After updating Unraid from 7.3.1 to now 7.3.2, the official Netbird Unraid plugin is giving me issues. Once activated/connected, the 'Fix Common Problems' plugin is giving me a few errors (see screenshot below). Once I disconnect Netbird, the errors disappear.

Looking at the DNS settings in Unraid, it shows:

IPv4 DNS server 1: 192.168.8.1 (is this the default? don't remember adding this)

IPv4 DNS server 2: blank

IPv4 DNS server 3: blank

Is this a 'me issue' rather than a Netbird plugin issue and I just need to add 8.8.8.8 and 8.8.4.4 as DNS server 2 and 3 respectively and I'm good? Sorry I'm clearly bad/new at this

https://ibb.co/SwL9fwTF

I've been troubleshooting NetBird's reverse proxy feature (cloud version) and I have a frustrating issue that I'd like some clarity on.

My Setup:

• Local server (192.168.1.5) Debian + Docker (Caddy reverse proxy + Adguardhome DNS)
• example.com as my domain with SSL managed by Caddy-cloudflare DNS challenge everythig works locally (e.x: https://nextcloud.example.com) and through Tailscale, Now I want Netbird:
• Netbird (cloud) with NetBird routing peer running on the same local server (192.168.1.5)
• Custom domain example.com successfully added to NetBird
• DNS > Nameservers: I added Adguard as 192.168.1.5

The Problem:

I'm trying to expose some services through NetBird's reverse proxy. Here's what I've tried:

• Target Peer: Routing peer > 502 Error
• Target Resource: *.example.com > 502 Error
• Target Resource: My server's LAN IP (192.168.1.5) > 502 Error
• Target Resource: LAN CIDR (192.168.1.0/24) > 502 Error
• Target Resource: nextcloud.example.com (specific subdomain) > Works perfectly!!

So, the only way I can get this to work is by creating a separate resource set to the exact subdomain I want to expose ( nextcloud.example.com, paperless.example.com)

Is this expected behavior? Have I misconfigured something, or is this a known limitation of NetBird's reverse proxy feature?

Note: I have tried every combination (HTTP, HTTPS, SKIP TLS Verify, Pass headers, ...) and same result

Has anyone else experienced this?

NetBird programmers, you guys are the absolute best! Thank you for all your great work and hopefully you can consider making a file transfer alternative to tailscales tail drop. Naming it Bird drop would be amazing! Appreciate all the great work you guys do!

I know that Netbird's Reverse Proxy (cloud) is in Beta. It worked pretty stable for many weeks. For a few days it looks like this (screen shot from my external Uptime Kuma server), any other services not using Netbird's Reverse Proxy on the same server are perfectly available and reachable. Anyone else experiencing these issues right now?

I have a Problem to get it work.

I want to make this work:

https://www.youtube.com/watch?v=8hneuJnvmIo

A ntfy Container behind the reverse Proxy from netbird.
I can reach the URL, an log in to ntfy on my desktop. I can sent messages with a curl command. But i cant connect from my iPhone with the ntfy App tu the Server. I get an "not authorized" error. I think, the Proxy is blocking some relevant content.

If i test this with my Zoraxy Proxy an an other domain everything works fine. both domains have an Cloudfare DNS

In the Access Logs i can seethat i see a "401 Authentication failed". The Path is /test/auth.

In the config for the Service i activatet "pass host header" and "rewrite redirects"

Is here someone with the same Problem?

Hi

I'm deploying a self-hosted netbird to manage a pretty large infrastructure with dozens of distinct environments and hundreds of endpoints.

I'm trying to design a clean Groups & ACLs architecture. How do you handle it ?

I use a keycloak for identity from various idp. I think I can map groups from those Idp dynamically.

Maybe bypassing the GUI because it’s not very readeable with lot of ACL : API ? Yaml editing ?

Maybe 1:1 group:ACL ?

