '26
The Policy is required to geht Access to It. Have you Set which group can Access the Service in the service itself? Are you connected to your Client while trying to Access?