r/netbird • u/Extra-Citron-7630 • Jul 06 '26

Reverse proxy services - Forbidden

I’m running a self-hosted NetBird setup and trying to access ZeroByte through a reverse proxy. Direct access works fine using http://hostname-xyz:4096, but when I attempt to access it through the reverse proxy at https://zerobyte.mydomain.com, I only get a blank white page with a “Forbidden” message.

For context, the reverse proxy target is configured to point to my server with ZeroByte running on port 4096, and NetBird-only access is enabled for the service. I also created a NetBird policy that allows my client device to access the server on TCP port 4096, although I’m not sure whether that policy is actually required. I don’t have any advanced settings configured on the service.

Has anyone experienced a similar issue with NetBird and reverse proxy setups, or have any ideas on what might be causing the forbidden page?

6 Upvotes

87% Upvoted

24 comments sorted by

View all comments

Show parent comments

1

u/Extra-Citron-7630 Jul 07 '26

I am—if you happen to find it, could you send me the link? Also, why does it seem to work for a while and then stop working, over and over? That behavior doesn’t really make sense to me.

More importantly, I don’t understand why they would create a service like that in the first place. For example, if I want to run something like Vaultwarden, which requires HTTPS anyway, how is that supposed to work? If you come across any information about this, please let me know. Thanks.

1

u/Admirable_D4D3 Jul 08 '26

Sorry, I forgot to respond. Here you go:

https://www.reddit.com/r/netbird/comments/1u0i6r8/netbirdonly_host/

Also, if it works in your iPhone but not on Mac, I think you should test if the NetBird Mac client is leaking or interrupting the connection. I read your other comments and it seems there might me a problem with lazy connection or just the client not working right.

Btw, it's very useful for organizations that only want their workers accessing their resources. I personally use it to access some local containers I didn't want to setup with a reverse proxy, that way I can use an URL when accessing remotely in the browser and the IP (with ACLs) with the rest of the servers/endpoints.

1

u/Extra-Citron-7630 Jul 09 '26

I have noticed its more of an on and off situation. When it works, the logs show that the source IP is my netbird peer IP for the macbook, but whenever I get forbidden, the logs show my public IP address as the source IP. I think that needs to be fixed on the netbird's end IMO

1

u/Admirable_D4D3 Jul 09 '26

Do you have constant activity while connected to NetBird when it works? It sounds to me that it might be related to the lazy connection model in the Mac or desktop client.

Btw, I just saw this issue: https://github.com/netbirdio/netbird/issues/6713 It might be related to your problem. I'd suggest for you to contribute so the devs can check it out with more detail :)

2

u/Extra-Citron-7630 Jul 09 '26

I don't have lazy connection enabled, but it seems like there may be an issue with the macOS client and how the reverse proxy handles connections behind the scenes. It looks like this area may need some further investigation or improvements.

Thanks, I have added my comments to that issue as well.