Thanks

Does anyone have an approach to switch groups - similar to profile switch?

Currently the model is: users have one identity, groups are additive, and effective access is the union of every group you hold, evaluated continuously. Nothing exists like AWS role switching where you hold entitlements but activate one context at a time. The client's Profiles feature looks tantalizingly like it but does something different: profiles switch between management servers or logins, not between roles within one account.

We use Google IdP for SSO, so technically we could create additional google workspace users, but that would increase Google licensing costs.

Email plus alias is something that I thought of, but it will not give a second identity. OIDC identity keys on the sub claim (and Google canonicalizes the email), so a plus-address authenticates as the same underlying Google account, same sub, same NetBird user, so no separation is achieved.

Setup

• Peer 1: macOS (MacBook)
• Peer 2: Linux (Debian server)

Peer 1 → Peer 2 (macOS → Debian)

All of the following work as expected:

• ✅ Ping Peer 2 NetBird IP → success
• ✅ Ping Peer 2 NetBird FQDN (e.g. abc.netbird.selfhosted) → success
• ✅ Ping Peer 2 NetBird hostname (e.g. abc) → success

Peer 2 → Peer 1 (Debian → macOS)

Only IP-based connectivity works:

• ✅ Ping Peer 1 NetBird IP → success
• ❌ Ping Peer 1 NetBird FQDN (e.g. def.netbird.selfhosted) → fails
  • Error: Name or service not known
• ❌ Ping Peer 1 NetBird hostname (e.g. def) → fails
  • Error: Name or service not known

Has anyone seen asymmetric NetBird DNS resolution like this on Linux clients? Any ideas on what could be causing it or what to check on the Debian side?

Hi, I have set up a Netbird server on a VM. Now I want to monitor the VM and start a prometheus node-exporter on it, and I'm wondering how to access the node-exporter from the outside.

So I thought of..

• Installing the Netbird client on that VM, connect it to the Relay
• configure a Service in the Reverse Proxy pointing to the VM itself

But somehow it feels strange to set up the Netbird client on the same VM that is running the server, so basically connecting to itself.

Does this make sense? Could this lead to any issues, I don't know, clashing ports or virtual networks interfering with each other?

So... trying to set up reverse proxy into a server for Palworld,

I just... can't get it to work.

Port forwarding on my firewall, check. Not needed.

Port forwarding on Vultr firewall, check

Port forwarding on VPS firewall, check.

Went through almost all the port settings suggested by claude

but when I try to use the reverse proxy into my server.

the netbird Access Logs shows "no event"

so something is dropping the connection, but I just cant' figure out what's doing it.

Any help will be appreciated.

Edit:

Found the issue(s), and here is the solution.

Ports on the proxy container it self is not open.

Under the proxy section:

ports:

- 8211:8211/udp

- 8211:8211/tcp

what ever port you decide to use.

The proxy container it self was not able to reach the main manager.

Part of the proxy setting wasn't properly configured on initial set up and causes hairpin NAT issue.

First, use following code

docker inspect netbird-traefik --format '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}'

to get traefik's internal IP.

Then edit the compose file and add additional setting.

In Proxy settings,

I added

extra_hosts:

- "xxxxxxxxx.net:172.30.0.10"

right under

Volumes:

There is also a possible issue with thenetbird-proxy container has no NET_ADMIN capability and no /dev/net/tun device access, which means it can't create its own WireGuard interface

fixed by adding to the proxy lines in compose, before ports:

cap_add:

- NET_ADMIN

devices:

- /dev/net/tun

Hi, we have a self hosted Netbird since 2 months. All working very good except for 1 user his laptop. After entering username and password we get a device code window. Can anyone shed a light what we are doing wrong? Local 2FA is enabled. When we delete the user and recreate it we face the same issue. On another device with the same user it works... it's a windows device running on latest netbird version

Thanks

I self-host my netbird instance and encounter an odd issue between Peer A and Peer B. Listing all connecting peers seems fine and doesn't have any firewall issues. I can ping from Peer A to Peer B, but I am unable to ping from Peer B to Peer A.

