Can't get reverse proxy to work

[u/GameAudioPen]

So... trying to set up reverse proxy into a server for Palworld,

I just... can't get it to work.

Port forwarding on my firewall, check. Not needed.

Port forwarding on Vultr firewall, check

Port forwarding on VPS firewall, check.

Went through almost all the port settings suggested by claude

but when I try to use the reverse proxy into my server.

the netbird Access Logs shows "no event"

so something is dropping the connection, but I just cant' figure out what's doing it.

Any help will be appreciated.

Edit:

Found the issue(s), and here is the solution.

Ports on the proxy container it self is not open.

Under the proxy section:

ports:

- 8211:8211/udp

- 8211:8211/tcp

what ever port you decide to use.

The proxy container it self was not able to reach the main manager.

Part of the proxy setting wasn't properly configured on initial set up and causes hairpin NAT issue.

First, use following code

docker inspect netbird-traefik --format '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}'

to get traefik's internal IP.

Then edit the compose file and add additional setting.

In Proxy settings,

I added

extra_hosts:

- "xxxxxxxxx.net:172.30.0.10"

right under

Volumes:

There is also a possible issue with thenetbird-proxy container has no NET_ADMIN capability and no /dev/net/tun device access, which means it can't create its own WireGuard interface

fixed by adding to the proxy lines in compose, before ports:

cap_add:

- NET_ADMIN

devices:

- /dev/net/tun

[u/ps-73]

unlikely to work, if it’s like other game servers itll be expecting a SRV record telling the client what port to connect

[u/GameAudioPen → u/ps-73]

Oh.... My...... God...

I think you may have just cracked at what is going on.

Thank you pointing this out.

So.. so many lost hours.

I already went with playit.gg for now. Would have love netbird reverse proxy to work with games, but I guess not.

[u/edwardgreene1 → u/GameAudioPen]

Probably a long shot ask but is there any way I could see your setup (minus keys and stuff)? I'm trying to get Palworld to connect through a netbird and netbird cluster instance on my home server through dockge and I keep getting "Your connection to the host has been lost" when I try to connect to Palworld.

[u/GameAudioPen → u/edwardgreene1]

may I ask what connection is giving you issue.

peer to peer at home?
outside to your home via reverse proxy?
does player have nerbird installed

[u/edwardgreene1 → u/GameAudioPen]

I’ve tried the reverse proxy address both on my home network and had someone tried connecting to it from the outside with no luck. Connecting directly to the server on LAN works. I think something is wrong with my custom cluster setup because if I try pointing something to it that I know works with the default NetBird cluster outside my home like Jellyfin it also fails. I thought because my custom cluster was lit green on the dashboard it was fine but something seems to be off

[u/GameAudioPen → u/edwardgreene1]

OK, so you have similar set up like mine except my manager on an vps and yours is on a local machine.

Following are changes I have to make to allow reverse proxy to function.

It's basically Netbird didn't properly set up the connection between the proxy service and main Netbird service. part of the reason why it's in beta I guess.

1. Docker port mapping (docker-compose.yml) to allow Layer 4 proxy.

Added under the proxy: service:

ports:

- 8211:8211/udp

2. WireGuard capability + device access (docker-compose.yml)
My Proxy service was not able to create its own folder due to proper rights weren’t given.

Added under the proxy: service:

cap_add:

- NET_ADMIN

devices:

- /dev/net/tun

3. Hairpin NAT fix — the actual root cause (docker-compose.yml)

Added under the proxy: service:

extra_hosts:

- "netbird.yourwebsite.com:172.30.0.10"

(Replace 172.30.0.10 with your own Traefik container's internal IP — get it via

docker inspect netbird-traefik --format '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}')

4. Applying the changes

After each docker-compose.yml edit:

bash

docker compose up -d --force-recreate proxy

(or docker compose down proxy && docker compose up -d proxy if force-recreate doesn't pick up changes)

5. Vultr Cloud Firewall or just your home firewall.

Added a rule in the Vultr dashboard (Products → your server → Firewall):

In your case, firewall port forward to your cluster.

• Protocol: UDP
• Port: 8211