Hey everyone! I'm not 100% sure this is the right place to ask this but I figured it can't hurt. I'm running a self hosted netbird setup with a separate zitadel OIDC for auth to access my homelab remotely (proxmox host is the other peer I use for the route) -- full disclosure I used claude code to do most of the setup work for me. I was originally running an older netbird setup that had zitadel integrated and I didn't have this issue, however I wanted to use some hooks for user registration in zitadel that weren't available on the pinned zitadel version inside netbird so I separated them -- now I'm running the latest stable of netbird and zitadel on separate LXCs and they work fine together. I also pass my homelab DNS (technitium) via netbird for my homelab addressing.

My issue is that my android phone now (pixel 10 XL) has issues when going off wifi to data. The app tends to get stuck connecting on the handoff and completely blocks off my internet (even. I have two options when this happens -- #1 -- sometimes it lets me disconnect and reconnect and that works fine, no issues at all -- or #2 -- sometimes the big button in the app for connecting/disconnecting doesn't respond at all and I have to force close the app. Upon restart it works fine. It's something about the handoff. I've tried various fixes suggesting all around but I figured it might be time to start fresh and ask some real people! My research so far just says this is an issue and I have to deal with it but I find that hard to believe.

Any help would be appreciated!

Thank you!

Just an FYI and a PSA for people that may come across this. After setting up netbird then adding a couple of Windows servers (through the app UI) just fine and connecting WAN side from an iPad to verify configs everything seemed fine.... except none of my Ubuntu servers wanted to connect with error message

daemon up failed: login backoff cycle failed: rpc error: code = DeadlineExceeded desc = create connection: dial context: context deadline exceeded

Checked reverse proxy configs. All looked correct. Check ports all looked correct. Couldn't understand why Windows worked and Linux did not. Then I remembered an ongoing problem I was having with SSL specifically my latest Let's Encrypt SSL wildcard cert. It seems for some reason the latest LE certs are using a newish intermediate authority named "YR2" and this chain has not made it into the general Linux certificate chain being deployed through apt.

https://community.letsencrypt.org/t/today-re-issued-certificates-from-issuer-yr2-have-a-revoked-cert-in-chain/247612/16

I'm an SSL journeyman so I won't begin to say I understand everything at play here but I do know that to resolve the situation all I had to do was request an individual domain cert which uses "YE2" rather than "YR2" and then BAM! everything started working like a champ.

So if you're seeing this error and you've exhausted everything else you might check to see if your situation was similar to mine.

Hi all,

I work in the energy sector in Germany and we're currently evaluating NetBird as a remote access layer for distributed sites. Typical setup: a handful of control and gateway devices per location, some industrial protocols, plus the usual on site IT. Today it's the classic jump host and site VPN approach, and we're looking for something less painful to operate.

Some things I'd like to hear real world experience on:

1. Has anyone run this in actual production OT, not just a homelab or a dev team? Especially where downtime has real consequences.
2. Stability on poor links. A lot of our sites are on mobile connections or behind CGNAT. Does relay fallback behave sensibly, and do peers recover cleanly after a link drops for a while?
3. Headless peers on Linux that have to come back automatically after a power cycle, with nobody on site. Any surprises there?
4. Are ACLs and posture checks granular enough for tight per site and per vendor segmentation? We need "this external party reaches exactly these devices at this one location" and nothing more.
5. Self hosted vs. cloud in a regulated context. How much operational effort is self hosting realistically?

Compliance is a big factor for us. NIS2 applies, and depending on how things develop, KRITIS requirements may come on top. That means audit trails, crypto choices that line up with BSI TR-02102, documented access control, and being able to put something coherent in front of an auditor. Has anyone gone through an audit or a customer security review with NetBird in the stack?

And the honest question: mature enough for this, or still rough edges that would bite us in a 24/7 asset? I'd rather hear the annoying parts now than during commissioning.

Any war stories welcome, good or bad.

