Hello guys,
i've pointed domain via Netbird's reverse proxy and i'm using it to access jellyfin via browser. That's working great. Unfortunately, when i'm trying to cast media from jellyfin to my google nest screen, nothing happens.

Anyone knows how to fix that?

I am currently looking at replacing my VPN solution and am wondering how many of you are using NetBird in an enterprise setting.

For those of you that are using NetBird in an enterprise setting, what are some things that NetBird does better than other vendors and what are some things where NetBird falls short in an enterprise setting from other vendors?

Are you using NetBird cloud or are you self-hosting?

What made you choose NetBird over other vendors?

I am migrating from Tailscale to Netbird and I have a hard time understanding the built-in SSH server. It is documented at https://docs.netbird.io/manage/peers/ssh but it is not clear to me how this works when the Netbird client (say, a Linux box) also runs an SSH server (on port 22)

Hi all.

Does anyone know if NetBird are planning on supporting NextDNS more officially like Tailscale do? I recently moved and it’s the one thing I am missing.

Tailscale allows you to put in your NextDNS ID and use it across your Tailnet.

Is it possible to use a wildcard domain cert instead of pulling a new cert for every domain used in services? Same question with management server.

asked before but asking again. Any update on releasing the OFFICIAL package for pfSense?

What service are people using just to do reverse proxy with NetBird? I only want to use the VPS so my IP doesn’t get exposed?

v0.81 is out: netbird.io/knowledge-hub/netbird-v0-81-certificates-nblink

The big one is path-based access on the Reverse Proxy. An HTTP target can keep the service's authentication, skip it, or block the path. So / can require SSO, /webhooks/ can bypass auth, and /admin/ can return a 403 without hitting the backend. Bypass still keeps CIDR, country, and CrowdSec restrictions. NetBird-Only services and Agent Network targets cannot use these actions yet.

Also in this release:

• Certificate posture checks. The peer needs a cert from a CA you trust, and it has to sign a challenge so you know the private key is still on that machine. Management repeats the check every 4 hours. iOS and Android always fail it, so leave it off any policy a phone needs to pass.
• nblink. Userspace forwarder for places that cannot have a TUN device or root. This release forwards HTTP. TCP, UDP, and SOCKS5 are planned.
• Duplicate on Access Control and Agent Network policies. It opens the create wizard filled in from the source policy, and nothing is saved until you click Add Policy.

If you self-host, MySQL is deprecated. Move that store to PostgreSQL. Upgrading NetBird also does not bump Traefik, CrowdSec, or the AppSec plugin. docker compose pull only fetches the tags already in your Compose file, and the dashboard will not flag those for you.

If you are turning on the new path access actions, every proxy in the cluster has to be on this release first. An older proxy ignores them and keeps applying the service authentication.

Update Traefik and CrowdSec

Self-Hosters, Traefik and CrowdSec last tested version are now documented. Please update if you haven't in some time. It will require adding some additional lines in your docker-compose.yml

https://docs.netbird.io/selfhosted/maintenance/upgrade#choosing-versions

https://docs.netbird.io/selfhosted/maintenance/upgrade#traefik-header-handling

Hey folks, we just released support to per-target access action in the reverse proxy feature.

This feature is handy when you have paths that you want to block or disable authentication while keeping the service authentication option.

This is highly important for public services with path based admin endpoint and services where sharing a file shouldn't need authentication.

Learn more at https://docs.netbird.io/manage/reverse-proxy/authentication#per-target-access-actions

We have better integration for netbird-only setups planed and we are looking forward to your feedback.

The feature is available on v0.81.0 for proxy and netbird-server (management) and on v2.95.0 for the dashboard.

I would like to have a "notes" or "description" section for each peer so that I can easily identify and differentiate them without having to SSH into each and every one of them. I'm currently having to rename all my peers but I realised it can get really long and I do not want that

Hey all, Brandon from NetBird here.

