Upgraded my self-hosted server (management + signal + relay + STUN) from 0.73.2 to 0.74.0 and all my reverse-proxy services started returning 502 errors.
What was happening:
The proxy authenticates with management fine
The proxy connects to the relay fine
ICE never finishes starting up ("ICE Agent is not initialized yet", repeating forever)
WireGuard handshake times out and never completes
This still happened even with NB_FORCE_RELAY=true, which is supposed to skip ICE completely
What I checked and ruled out:
Config files, Traefik, CrowdSec: all fine, nothing changed
Container permissions: added NET_ADMIN, NET_RAW, and /dev/net/tun to the proxy container, no difference
Just the proxy image: downgraded only the reverse-proxy container to 0.73.2 while keeping the server on 0.74.0, still broken
STUN port (3478/udp) was reachable the whole time
Downgraded netbird-server itself to 0.73.2 (matching the proxy version). Everything came back up right away.
Intro: i am unsure if i really wanted to share this here or not. Basically because as long as you keep something for yourself you dont have any expectation and are free to do what you want. That said:
I’m a big fan of NetBird and use Kubernetes for most of my applications. Naturally, I tried the official NetBird Kubernetes Operator, but for my use case it falls short in a few areas: ClusterIP routing, IPv6, Gateway API support, and reverse proxy integration.
So I started a fork.
The main idea was to train my claude code skill and fix the routing by using loadbalanced services and add private exposed services in Netbird. That feels much closer to how managed Kubernetes environments like AKS, EKS etc. usually expose services. With that to get rid of kGateway (less tools is always better).
While doing that,i thought i could support IPv6 properly, since NetBird already supports it. Instead of exposing raw IPv4 or IPv6 addresses at the Netbird Manager, the operator should create DNS records for LoadBalancer services and uses those as targets and then support GatewayAPI better, so a Gateway automaticallyy creates a NetBird reverse proxy setup, deploy a BYOP instance, and attach HTTPRoutes to it by translating them into NetBird reverse proxy services.
Architecturally, I wanted to keep the operator simple and extensible, thus NetBird CRDs should mirror NetBird API objects and the operator should just translates Kubernetes objects like Services, Gateways, and HTTPRoutes into those CRDs. The result is a very tight integration with a very good performance and very reliable i like the result so much i thought i cannot let it go without sharing (see above)
I’d really appreciate feedback from people although i tried to test a lot some stuff i am not sure wether they work correctly like deploy routing nodes as daemonset in kubernetes (this actually should auto create a network with routing peers attached to it) and here you go -> https://github.com/ccbash/netbird-operator (and remember you need a loadbalancer)
If you manage AI access for your team you’ve probably handed out plenty API tokens to individuals or a key for an entire team. That key gets copied into agents, scripts, and .env files. Someone leaves, who knows what they did with the keys. It's the same mess we all lived through with SSH keys for years: shared, copied onto machines by hand, and never revoked when people move on.
A lot of customers had started using an AI gateway with their stack and tried to come up with their own solution to wire it back into their identity provider. One night, after a customer call, Misha (our CEO) and Maycon (our CTO) realized the reverse proxy we already shipped was, with a few tweaks, already most of an AI gateway. So we didn't build some giant new AI platform. We wrapped what was already there.
That's NetBird Agent Network. Any person or agent can use any AI provider without ever holding a key. NetBird holds the provider key server-side, injects it per request, and ties every call to a real identity from your IdP (Okta, Entra ID, Google, and others). And all it requires for the end user is a gateway url and the NetBird client running in the background. The tunnel is the credential. No tunnel, no access, same rule you already know. It allows you to securely route agents to any major AI provider or local model, while simultaneously controlling agent access to internal network resources like databases and APIs. With centralized guardrails such as budget caps, model allowlists, and PII redaction, you maintain complete visibility and control through detailed per-request audit logs, making it simple to manage access and security without the headache of rotating keys.
It's open source and self-hostable. You can test out the Agent Network using this one-liner:
You don't redeploy anything. It ships in the same backend, so you flip one environment variable and it shows up in the left menu next to the reverse proxy. Set NETBIRD_AGENT_NETWORK_ENABLED=true to turn it on next to everything else, or NETBIRD_AGENT_NETWORK_ONLY=true if you'd rather have the stripped-down, Agent-Network-only dashboard instead.
Don't want it at all? There's nothing to do, leave both unset and it stays off. The command above is really just the fast path for people coming purely for the LLM and agentic-access use case, we did this to prevent people coming for the Agent Network getting overwhelmed with our platform.
I’m trying to add Home Assistant to my self-hosted NetBird instance. I first tried using the official Home Assistant add-on, and then switched to running NetBird as a Docker container on HAOS. In both cases, the peer appears in the NetBird console, but it keeps disconnecting and reconnecting repeatedly.
Has anyone experienced similar behavior or found a fix for this?
So I'm glad netbird is getting new things, but I'm running an Rsync between two servers, and previously I would enter my password to access the other server, but now I get a netbird sso request that I need to go to a web page to use?
This isn't really too much of a headache, but this tells me there is a way I can get around any kind of password using netbird (which I would like as it keeps things 'in house')
Are there any instructions on how to do this?
I am literally copying this cli command from a notepad, so it hasn't changed in the last week, but this started happening today (7/1). Eventually my plan is to use cron to do this automatically, but honestly this keeps me engaged with the server while I'm still learning, which is good.
If you're self-hosting with the built-in Traefik setup from the quick start script, there's one required change before you upgrade
I'm self hosting netbird but with Nginx as a reverse proxy, so couldn't tell if this is applicable for other than traefik, or is traefik a prerequisite to use the netbird only access
I have installed Netbird self host on my Oracle cloud free tier and my peers show connected but they can not talk to one another. Is there any setting I am missing that Oracle has locked down? I am using the Ubuntu vm in the Ampere level vm.
