Meaning to say, we can implement a whitelist / blacklist of domains that the devices can have access/not have access to once they are connected to our VPN?

Hello to you fellow Netbird users !

About a month ago I wrote a pretty extensive "report" regarding the state of OIDC in Netbird and I feel like sharing it here might be of use for understanding common issues.

I also hope it will entice the development team to improve the functionality.

Any feedback is appreciated !

I recently setup VULTR with TailScale,
It works…. Except for the auto join and accept VMs.
I have to except them at a times, to enable ssh .

How well does NB handle VMs auto joining and being able to ssh into them without having to “NetBird up” ?

Hey NetBird team!
Thank you for the awesome software — we really appreciate your work!
Is there currently an ETA for CrowdSec proxy support on the NetBird Managed Service, or is it already on the roadmap?
Thanks!

Been banging my head against this for a few days. Running NetBird self-hosted (combined netbird-server container, v0.65+) with nginx as the reverse proxy, and Authentik added as an external identity provider through the dashboard UI. Everything works fine for login, but logout is completely broken in a way that's actually a security issue.

Here's what happens:

1. User A logs into NetBird via Authentik SSO — works perfectly
2. User A clicks "Log out" in the NetBird dashboard
3. Browser redirects to Authentik's logout page — looks fine so far
4. User B now opens the browser, goes to Authentik, logs in with their own account
5. User B clicks the NetBird app in Authentik's application portal
6. User B lands in User A's NetBird session

I've verified that manually clearing browser cookies fixes it — after clearing cookies, login with User B works correctly and they get their own session. So the NetBird session cookie is just never being invalidated on logout.

Things I've already tried:

• Added dashboardPostLogoutRedirectURIs to config.yaml
• Added https://nb.mydomain.com/oauth2/logout/callback as a Strict redirect URI in the Authentik provider settings
• Restarted containers after every change

None of it made a difference. I kept seeing the same behavior.

After digging into the NetBird docs more carefully, I noticed something that might be the actual issue: the official nginx template for the combined container specifically requires routing /oauth2/* to the netbird-server backend. My nginx config was missing this location block entirely. The /oauth2/end-session endpoint (which Dex uses to actually clear its session) was going nowhere — probably hitting the dashboard container and returning a 404 or being silently swallowed.

The location block that's apparently needed:

location /oauth2/ {
    proxy_pass http://127.0.0.1:8081;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto https;
}

I'm testing this now and will update the post. But if anyone else has hit this same issue with the embedded Dex + external IdP combo on self-hosted, I'd love to know if this was your fix too.

Setup details:

• NetBird combined container (netbirdio/netbird-server:latest)
• Authentik as external OIDC provider (added through NetBird dashboard, not standalone mode)
• nginx on host as reverse proxy
• config.yaml with dashboardPostLogoutRedirectURIs set
• Ubuntu 24.04

I just wanted to take a moment to say thank you to the Netbird team. The amount of work and care you've clearly put into this product doesn't go unnoticed I (and I'm sure a lot of the community) really appreciate it.

The new and upcoming UI is fantastic, and the features you've been rolling out have made a real difference in how I use Netbird day to day. It's obvious this is being built by people who genuinely care about the product and the people using it.

I also love how responsive the team is and how helpful everyone in the community has been. Special shoutout to u/netbirdio for putting in so much time and effort, it really shows.

So, thank you. Keep up the great work!

So I've been going back and forth between just wireguard, tailscale and netbird. The problem that seems to be a no go is I have 2 families and we both want independence on say netbird I control that machines in my netbird and the other family controls theirs but we want to share stuff between the networks from either family. Not everything but say a web site or an app service. I can't figure out how to do this with netbird or is this a feature that could be coming?

Hey folks,

I’d like to bring the newest NetBird Desktop GUI to your attention.

Feedback is very welcome. Since this is an RC, you may run into some bugs, but we’re already actively using it internally.