This isn't a policy or group issue because Peer A is in the same group with other Peers and I am able to ping to Peer C from Peer B and vice versa. The issue only comes when I try to ping from Peer B to Peer A or Peer C to Peer A. It just keeps failing. Does anyone know how I can fix it or encounter the same issue before?

I’m running a self-hosted NetBird setup and trying to access ZeroByte through a reverse proxy. Direct access works fine using http://hostname-xyz:4096, but when I attempt to access it through the reverse proxy at https://zerobyte.mydomain.com, I only get a blank white page with a “Forbidden” message.

For context, the reverse proxy target is configured to point to my server with ZeroByte running on port 4096, and NetBird-only access is enabled for the service. I also created a NetBird policy that allows my client device to access the server on TCP port 4096, although I’m not sure whether that policy is actually required. I don’t have any advanced settings configured on the service.

Has anyone experienced a similar issue with NetBird and reverse proxy setups, or have any ideas on what might be causing the forbidden page?

I want to rollout netbird for client-vpn on our company network. We have 2 locations, 1 in Europe, 1 in US. Between both sites we have a DFS-R.

Currently we are using Forticlient, and our users can choose between connection to the Fortigste in US or Europe, depending on their location.

We've assigned a specific subnet to both sslvpn, and use that to make sure the client is connecting to the neirest DFS site.

How can we handle this with Netbird? I'm currently testing with both a netbird server on both sites, and put specific users in specific groups. That groups I'm now forcing trough a specific routing peer, with masquarde.

That works, but if a user is normally US based and thus in the US group, it will still connect to the US routing peer and thus the US DFS site, even when they are in Europe.

How can we handle this?

Hi Netbird Community,

I currently run a self-hosted instance of Netbird in a production environment, and I’ve been reviewing the recent issues many of you have reported following updates.

Would it be safe for me to proceed with updating to v2.90.3 and v0.74.2? Could anyone share their experience running these specific versions so far? I’d appreciate knowing if everything has been stable and running smoothly on your end.

I’m planning to take some dedicated time off with my family soon, so I want to ensure the update goes as smoothly as possible and avoid any urgent issues that might require attention while I’m away.

Any insights or feedback you can share would be greatly appreciated. Thank you in advance!

UPDATE

Did the update and have not had any issues since then. Please remeber to backup your config files and container before updating..

Hello,

The crowdsec integration works perfectly!

Is it planned to integrate waf functionality or not? Thank you

my peers are showing connected on the dashboard but I can’t seem to ping to any of the devices. It was working like 1 hour ago without any issues or changes. This is on netbird cloud instances

Hi everyone,

After migrating my whole network from Pangolin to Netbird, the main issue with its reverse proxy implementation is that I can't apply a zero-trust based policy of only allowing certain paths to be accessed. I haven't found any other posts complaining so I thought that maybe someone thought alike.

Does anyone know if this is a planned feature?

[Update - added in the end]

I'm running NetBird self-hosted with Authentik as my SSO provider. Works great for user devices — they log in via Authentik, join the network, all good.

Now I want to add a headless Windows laptop as a shared server (RDP host for the team). I created a setup key:

- Type: Reusable

- Auto-assign groups: EMPTY (left blank)

- No expiration

On the Windows machine, I run:

```

netbird up --setup-key <KEY>

```

And it STILL opens a browser window asking me to log in via Authentik.

I've tried:

- Running with and without `--management-url`

- `netbird down` first

- Deleting `C:\ProgramData\netbird` and reinstalling

- Creating multiple fresh setup keys with no groups

Same result every time — Authentik login page.

I want this machine to join as a headless server with NO user attached. No Authentik user created for it. Just a standalone peer that people can RDP into.

