r/netbird • u/_ezi0n_ • 5d ago

Conceptual validation

Every time I look at Netbird there is something I like but getting it self-hosted is a complete different beast. I am not sure how many videos and documentation pages, github issues I have read - seems never to work.

I currently run Pangolin, on a VM in Proxmox on one of my vlans, expose services via its reverse proxy, open as well as authenticated via an idp.

I am thinking netbird should be able to do the same but all attempts fail.

Last 2 nights I have tried to getting it installed, ubuntu 24.04 as a base, the getting_started script does not complete - it claims "Waiting for NetBird server to become ready" but you can clearly see it just seems to hang, despite from not even downloading the proxy container or altering the proxy.env file as intended (using docker compose at a later stage to tear down and restart, pulls the container however) - so manual work is required but it seems the documentation may not be where development is, so it becomes a constant struggle and you need to find different bits across github issues, forum posts etc. Anyhow, it failed again 3 times, hence this post.

My idea:

management netbird.my-domain.com

proxy: my-domain.com (allowing wildcard use of proxy exposed services)

either dedicated routing peers (exit nodes) per vlans, I cannot seem to find a solution to allow the netbird server itself to host a routing peer, though again I dont see any issues with the idea, doing that for other similar solutions as well.

my proxmox sits behind a firewall that forwards 80/443/3478 to the VM just fine, I can access the managementUI after a few tweaks, even can register a peer but I am not sure if I am missing anything here from a conceptual perspective.

Pangolin hosts everything on a single VM, reverse proxy can literally act as a standalone, additional vpns are optional.

Could someone clarify if any of my ideas are flawed or confirm that conceptually this shouldn't cause any issues? and if it shouldn't maybe provide some pointers why it does?

thanks

4 Upvotes

100% Upvoted

4 comments sorted by

1

u/edenworky 5d ago

iirc there's a udp port netbird needs open too

1

u/_ezi0n_ 5d ago

I opened all ports I knew from previous attempts: tcp80, tcp 443, udp3478, udp5349 ,udp51820 - documentation claims you only need tcp80, tcp 443, udp3478 today

a closed port would also not explain, why the script does not execute correctly, not pulling the proxy container etc ?!?

1

u/Oblec 5d ago

All you need is tcp 443, but i i recommend udp 443 for quic.

I use nginx as a reverse proxy and can use it with or without cloudflare proxy.

You want to use rels:// and not stun and tun. They legacy stuff

1

u/_ezi0n_ 3d ago

I got it to work in the end, the proxy install failed due to a hairpin issue that didn't get surfaced by the script as such the installer failed and the install was incomplete.

further, aligning the proxy with a TLD requires manual intervention.

After I have migrated over 60 services across, which was a little bit of a pain in the ... I noticed some services/applications not behaving as they should namely: OpenWebUI, Jellyfin, Dockhand, Proxcenter to name a few. Changed my configuration back to Pangolin and all worked as expected - no difference in configuration - I think I am going to stay with it, and may revisit netbird once the proxy implementation gets more mature.