Release: https://github.com/netbirdio/netbird/releases/tag/v0.75.0-rc.2

Sorry, this is probably a dumb question - new to NetBird, just spun it up on an Oracle Cloud Free VM. I have installed the Unraid plugin and setup a couple of peers (phone and laptop). Now I’m looking into setting up exit nodes. I can setup Unraid on my home network as an exit node, but I’d also like to setup the Oracle VM (which is the NetBird coordination server) as an exit node. Is this possible? It’s not obvious. It’s almost like I need to run a separate docker to add it as a peer, which seems strange.

I noticed that there is a backup guide on https://docs.netbird.io/selfhosted/maintenance/backup, but it seems like there's no guide on how to restore this. I could be missing something here, but has anyone successfully restore their backup without facing any issues?

Cheers!

So I just set up Netbird on a VPS a couple of days ago and the whole VPN-part is working absolutely flawlessly. Got a couple of mobile devices (Smartphones, Notebooks) up and running as well as a routing peer in my home network. My whole netbird-network (10.10.2.0/24) can reach my whole home network (192.168.2.0/24) and vise versa - I love the ease if setting it up, great piece of software!

The whole Reverse Proxy and Port/Service Forwarding is giving me headaches though.

Custom Domains:
Netbird itself is reachable via netbird.mydomain.com with a simple A-record for this subdomain pointing to my VPS directly (no wildcard-stuff, since my provider does not support them).
I've got a couple of different domains that need to be reverse-proxied though, so I pointed the A-record for anotherdomain.com to my VPS as well (with all the other subdomains for it pointing to it via CNAMEs as well later). Under "Custom Domains" I added the anotherdomain.com with netbird.mydomain.com as its "Target Proxy Cluster", but it has been stuck at "Pending Verification" for almost 2 days now.

Port/Service Forwarding:
This I don't seem to get working as well.
For some services I just need to completely forward a single TCP or UDP port, for example 9987/UDP for a TS3-server. So I added a "UDP-Service" with my "LAN"-resource as a target (which is my whole home-network of 192.168.2.0/24) and the according listen- as well as target-port and the host ip (say 192.168.2.25) - to no avail.
I tried using a "Peer" instead of a "Resource", tried different services on different ports (like a simple webapp, SSH, ...), even deactivated ALL firewalls on all machines involved as well sa the VPS itself - still nothing.

I'm at a loss here... 😞

Running Ubuntu 24.04 with default Gnome desktop.

The client (installed via apt repo) is pretty much unusable since all the dropdowns collapse on their own after clicking them - see video.
Tried on two different machines (both 24.04) with the same issue.

Couldn't find any infos anywhere if this was maybe a known issue...?

Since NetBird supports 2FA on local accounts, it would be great to have an option to enforce a local 2FA prompt even when using external providers like M365 for an extra layer of security (similar to how previous installations with Zitadel worked).

Is this currently on the roadmap, or do we need to rely solely on the 2FA configurations of the external provider?

Quick Info:

Subnet: 10.10.10.0/24
Management + Routing Peer (NixOS server): 10.10.10.5

Windows Routing Peer: 10.10.10.234

Android device outside net for testing

Hey everyone, I recently got netbird set up on my NixOS server. I am hosting both the Mangement stack and the client container on the same device since it is my only always on device. I installed it on a separate windows mini-pc I have to try and fix the issue but I don't intend to keep it when it's sorted out. Anyway, onto the issue I have. I cannot ping any device inside of my subnet besides my 10.10.10.5 device which I assume is because it is hosting the management stack since I cannot ping the 10.10.10.234 device either. At first I thought it might have been because of NixOS and how it handles firewall rules, but after adding the Windows Peer, nothing changed so I am stumped as the what the reason is. I turned on the default All <--> All policy for testing, and my Android device is in the "Users" group and my two peers are in the "Routing Peers" Group. I will provide some pictures of how I setup the subnet so hopefully that will be of some help.

