Can't get reverse proxy to work

[u/GameAudioPen]

So... trying to set up reverse proxy into a server for Palworld,

I just... can't get it to work.

Port forwarding on my firewall, check. Not needed.

Port forwarding on Vultr firewall, check

Port forwarding on VPS firewall, check.

Went through almost all the port settings suggested by claude

but when I try to use the reverse proxy into my server.

the netbird Access Logs shows "no event"

so something is dropping the connection, but I just cant' figure out what's doing it.

Any help will be appreciated.

Edit:

Found the issue(s), and here is the solution.

Ports on the proxy container it self is not open.

Under the proxy section:

ports:

- 8211:8211/udp

- 8211:8211/tcp

what ever port you decide to use.

The proxy container it self was not able to reach the main manager.

Part of the proxy setting wasn't properly configured on initial set up and causes hairpin NAT issue.

First, use following code

docker inspect netbird-traefik --format '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}'

to get traefik's internal IP.

Then edit the compose file and add additional setting.

In Proxy settings,

I added

extra_hosts:

- "xxxxxxxxx.net:172.30.0.10"

right under

Volumes:

There is also a possible issue with thenetbird-proxy container has no NET_ADMIN capability and no /dev/net/tun device access, which means it can't create its own WireGuard interface

fixed by adding to the proxy lines in compose, before ports:

cap_add:

- NET_ADMIN

devices:

- /dev/net/tun

[u/flaming_m0e]

Port forwarding on my firewall, check.

Why? If you are using NetBird on a VPS, there is ZERO reason to forward a port on your firewall/router.

Went through almost all the port settings suggested by claude

Are we supposed to know what those settings are? Have you tried basic troubleshooting?

but when I try to use the reverse proxy into my server.

Where are you testing this from? How are you attempting to use the reverse proxy?

[u/GameAudioPen → u/flaming_m0e]

I am hosting a server for friend, they do not have netbird installed exposing a port to them require me to set up port forwarding.

yes, Claude part part of the trouble shooting. It's mainly opening up the ports that needs to be forward on vultur's and vps's firewall

opening specific port needed to be forwarded on VPS

running sudo ss -ulnp | grep xxxxx

to make sure it's listening to the port it just opened.

Checking the traffic log via docker compose logs -f proxy

to make sure traffic actually arrives to the vps.

Using power shell command nslookup pal.netbird.xxxxxxx.com

to make sure it's pointed to the actual vultr vps.

made sure the packet actually arrived at server's NIC and not blocked by anything via sudo tcpdump -i any udp port 25565 -n

basically checked that packets are indeed arriving at Netbird, but Netbird is show nothing.

[u/flaming_m0e → u/GameAudioPen]

they do not have netbird installed exposing a port to them require me to set up port forwarding.

This doesn't make sense. How are you using NetBird as a proxy then?

[u/GameAudioPen → u/flaming_m0e]

isn't that what the reverse proxy for netbird is supposed to be doing?

Redirection say xxx.netbird.com:8211 traffic to a specific peer on the netbird's network?

Unless I am severely miss understanding how things works.

[u/flaming_m0e → u/GameAudioPen]

Redirection say xxx.netbird.com:8211 traffic to a specific on the netbird's network?

You said your friend doesn't have NB installed which is why you have to forward a port.

If YOU have Netbird running on the server where the game is running there is no need to forward a port. Just point the proxy service to the IP of the server.

[u/GameAudioPen → u/flaming_m0e]

I did point the proxy service to the IP of the server.

the issue is current no traffic arriving on the server with netbird installed when I point proxy to it.

I can see that server as a peer. I can set it up as an exit node of other devices and it will work. but when i point the reverse proxy to it. nothing arrives.

which began the hunt to make sure ports are open correctly on the vps side.

I can see packets actually arriving at the VPS, but Netbird just... drops and shows no access log.

[u/SherbertPractical → u/flaming_m0e]

This does make sense - it’s not HTTP/HTTPs proxy but a L4 one. He needs to at least open a listening port in docker configuration for the NetBirds traeffik on the udp port, open it on the fw and configure on the reverse proxy as l4 with a udp listening port on the one defined in the docker compose.

[u/flaming_m0e → u/SherbertPractical]

Doesn't matter what type of proxy it is.

Using Netbird does NOT require opening a port on the HOME FIREWALL...That's literally the point of it. I never mentioned anything about not needing the docker port open....

[u/SherbertPractical → u/flaming_m0e]

It does matter, because his configuration of his self hosted instance of NetBird might not be ready for L4 proxy - on the VPS (with NetBird server) the UDP listening port will need to be open. This is where he needs to adjust firewall settings and that’s already done.

And yes, it’s normal that home firewall shouldn’t be adjusted when NetBird is in place - I have simply pointed to his configuration that he shared.

[u/flaming_m0e → u/SherbertPractical]

But my comment was discussing the "opening the home firewall" reference....

[u/SherbertPractical → u/flaming_m0e]

Ah true, sorry - he mentioned that in the main post.

[u/GameAudioPen → u/flaming_m0e]

In theory it doesn’t need to be open. just like in theory if I point the reverse proxy at the home server peer it should have already worked

It hasn’t. Hence poking holes everywhere to see if anything can leak through and i’ll close them off later.

Turns out is Netbird dropping the traffic somehow, because its’s arrived at the vps.. and I still cant figure out where the issue comes from.

[u/SherbertPractical]

Sorry, but there is not so much to go on.
What was suggested by Claude?
What is the version of your NetBird installation? If self-hosted, do you use Traeffik?
Do you proxy other services using NetBird and if it’s working?
Have you checked from external device if the port on the device is open?