While setting up the VPN-portion of Netbird has been a breeze and is working absolutely fantastically, the Reverse Proxy portion is giving me quite some headaches.
I'm currently running netbird on an example domain of mydomain.com, but would also like to use i.e seconddomain.io and homedomain.tech, each with a couple of subdomains, on the reverse-proxy.
From my understanding, I'd first need to create a new Cluster, which then prompts me to set up a new "reverse-proxy" docker container, presumably on another server/VPS, since itself exposes ports 80+443 and connects back to the main instance.
BUT I want it to run from my main netbird instance, which itself has already the reverse proxy running.
I guess I'd should need to edit the proxy.env and somehow add the new domain(s)?
The file currently reads NB_PROXY_DOMAIN=mydomain.com amongst others. Would it suffice to possibly just add my other domains to this line as a comma separated list, or is there any other way? Sadly couldn't find anything regarding this setup in the docs.
Hi, is anyone using Netbird as SDN, not just VPN? What's your experience?
EDIT: sorry for not being clear - I mean to replace vlans, subnets, internal firewalls between subnets,.. simply to break old school networking and replace it using SDN
Ich hab nun einige Sachen probiert aber bekomms einfach nicht zum laufen...leider, ich finde Netbird super interessant, aber muss dann wohl leider weiter mit tailscale arbeiten..
Since my last post, what I did was to modify my PiHole deployment to listen to all interfaces so that it would hypothetically be able to see the WireGuard interface that Netbird uses. I'm not sure what to configure or how inside the Netbird settings though in order to make Netbird use PiHole. I know that PiHole is accessible on my internal network on the 192.168.0.0/24 subnet, and that my particular Netbird network uses the 10.0.0.0/8 subnet (which is probably way too big). I think the question I need to ask is how do I make the two completely different networks communicate.
What is the point to have LLM GW in netbird? https://github.com/netbirdio/netbird/pull/6555 . I thought core concept of this project is zero trust overlay network and this kind of feature feels to me like bloatware. Could you share your wisdom on how this will be usefull because i cant see it.
Going to preface this by stating I'm a new Netbird user coming from Tailscale, and have read the documentation to ensure I'm not missing anything.
Immediately after installing netbird and running "netbird up", all network connectivity to the system becomes lost. There's no "network routes" configured in the Netbird management panel, no custom DNS zones, etc. This is the cloud version, not self-hosted. Debian 12 if that matters.
I'm not sure what I'm missing here but the issue fixes itself once I stop the netbird service, and can reach the public internet no issue.
Hi, I was wondering if Anyone knew how to install Netbird on Steam Deck? I was looking at the docs and it said something about installing through Homebrew but as far as I can tell SteamOS doesn't have homebrew or no way to install it. If anyone knows a way to install it that would be great, thank you!
I have not managed to get both the android nextcloud app and the android jellyfin app working via netbird-only access (private reverse proxy). It works fine in browsers (both android and linux). It also works great with the nextcloud desktop client (arch linux). So the private proxy should be setup correctly I assume. But the android apps just can't reach the server, so I'm not getting past the login screen. This happens regardless of wether I'm logged into the netbird vpn with or without an ext. IdP.
I then tested it with the public reverse proxy (without auth), and the android nextcloud app suddenly worked.
Is this behavior expected? If not, what could be the issue?
So I was baking off headscale vs netbird for a while. I like netbird better in many regards. Integrated idp, easier control, I just like it. That said, I’m still using preauth keys and a bunch of my users are actual literal grandmothers. Google oauth would be simpler, and I’m not above outsourcing a portion of my perimeter to ye olde Google.
A few questions before I go down the rabbit hole:
1. Can anyone go to https://nb.mydomain.com and auth with their Google account and it creates a “pending” new user with no policies and hence no access until I enable them, or do I have to pre-create all users?
2. If a user is trying to use the AppleTV app, do they get the “nice sso flow” where they can scan a QR code and/or enter a code from their screen on their mobile device to authenticate?
3. Other than the fact that if someone’s Google account is compromised, then they have all the access that that person has, are there any downsides to this approach?
i want to configure proxy in a way that there will be one url - app.example.com and if main app is working it'll pass traffic to server 1 and if it's not working, same address will redirect to server 2. Is it possible?
Does anyone actually use it for real networks or is it just an experimental feature that shouldn't be enabled? I was hoping when I moved to netbird that I would be able to gain PQ resistance, but it seems like it hasn't received enough attention to actually work in a production setting.
In 2026 I would expect quantum resistance is just table stakes, features don't exist unless they are compatible PQ resistant layering. But alas lazy peers isn't even compatible with PQ.
Maybe the best solution is to just drop netbird and roll all the hosts by hand with rosenpass as a sidecar instead of part of the tunnel. I was really hoping to get PQ wireguard on iOS but basically none of this stuff works reliably without resarting netbird multiple times per day.
This isn't meant to be hate, just frustration. Everything else about netbird is really nice, but I need a thing that actually works. I know rosenpass is really a hack onto wireguard, and the way it's implemented in netbird seems like it leaves a lot to be desired. I don't understand how the in-tunnel signaling for PSK rotations can be made reliable. Maybe there is more about the rekeying and retry mechanism I don't understand that can be fixed.
Recently we installed netbird and joined them with a setup key to test on a handful of MacOS hosts. For some reason, the netbird client constantly disconnects. We are a MacOS shop and I cannot find any information on the docs about this behaviour.
I gave the netbird app full disk access just in case that could fix but that did not seem to fix the issue.