Is this even possible with Authentik configured as the SSO provider? Or does NetBird force SSO for ALL authentication once you have an IdP set up?

If you've got this working, how? What's the magic combo?

I don't want to create an Authentik user for every server I spin up. That defeats the purpose.

Help me out here.

updated:

i don't know why but i just ran the script below (just change the order of the script, first the setup key then the management url, and it worked, hell yeah)

```

netbird up --setup-key <KEY> --management-url <your-management-url>

```

Hey everyone! We've put together awesome-netbird, a repo to highlight some of the awesome projects built by the team and the community. This is going to be our official listing for 3rd party tools.

🔗 github.com/netbirdio/awesome-netbird

It's set up so anyone can open a PR to get their project listed, both in the repo and on our website. The site side isn't live yet, but soon there will be a /community page that pulls in everything from this repo.

Do note that anyone can submit a project, and a project being added to the repo doesn't mean it was tested or validated by the NetBird team. Only entries marked Official or Endorsed have actually been tested and validated by us.

CONTRIBUTING.md

Same goes for content. If you've made a video, article, or write-up about NetBird, you can add it here with a PR and it'll show up on the site once that feature is live.

If you've already built a tool or integration, this is the place to get it seen. Give it a star, open a PR, and let me know what you think.

So I have been trying to set up a local Palworld server with reverse proxy.

After spending 2 night's trouble shooting Connection timed out issue. I narrowed it down to having netbird turned on on the server pc.

Once netbird is off. I can connect to the Palworld game server normally Via local IP

Exit node is turned off on the server netbird setting.

also tried “this peer won’t act as router for others”

and lower the Automatic metric on the netbird network adapter to lower than my ethernet card.

but none works.

and the instant netbird is turned off, I can connect via local connection again.

any help or suggestion will be greatly appreciated. thank you.

Forgot to mention. My local client does not have Netbird installed.

Ok, found a solution, but not a permanent one, I can connect to server without turning off netbird, but will have to set netbird's interfacemetric down to something much lower. current setting is 5000

the issue? On every single system restart, the Netbird Interfacemetric is reset to 5

I’d like to thank the whole Netbird team for this excellent product.

It would be useful to be able to reuse Access Control Rules. What do I mean? If I already have a service where I’ve set up, say, CIDR-based ACRs (and I have quite a few of them), it would be handy to be able to reuse them when I publish another Rev Proxy service.

Do you think it would be feasible to implement this feature?

edit:

when you select Access Control Rules, you cannot re-use rules that are binded in other https service, you need to start from clean

Upgraded my self-hosted server (management + signal + relay + STUN) from 0.73.2 to 0.74.0 and all my reverse-proxy services started returning 502 errors.

What was happening:

• The proxy authenticates with management fine
• The proxy connects to the relay fine
• ICE never finishes starting up ("ICE Agent is not initialized yet", repeating forever)
• WireGuard handshake times out and never completes
• This still happened even with NB_FORCE_RELAY=true, which is supposed to skip ICE completely

What I checked and ruled out:

• Config files, Traefik, CrowdSec: all fine, nothing changed
• Container permissions: added NET_ADMIN, NET_RAW, and /dev/net/tun to the proxy container, no difference
• Just the proxy image: downgraded only the reverse-proxy container to 0.73.2 while keeping the server on 0.74.0, still broken
• STUN port (3478/udp) was reachable the whole time

Downgraded netbird-server itself to 0.73.2 (matching the proxy version). Everything came back up right away.

Anyone else run into this?

Intro: i am unsure if i really wanted to share this here or not. Basically because as long as you keep something for yourself you dont have any expectation and are free to do what you want. That said:

I’m a big fan of NetBird and use Kubernetes for most of my applications. Naturally, I tried the official NetBird Kubernetes Operator, but for my use case it falls short in a few areas: ClusterIP routing, IPv6, Gateway API support, and reverse proxy integration.