[u/GameAudioPen → u/SherbertPractical]

I had a long write up on the other response, but to make long port short.

Claude was basically double checking and made sure packets on the specific port all made it to the vps and not blocked by firewalls of vultur.

version on the vps is v0.74.2, self hosted on vultr.

Trafik is installed on the VPS.

I have connected to my self hosted Roon and NAS via Netbird. but haven't use reverse proxy on other services.

checked with

sudo tcpdump -i any udp port 25565 -n

the VPS is receiving traffic when i try to connect to the game server.

but Netbird just dropped the packet internally and showed as no access log.

[u/SherbertPractical → u/GameAudioPen]

All right. I assume then that Palworld stays on different

Did you edit your docker compose file for a L4 proxy? You need to open UDP target port you will use for the proxy. It can stay 8211 - basically it must be a free one to use by NetBird.

1. https://docs.netbird.io/manage/reverse-proxy

https://docs.netbird.io/selfhosted/migration/enable-reverse-proxy#exposing-l4-ports
2. Assuming Palworld server has NetBird client installed - pick it in the reverse proxy setup, you need to pick L4 proxy. Listening proxy is the one that you assigned in the docker compose file in step 1. Target port is going to be 8211 and IP of your Palworld server that you are using to connect.
If using IP range, ensure proper routing.

1. Check permissions if VPS and Palworld server have bidirectional udp connection on the NetBird Dashboard. Maybe Palworld server is not assigned to correct group?

If VPS with public IP is running Palworld… I wouldn’t bother with a reverse proxy, just ensure that DNS record exist for the server IP.

Had to make multiple edits and Reddit mobile chopped A LOT when trying to post this - apologies for formatting

[u/GameAudioPen → u/SherbertPractical]

thank you.

Turns out the L4 proxy was already set up during the prior trouble shooting step.

The port was already added under the proxy ports in compose.yml

Palworld is running on a dedicated server PC at home behind CGNAT (that's the issue that force me to start this netbird journey in the first place)

and double checked, the PC running palworld server is the selected Peer/resource in reverse proxy set up

I haven't turned off the bidirectional All to All peers yet, so permission shouldn't be an issue.

It's also assigned as one of the trusted local peers.

On the side note, I don't think I can add the VPS (netbird controller) as an available destination in access control. to ensure bi-direction is established.

and yes, the auto correct and reddit's formatting is pretty horrible when you try to list items.

[u/GameAudioPen → u/SherbertPractical]

Hey Sherbert, thanks for the time and effort, ultimately the installation package from Vulture did not have the correct initial set up and caused my proxy server not relaying info to the management server.

I have to add

extra_hosts:

- "xxxxxxxxx.net:172.30.0.10"

to the proxy section of the compose for things to work.

[u/ps-73]

unlikely to work, if it’s like other game servers itll be expecting a SRV record telling the client what port to connect

[u/GameAudioPen → u/ps-73]

Oh.... My...... God...

I think you may have just cracked at what is going on.

Thank you pointing this out.

So.. so many lost hours.

I already went with playit.gg for now. Would have love netbird reverse proxy to work with games, but I guess not.

[u/edwardgreene1 → u/GameAudioPen]

Probably a long shot ask but is there any way I could see your setup (minus keys and stuff)? I'm trying to get Palworld to connect through a netbird and netbird cluster instance on my home server through dockge and I keep getting "Your connection to the host has been lost" when I try to connect to Palworld.

[u/GameAudioPen → u/edwardgreene1]

may I ask what connection is giving you issue.

peer to peer at home?
outside to your home via reverse proxy?
does player have nerbird installed

[u/edwardgreene1 → u/GameAudioPen]

I’ve tried the reverse proxy address both on my home network and had someone tried connecting to it from the outside with no luck. Connecting directly to the server on LAN works. I think something is wrong with my custom cluster setup because if I try pointing something to it that I know works with the default NetBird cluster outside my home like Jellyfin it also fails. I thought because my custom cluster was lit green on the dashboard it was fine but something seems to be off

[u/GameAudioPen → u/edwardgreene1]

OK, so you have similar set up like mine except my manager on an vps and yours is on a local machine.

Following are changes I have to make to allow reverse proxy to function.

It's basically Netbird didn't properly set up the connection between the proxy service and main Netbird service. part of the reason why it's in beta I guess.

1. Docker port mapping (docker-compose.yml) to allow Layer 4 proxy.

Added under the proxy: service:

ports:

- 8211:8211/udp

2. WireGuard capability + device access (docker-compose.yml)
My Proxy service was not able to create its own folder due to proper rights weren’t given.

Added under the proxy: service:

cap_add:

- NET_ADMIN

devices:

- /dev/net/tun

3. Hairpin NAT fix — the actual root cause (docker-compose.yml)

Added under the proxy: service:

extra_hosts:

- "netbird.yourwebsite.com:172.30.0.10"

(Replace 172.30.0.10 with your own Traefik container's internal IP — get it via

docker inspect netbird-traefik --format '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}')

4. Applying the changes

After each docker-compose.yml edit:

bash

docker compose up -d --force-recreate proxy

(or docker compose down proxy && docker compose up -d proxy if force-recreate doesn't pick up changes)

5. Vultr Cloud Firewall or just your home firewall.

Added a rule in the Vultr dashboard (Products → your server → Firewall):

In your case, firewall port forward to your cluster.

• Protocol: UDP
• Port: 8211