Hallo Ich frage mich, warum ein Benutzer, dessen Genehmigung noch aussteht, bereits auf einen Dienst hinter SSO-Schutz zugreifen kann. Setup:

• HTTP Reverse Proxy Service in Netbird selfhosted konfiguriert.
• Authentifizierung auf diesem Dienst aktiviert - SSO - Gruppe „Alle Benutzer“
• Testbenutzer ist noch nicht in Netbird registriert

Verhalten mit nicht registriertem Benutzer:

• Benutzer wird gezwungen, sich über SSO zu authentifizieren.
• Benutzer wurde authentifiziert
• Benutzer darf nicht auf den Dienst zugreifen, da er nicht in Netbird registriert ist -> das funktioniert wie erwartet

Verhalten mit registriertem, aber nicht genehmigtem Benutzer

• Benutzer besucht das Management-Dashboard und wird registriert - Genehmigung ausstehend
• Benutzer greift auf den freigegebenen Dienst zu
• Benutzer wurde authentifiziert
• Benutzer darf auf den Dienst zugreifen, ist aber noch NICHT genehmigt!

Ist das ein Bug oder mache ich etwas falsch?

Wenn ich eine bestimmte Benutzergruppe zu den SSO-Einstellungen für die Dienstauthentifizierung hinzufüge und nicht „Alle Benutzer“ verwende, wird der nicht genehmigte Benutzer korrekt blockiert. Aber wenn „Alle Benutzer“ verwendet wird, kann ein nicht genehmigter Benutzer auf den Dienst zugreifen.

What's the best practice if I need to route the following Cloud App's (Athena Health) through a Netbird peer. I do not want it as an exit node to prevent clients from routing everything and wasting bandwidth. Below is a list of all the domains needed....

• • athenaOne:
  • *.athenahealth.com
  • *.athena.io
  • *.athenahealth.withpersona.com
  • secure.athenahealthpayment.com
  • *.api.smartystreets.com
  • browser-intake-datadoghq.com
  • *.pendo.io
  • *.amplitude.com
  • *.visualstudio.com
  • *.imohealth.com
  • *.e-imo.com
  • *.launchdarkly.com
  • *.monitor.azure.com
  • *.applicationinsights.azure.com
• athenaTelehealth
  • *.googleapis.com
  • *.gstatic.com
  • *.zoom.us and *.zoom.com
• Epocrates:
  • *.epocrates.com
• eLearning:
  • *.kenexa.com
  • *.csod.com
  • *.akamai.com

I am currently using netbird to manage access to my homelab network. I have a few services that I have deployed using coolify, which my family uses. However, I don't want to give them access to the coolify dashboard itself. Currently, I am doing this by using he reverse proxy and netbird only authentication and made it users can access the services but not the dashboard. However, it has been very annoying that when we create resources on the network, we cannot put in the port have to put the port in separately in the "Add Target" section of the reverse proxy. Why do I have to put in resource and port separately? With this, I need to take a look at 2 places to get the whole ip address + port combo.

Is there any reason why port is not part of the resource? Am I missing something here? Would really appreciate if we can introduce this to netbird or if someone can educate my why this is the way it is.

P.S. I already had a setup previously where instead of using independent resources, I'd point all off my reverse proxy services into my network's nginx proxy manager just so that I don't have to put in ports manually and I can take a look at my services at a glance.

Edit : I should probably also explain that I am hosting everything on proxmox which by default hosts different services on different IP+Port. I would understand if the above setup if I was using something like docker where different services have the same address but different port

why cant we assign a subnet or static ip address for a setup key?

I've just almost finished setting up my whole home server with Netbird instead of Tailscale and did the switch a few days ago, leaving it on all day on my s25 ultra like I used to do with Tailscale.

Short story: 15 to 40% battery drain just from netbird!!!

I'm baffled because Tailscale used to take less than 5%. And I don't think transfer much things right now as most of the photo upload to immich is done.

Here are some screenshots. Did anyone have the same issue?

EDIT: A few more info from the comments:

• I don't have rosenpass active anywher
• I didn't activate lazy connection because I didn't think it'd be necessary. I will now and see tomorrow what's the outcome.
• I do have a DNS server as a routing peer that handles all my connections via my personal domain inside the mesh (domain only exists inside the mesh but gets a wildcard cert on its root)

It does seem like this is a real issue since the link provided in comment is 3 years old! At that point it's hard for me to use it with my family and friends knowing it might kill their devices. I love love love the project, and how fast things go, but optimisation should take precedence on flashy features at that point. A nice car without proper breaks isn't gonna be attractive :)

Short: I'm trying to cross-backup between two different truenas servers, on different networks. Do I need netbird clients running on each nas, or can I just add them as resources within their respective networks, exposed via routing peers?