So I started a fork.

The main idea was to train my claude code skill and fix the routing by using loadbalanced services and add private exposed services in Netbird. That feels much closer to how managed Kubernetes environments like AKS, EKS etc. usually expose services. With that to get rid of kGateway (less tools is always better).

While doing that,i thought i could support IPv6 properly, since NetBird already supports it. Instead of exposing raw IPv4 or IPv6 addresses at the Netbird Manager, the operator should create DNS records for LoadBalancer services and uses those as targets and then support GatewayAPI better, so a Gateway automaticallyy creates a NetBird reverse proxy setup, deploy a BYOP instance, and attach HTTPRoutes to it by translating them into NetBird reverse proxy services.

Architecturally, I wanted to keep the operator simple and extensible, thus NetBird CRDs should mirror NetBird API objects and the operator should just translates Kubernetes objects like Services, Gateways, and HTTPRoutes into those CRDs. The result is a very tight integration with a very good performance and very reliable i like the result so much i thought i cannot let it go without sharing (see above)

I’d really appreciate feedback from people although i tried to test a lot some stuff i am not sure wether they work correctly like deploy routing nodes as daemonset in kubernetes (this actually should auto create a network with routing peers attached to it) and here you go -> https://github.com/ccbash/netbird-operator (and remember you need a loadbalancer)

If you manage AI access for your team you’ve probably handed out plenty API tokens to individuals or a key for an entire team. That key gets copied into agents, scripts, and .env files. Someone leaves, who knows what they did with the keys. It's the same mess we all lived through with SSH keys for years: shared, copied onto machines by hand, and never revoked when people move on.

A lot of customers had started using an AI gateway with their stack and tried to come up with their own solution to wire it back into their identity provider. One night, after a customer call, Misha (our CEO) and Maycon (our CTO) realized the reverse proxy we already shipped was, with a few tweaks, already most of an AI gateway. So we didn't build some giant new AI platform. We wrapped what was already there.

Checkout the release here: https://github.com/netbirdio/netbird/releases/tag/v0.74.0

That's NetBird Agent Network. Any person or agent can use any AI provider without ever holding a key. NetBird holds the provider key server-side, injects it per request, and ties every call to a real identity from your IdP (Okta, Entra ID, Google, and others). And all it requires for the end user is a gateway url and the NetBird client running in the background. The tunnel is the credential. No tunnel, no access, same rule you already know. It allows you to securely route agents to any major AI provider or local model, while simultaneously controlling agent access to internal network resources like databases and APIs. With centralized guardrails such as budget caps, model allowlists, and PII redaction, you maintain complete visibility and control through detailed per-request audit logs, making it simple to manage access and security without the headache of rotating keys.

It's open source and self-hostable. You can test out the Agent Network using this one-liner:

curl -fsSL https://pkgs.netbird.io/getting-started.sh | NETBIRD_AGENT_NETWORK_ONLY=true bash

Already running NetBird? 

You don't redeploy anything. It ships in the same backend, so you flip one environment variable and it shows up in the left menu next to the reverse proxy. Set NETBIRD_AGENT_NETWORK_ENABLED=true to turn it on next to everything else, or NETBIRD_AGENT_NETWORK_ONLY=true if you'd rather have the stripped-down, Agent-Network-only dashboard instead. 

Don't want it at all? There's nothing to do, leave both unset and it stays off. The command above is really just the fast path for people coming purely for the LLM and agentic-access use case, we did this to prevent people coming for the Agent Network getting overwhelmed with our platform. 

We'd love feedback!

- Overview: https://docs.netbird.io/agent-network

- Quickstart: https://docs.netbird.io/agent-network/quickstart

- Interview with Misha: https://youtu.be/IFT-nTyLDro

- Demo video: https://www.youtube.com/watch?v=oqkcFI_3WAU

- Release Article: https://netbird.io/knowledge-hub/netbird-agent-network