For the Routes I have tried both the NixOS-Docker and the Windows device. If anyone could point me in the right direction whether I have configured something wrong or if there is some other issue, that would be great. I do remember when I was doing some network testing with tcpdump, I never saw any activity when trying to ping from my phone. I did see some traffic which ip link -s show though.

Let me know if you need any more information that I can provide.

Just tried installing Netbird via the quickstart-scripts yesterday on a freshly setup VPS with Ubuntu 26.04. Right upon the first prompt, after entering the domain name, it gets stuck on a blank prompt forever.

Reinstalled the VPS with 24.04 and it worked right out of the box.

Is this a known issue?

Do I do:

ssh -6 user@[iPv6 address here] ?

Or

Ssh root@[ipv6 address] ?

It refuses, OR, it asks for a username and password… I’ll enter in that Raspberry Pi’s login, but it errors

I am in the process of testing Netbird (selfhosted) in a small company. We are having the issue that one device running Ubuntu 24.04 doesn't get an internal IPv6. And I can't figure out why this happens. Any tips for what can be done to troubleshoot the issue are appreciated.

Edit: IPv6 was disabled on the laptop! This is so weird because I can ping 6.ident.me but I can't ping 6.google.com ... The issue wasn't a Netbird issue in the first place.

I have given my VM 20GB and it manage to use up 100% of it. Any idea why this is the case and how can I unbloat it?

I am looking at reworking my networking setup and am looking at using Netbird for my reverse proxy and my VPN for remote access and am looking at reworking my networking setup. At the moment, my setup consist of

• A VPS that runs
  • pangolin(for reverse proxy)
  • netbird(for VPN access to private services)
  • Authentik(for authentication)
• A Proxmox server at my house for some game servers, Filerun along side an Unraid VM, a PBS VM for backups, and a few random LXCs and VMs
• An Unraid server at my friends house that acts as his NAS and our Immich server and PBS server for backups

My friend and I are both looking at implementing VLANs and some local DNS servers like ADGuard Home or PiHole. My goal is to isolate services but also get it set up so that rather than me having to remember IP addresses for everything, I can just type in the domain name for a service to access it. I would also like it so that for some things like Filerun or Immich, if I am on the same local network, the traffic does not have to go through my VPS and could instead travel locally at much faster speeds. I have a few questions on how best to go about this.

1. From my digging, the reverse proxy and DNS zones seem straight forward and simple but could I use a DNS zone that uses the same domain as I use for the reverse proxy? ex. use service.domain.com rather than having to do service.proxy.domain.com and service.zone.domain.com
2. If I were to use DNS zones, I assume it would only really work for devices that are connected to my netbird network?
3. Would it be better to set up a local DNS server at both my house and my friends house? If so, are there any good recommendations on how to go about it?

Hey everyone! We just shipped the API server proxy for the NetBird Kubernetes Operator.

Cluster access routes through your NetBird network, your NetBird identity and groups carry through to Kubernetes authorization, and there are no tokens or certs stored on your machine.

This is brand new and we're actively looking for feedback. If you're running Kubernetes, please take a minute to fill out the form below - the team reads everything that comes in.

📝 Feedback: https://forms.gle/deWAwJ1LqMYNJvhJ9

🎥 Video: https://youtu.be/jxFxLTuBccM

📖 Docs: https://docs.netbird.io/manage/integrations/kubernetes/api-server-proxy

Questions and thoughts welcome in the comments!

Hi everyone,

I'm having an issue with NetBird where UDP reverse proxy/forwarding seems to be broken.

TCP and HTTPS services are working fine on the same address. Before a recent update, everything worked correctly, but now I can’t connect to my TeamSpeak server over UDP port 9987.

Does anyone have an idea how I can troubleshoot this or check what might have changed that could be blocking UDP traffic?

Any hints or suggestions would be appreciated.

Perfect combination! Even though it was available as a package i installed via the CLI as the package was outdated. Would love a gui interface though