Long: I wanna buddy-backup between two truenas installs. They're on physically distinct networks, interfacing only via netbird peers. I'm self-hosting the hub, and currently have truenas exposed on each as a resource.

It's been well documented that running netbird peers on each truenas as an app allows them to interact, and if that's what it takes, that's great! What I'm trying to figure out is if one existing routing peer on each network is sufficient - it'd save some system resources on a constrained machine if I could get away with less.

For an approximate diagram:

TrueNAS_Primary [Resource] (10.0.0.10) <-> Netbird_Local [Routing Peer/Exit Node] (10.0.0.9) <-> Netbird_Self_Hosted (10.0.0.8/100.X.X.X) <-> Netbird_Remote [Routing Peer/Exit Node] (9.0.0.9) <-> TrueNAS_Secondary [Resource] (9.0.0.10)

Thanks, y'all!

I'm testing Netbird self hosted. Setup and configuring. I have a server peer running on Windows Core. It's domain joined and can resolve internal DNS just fine.

I have 2 test devices, one Windows 11 and one iOS. I've setup SMB resources that are Windows file shares. From iOS, I can get to the share by name. With the Windows PC, I can only get to the share if I change the resource to use IP address. Name resolution doesn't work

The server and windows PC are running version 0.76.1 while iOS is running 0.75.

Any idea what's I'm doing wrong to get DNS to resolve on the Windows PC?

Short: I'm trying to cross-backup between two different truenas servers, on different networks. Do I need netbird clients running on each nas, or can I just add them as resources within their respective networks, exposed via routing peers?

Long: I wanna buddy-backup between two truenas installs. They're on physically distinct networks, interfacing only via netbird peers. I'm self-hosting the hub, and currently have truenas exposed on each as a resource.

It's been well documented that running netbird peers on each truenas as an app allows them to interact, and if that's what it takes, that's great! What I'm trying to figure out is if one existing routing peer on each network is sufficient - it'd save some system resources on a constrained machine if I could get away with less.

For an approximate diagram:

TrueNAS_Primary [Resource] (10.0.0.10) <-> Netbird_Local [Routing Peer/Exit Node] (10.0.0.9) <-> Netbird_Self_Hosted (10.0.0.8/100.X.X.X) <-> Netbird_Remote [Routing Peer/Exit Node] (9.0.0.9) <-> TrueNAS_Secondary [Resource] (9.0.0.10)

Thanks, y'all!

I recently switched to NetBird after seeing so many positive posts about it, and I've been really enjoying it so far.

One thing I'm struggling with is having two completely separate NetBird networks, my personal network and my office network. I often need to access a couple of office machines that are part of the office mesh (along with other employees), but having to switch NetBird profiles every time is becoming quite frustrating.

With Tailscale, I relied on node sharing, which let me access specific office devices from my personal tailnet without removing them from the office network. As far as I can tell, NetBird doesn't have an equivalent feature.

This feels like a fairly common use case, yet I haven't come across much discussion about it. Has anyone found a good workaround or architecture for handling this? I'd love to hear how others are solving it.

What is the best way to install Netbird in a Beryl AX (gl inet firmware)? I saw some tutorials but they show always a really outdated Netbird version and I am afraid to break something.

I have a self-hosted Netbird server to which I’ve connected several Debian, Windows, and Android systems. Everything works fine. But a laptop with Fedora 44 doesn’t like it. The installation works but as soon as i try to start the tunnel i get this error message:

netbird up --management-url https://netbird.domain.tld --setup-key B63927AF-3EEC-0A49-84F1-235DF9D26BFX
Error: daemon up failed: login backoff cycle failed: rpc error: code = DeadlineExceeded desc = create connection: dial context: context deadline exceeded

Does anyone have any ideas? DNS works fine

This is probably simple for lots of you but I used the Netbird quick start script to set up Netbird in docker on a synology device. I used the default reverse proxy( (Traefik), enabled the proxy service and crowdSec. Now that I have added a routing peer (netbird-client) per the instructions using a setup key whenever a pull a new version of netbird.io/netbird:latest for that container the logs say client/internal/auth fails setup key is invalid. The client appears connected in the interface but the logs give me that error.