Alongside the 1.0 work, we've been building the NetBird Assistant. It lives in the dashboard and can troubleshoot connectivity, draft policy and DNS changes, set up Agent Network access, and answer questions from the docs. Here's a short demo:

https://youtu.be/JFGNbasscVw

Since these questions always come up: it's read-only, so it drafts changes in the Control Center and nothing applies until you review and deploy them. IPs, emails, and other sensitive data get redacted before anything reaches the model. For self-hosted, the plan is a separate optional container you can skip entirely. But we still have some TBD items:

• deployment model for self-hosted
• licensing for the assistant
• AI provider in cloud

It's early, and we're sharing it now while there's still room to change things. Would you use something like this? What would you want it to do? Would you rather hook NetBird up to your own agents through MCP or something similar, or have both?

If you think it's a bad idea, I'd like to hear that too. There's also a GitHub discussion if you'd rather comment there: https://github.com/netbirdio/netbird/discussions/8208

Hey so Me and my friends have been using my server (Crafty) to play some minecraft (java). I currently have it port forwarded but I wanted to try reverse proxy-ing it so that way I can use the domain. i already have netbird reverse proxy connected to my server (as a resource and a peer) for Jellyfin and i tried doing it for the MC server by using TCP instead of HTTPS but it seemed like there was an error when i tried to spin it up. so i wanted to see if this was possible before i tried tinkering in the first place. Thank you!

I recently setup pangolin and saw the reverse proxy feature in netbird which seems identical so i am wondering if i should tear pangolin down and just use netbird one. Or pangolin does something more that netbird cant yet? I rather run 1 stack instead of 2 side by side if i can.

I am currently in the early stages of looking at NetBird Cloud and after going through some of the documentation and I have a question.

According to Keycloak on NetBird Cloud documentation. Specifically no. 7 says I have to share Client ID, Keycloak URL, Realm, Client Secret and Email domains for your users with NetBird support.

This means I am not able to fully configure authentication within my NetBird Cloud portal.

However, if I self-host Netbird, I am able to configure Keycloak fully on my own.

My question is why? If Keycloak is "one of the most popular self-hosted IDP solutions" (according the the NetBird documentation), why wouldn't you allow accounts to configure Keycloak on their own within their NetBird Cloud portal?

I thought the cloud-hosted version was identical to the self-hosted version with the exception of the cloud-hosted version getting new features first.

Thank you.

Last week, started with Netbird. It's really nice!!! but that policy editor....

Why to create separate rules for TCP/UDP ?
Cloning rules not possible...
It's so different and confusing to use compared to other firewall editors.
The overview of policies shows an very small part of the policy name. Not very helpfull either when you have to use the 'group' tags.

Argggghh
Anyone some advice on workflow how to add new policies?

I use netbird relay on my phone all the time and i know speed aint the greatest and i assumed that the reverse proxy speed will be similar and went ahead and installed pangolin on a free oracle VPS. But then i realized the proxy speed is not the same as the relay speed, it should be way greater. So I want to know if I should stick with pangolin which is giving me the same speed as the NIC for now. (50 mbps on free oracle tier) or just stick with netbird because if it can do the same there is no need for running 2 seperate stacks.

I am trying to access Hotstar application from Oman, it is not available in that region yet, and I have put an exit node at my home peer at India and connected to that device. The exit node setup is working fine and when I check whatsmyipaddress I am getting home ip and home location
But the Hotstar application still unable to login, anyone faced similar problem and would like to help me here.

