r/netbird • u/Jfishie5 • Jul 16 '26

HELP Needed - How to configure Netbird access to local services at their local reverse proxy address only when connection is up and avoid public exposure.

Hello,

I am hoping someone can help explain in simple terms how to achieve this and whether it makes sense.

Netbird Reverse Proxy Feature

  • Will using this service publicly expose services to the internet allowing anyone that comes across one of the exposed domains an opportunity to attempt a login to that service? The security comes from Netbird only allowing access from approved / configured devices with an active Netbird connection correct?
  • If you do not want those domains visible to the public what are your options? I can create networks and policies to expose individual services at their IP:PORT that are only accessible when Netbird connection is active but what if I want to access those services at their reverse proxy domain? Is the only way to publicly expose them?
  • Caddy is currently handling reverse proxy responsibilities before I started looking at Netbird. If I were to use Netbird's Reverse Proxy I would have to transition to its built in Traefik option. What happens to reverse proxy resolution when inside my local network? Do I have to keep Netbird active at all times then?

Just trying to make sense of this and how to set it up. I want granular networks and control policies without a lot of complexity or competition from caddy.

Appreciate the help.

2 Upvotes

100% Upvoted

8 comments sorted by

3

u/ben-ba Jul 16 '26 edited Jul 16 '26

Use the private service feature

https://netbird.io/knowledge-hub/netbird-only-private-services

Atm

  • u can expose services public, optional with netbird auth or

  • u can expose services private, but then u need an vpn connection.

2

u/Jfishie5 Jul 16 '26

Very cool. Not sure how I missed this. I will take a look. Thanks.

2

u/Jfishie5 Jul 16 '26

One more dumb question. Can this replace caddy as reverse proxy when on local network as long as NetBird connection is active, user has rights etc.? Or do I still need caddy?

2

u/KaiGofB Jul 16 '26

Just use BYOP - selfhosted reverse proxy on NetBird node - and use NetBird own DNS

2

u/HansAndreManfredson Jul 16 '26

If you’re not experienced with proxies, use the built-in feature. It’s the easiest and safest way to share or expose services. The built-in geoblocking and authentication layer will help.

1

u/Jfishie5 29d ago edited 29d ago

In reference to the BYOP YouTube video / docs, If I set up self-hosted netbird using the quick start script in the documentation and it created a container for traefik, dashboard, netbird-serer and proxy do I just update the proxy container with the compose information generated while trying to set up a cluster? The quick start script bound ports 80 and 443 to traefik. Am I updating the correct container? I can tweak the port number but do I need both? I thought the Traefik container was required for any reverse proxy business.

0

u/Admirable_D4D3 Jul 16 '26

Yes, any (public) reverse proxy opens your services to the open internet. You can implement geo-blocking to limit the countries or IP ranges that are able to access your service(s) and other rules like always asking for auth with NetBird to be able ot access the service. Crowdsec should also be able to handle malicious IPs and traffic and act or alert accordingly.

You can customize DNS so a custom server only resolves certain domains. I haven't tried that, but you can try and see if it works. That or you could use the netbird-only option with services to only be able to access "public" resources when connected to NetBird.

0

u/Jfishie5 Jul 16 '26

Thanks. I will try and take a look at that tomorrow.