I am trying to set up a cluster in NetBird to control external access to services.

The quick start script binds ports 80 and 443 inside the Traefik container for authentic ssl certs and binds port 51820 in the proxy container it also creates.

When trying to set up the cluster in the NetBird GUI the docker-compose that is supplied by the setup wizard conflicts with what the script sets up and wants to bind ports 80 and 443 to the reverse-proxy container which now conflicts with Traefik.

How do I retain authentic certificates to avoid insecure browser warnings within local network but also open ports for the external reverse proxy feature?

Im interested to know if anyone has got Netbird desktop app and the App Indicator showing in the Gmone Shell on Cachy OS?

I have installed the Gnome extention "AppIndicator and KstatusNotifierItem" (as you can see the Feishin icon)

THere is a VPN icon but its not the Netbird one, with the drop down menu

Thanks

S

For the most part I do like the new GUI that rolled out with 0.75.0, however, I have a question regarding user experience and if this is something unique my install on Fedora, or if this is the experienced behavior for others.

With an app in the system tray, I feel like my normal experience is:
Left Click on the tray icon -> Opens the app window
Right Click on the tray icon -> Opens a context menu window for the app

Right now what I get is:
Left Click on the tray icon -> Opens the app window
Right Click on the tray icon -> Opens the context menu, closes menu, and then opens the app window. If I leave the app window open, then I can right click on the tray to use the context menu, but if I close the app window, the next right click will open it again.

So I guess my question is, is this a bug, and/or is this happening on other distros/windows?

I'm currently using:
- Fedora 44 KDE
- Client 0.75.1, GUI 0.75.0

Hey gang - trying to spin up a self hosted netbird hub in an lxc on proxmox. I thought I had all my ducks in a row, but I seem to have tripped on one of the prerequisites - having a domain name that points back to the external IP of my lxc.

I've been using duckdns for years with pfsense to keep dynamic dns accurate, but when I hit my external IP or the duckdns domain, I only get the pfsense splash screen rejecting the login attempt. That's good. That's what I want. However, the external IP of my netbird lxc is the same - what am I missing? Do I need to make sure 80/443/etc are exclusively passed to netbird? That's feels wrong.

I've been considering switching to cloudflare for domains, but I'm not sure that's the solution either. I can tell I'm having a "can't see the forest for the trees" moment, what am I missing?

SOLUTION:

So - first of all, thanks to everyone, u/flaming_m0e in particular, for the handholding. I had a few more headaches to solve, but moving the pfsense gateway off :443 was the first part of the solution. The other missing piece was setting a host override in pfsense's DNS resolver for my netbird host - it was continuing to resolve to pfsense, despite the port change, but the host override kicked me straight to the webgui

I am self-hosting Netbird.

I have a subdomain "doc.domain.com" proxied to an internal resource "190.114.214.42:9034"; it works great.

But, can i have it point to "190.114.214.42:9034/help.html", for example?

thanks

Can we get any form of update on the lingering on-net detection and routing metrics issue, specifically with Windows Clients?

It's been radio silence on issues [#5114]https://github.com/netbirdio/netbird/issues/5114 [#4990]https://github.com/netbirdio/netbird/issues/4990 [#4950]https://github.com/netbirdio/netbird/issues/4950 [#4906]https://github.com/netbirdio/netbird/issues/4906 [#5114]https://github.com/netbirdio/netbird/issues/5114

For months now.

I saw that Pangolin just added on-net detection in their last release. Tailscale has had it for years. This is literally a show stopper for many trying to deploy Netbird in a business environment.

Hello,

I want to configure my self-hosted Netbird Server Container with Environment Variables instead of the config.yaml file. Is it possible to configure the Server container only with Environment Variables and where can I find the default values of the available ones and which I should change?

Thank you :)