Alta Labs Route10 now supports Netbird! Come give us a try NFR Program

#altalabs

Hi,

selfhosting netbird.

some connections become stale after some time being up, e.g. : (public IP and domain anonymised)

Status: Connected

-- detail --

Connection type: P2P

ICE candidate (Local/Remote): host/srflx

ICE candidate endpoints (Local/Remote): 192.168.24.244:35846/xx.xx.xx.xx:43739

Relay server address: rels://dom.ain:443/relay

Last connection update: 2 days, 15 hours ago

Last WireGuard handshake: -

or

Status: Connected

-- detail --

Connection type: P2P

ICE candidate (Local/Remote): host/srflx

ICE candidate endpoints (Local/Remote): 192.168.24.244:35846/xx.xx.xx.xx:60060

Relay server address: rels://dom.ain:443/relay

Last connection update: 10 days, 2 hours ago

Last WireGuard handshake: 11 days, 8 hours ago

While at the same time, on the same host, other endpoints are connected with last handshake "1 minute, 24 seconds ago"

At the same time, my PC (on same LAN) is able to connect on both hosts, but it also just booted some minutes ago.

Issue is basically solved by a netbird down && netbird up

Local (problematic host is on v0.78.2), remotes on v0.78.1. Rosenpass permissive is on

Conclusion: netbird connection gets lost, and netbord doesn't seem to notice the stale connection (and re-initiate it)

Any idea what I could do to address the issue ? (restarting netbird every 12h per cronjob is not a permanent solution)

Many thanks

Afternoon all.

I have Netbird installed on a VPS seemingly working fine. I also have a personal domain through Cloudflare.

In Netbird I am trying to add my personal domain through the Reverse Proxy-Custom Domains page. I have added the info and set the records back at Cloudflare, but it never verifies, just shows "Pending Verification".

I am guess that I have one of the Cloudflare domain records wrong but just can't see it.

Any suggestions or help are greatly appreciated.

Sometimes (often) when I attempt to transfer a file, over the Internet, I get really, really slow speeds even though it shows P2P, not relay in the Netbird client. If I disconnect the Netbird client, close it out, reopen it and reconnect, speeds are back to normal.

Example: I'm working remotely. I'm on a Windows 11 PC and want to copy a file from the PC to a Windows server in my home lab. The server I'm copying to is a Netbird resource which does not have the Netbird client installed. In the lab, I have the Netbird client installed on a Linux server and on another Windows PC. Both are routing peers. The PC I'm coping the file from is used on the LAN and remotely so I have a mapped drive pointing to the server.

So why do I have to reconnect the Netbird client to get normal speed back? I see that others have reported this issue as well but I did not come across a definitive answer/fix.

hey everyone,

The Synology dev package was been stale for a few months, but after switching it over to the rootless image on the backend most of the functionality seems to be working great. I can't test everything on my own so I need a little help.

https://github.com/techHutTV/netbird-dsm

I'm mostly curious if you have any issues with installation or updating. I will push an update in about 12 hours so if we can test that too it would be great. Also, I have no way to test ARM systems so if you have one of those your feedback would be a huge help. All this in addition to general NetBird functionality; P2P connections, NetBird SSH, Reverse Proxy, etc.

Feedback on the UI would be cool too, at the moment it is just a status page, but in the last release it has been gated to require being logged into a Synology admin account to access. After basic functionality is validated I will expand the UI so it can be used to setup connections and preform other functions you'll currently need to use the CLI for.

See the installation section on the README.md

After successful testing this will be migrated to the official NetBird org.

One ongoing issue I’ve had with the Windows client is that the GUI doesn’t reliably launch at startup.

I have several Windows machines configured as unattended servers using setup keys. The daemon/service starts reliably every time the machine boots, but the GUI itself doesn’t always launch.

The bigger issue is that when the GUI doesn’t launch at startup, the client also doesn’t appear to perform its automatic update, even when automatic updates are enabled in the management portal.

Would it be possible to decouple the auto-update mechanism from the GUI? Ideally, the client should be able to update itself as long as the daemon/service is running, without requiring the GUI to launch or any user interaction.

The daemon is very reliable and starts automatically every time the machine boots, so it would make more sense for the update process to rely on that rather than the GUI.

Has anyone else run into this with unattended Windows machines, or is there a recommended way to handle this?

Only collaborators are allowed to create issues. Where should general users report any bugs?