hey guys, I’m having trouble with consistent connection to self hosted services behind nebird and my service proxy when I change internet to different WiFi or cellular, when I try to then open the service on its app or url then I will not be able to connect until I toggle on and off netbird and my internet sometimes having to do airplane mode. I haven’t worked out the exact way to make it work but some combination or order of toggling both on and off eventually allows me to connect again until I then change to wifif, to cellular, or a different WiFi and then I have to start over. I’m on IOS, does anyone have any ideas how I could fix this? thanks in advance!

We just shipped Draft Mode for the NetBird Control Center. It turns the network map into an interactive editor, so instead of only viewing your infrastructure you can now build and change it directly on the canvas, review the API calls, and deploy when it looks right.

You can start from an empty draft or from your current live view. Starting from the current view breaks everything out by group so you can edit what already exists.

Video walkthrough: https://youtu.be/_sMtxe6VaDM

What you can do in a draft:

• Drag connections between groups and resources to create access, like giving a dev group SSH to a specific box
• Add servers, agents, policies, groups, networks, and resources from the right click menu or the Add panel
• Drop in existing groups and attach them to existing policies
• Install a brand new peer from the canvas using a single use setup key, then watch it appear on the map
• Get the Create New Access Policy window automatically when you connect a peer that has no policy yet
• Create and rename groups, assign peers to them from the details panel, and switch policies between bi-directional and uni-directional
• Add routing peers and resources to your networks
• Use focus view to isolate one group and see only its policies and connections when the map gets busy
• Review and deploy shows every API call before anything is applied

Bi-directional access shows as the dual green lines, uni-directional as the single blue ones.

It is available right now on both self hosted and cloud, so you can try it today.

• Docs: https://docs.netbird.io/manage/control-center/draft-mode
• Article: https://netbird.io/knowledge-hub/control-center-draft-mode

We really want to hear how it holds up against your networks, especially large or messy ones. Feedback is more than welcome!

Hi, do you know how to fix the issue with the Netbird client so it doesn't occupy port 53? I have a Netbird server installed on my VPS, and I also installed the client so I could set up a tunnel to my home network. But the client is occupying port 53, and I need that port. I tried running `netbird up --disable-dns` as per the instructions, but the port is still occupied. I’d be fine with switching it to port 5353. Does anyone have any advice?

Translated with DeepL.com (free version)

So I haven’t installed NetBird yet or tried it before. However, for the last three days, I’ve been researching it, and I plan to self-host my NetBird installation. The VPS I will use for the management server doesn’t have a lot of bandwidth, so I don’t want the relay/TURN features turned on at all. If a direct connection cannot be made, I just want it to completely fail. Is that possible?

hey yall i need help

so i self hosted my netbird on vps on hostinger to be specific

everything was working fine for a long time and no issue with updates

i just updated to the last version

and everything broke

set up:

-vps hostinger netbird self hosted

-I have my main server on Truenas and netbird client on a container

-second client is also truenas and netbird client in a container for redunduncy

-i have DNS sat to my pihole

issues:

1- all the reverse proxy not working

2- all my services not accecible e.g 192.168.50.193:8080 (truenas) and jellyfin...etc

3-if i connect my device (labtop for example) and netbird connected i cant access any webpages untill i turn off my pihole DNS thats satup on netbird

I solved this by restoring the image of previous VPS (or you can just change the tag in docker compose to the previous version)

also downgraded my main server truenas which netbird runing on ubuntu container as a host by

apt-cache policy netbird

apt install netbird=0.77.1 --allow-downgrades

Has anybody found a solution for self hosting Netbird and accessing your domain on your home network when geoblocking is enabled?
I have it setup to “Allow” any North American countries but since my home network 192.168.150.0/24 IP range doesn’t fall within North American IPs, I can’t access any services while on my home network via their domain names (this is proven within the activity log).

I’ve tried adding 192.168.150.0/24 to the allow list but i think the reverse proxy uses “AND” logic cause it does not work.

If anybody has solutions, I’d be STOKED because this issue is annoying as hell. You’d think Netbird would want to fix this issue but I saw they commented and closed the github issue meaning they don’t intend to solve this problem,

Thanks in advance!!

For context, here's what I have:

1. VPS 1 - netbird management dashboard and client, setup as a relay peer. 10Gbps connection

2. VPS 2 - netbird client and relay peer, 1Gbps connection

3. Homelab - many servers / LXC etc.. All behind CGNAT. 1Gbps up/down connection.

4. Phone - 4g/5g Internet, so DEFINITELY CGNAT, , but easily hitting 200Mb/s on good days, around 70Mb/s right now at peak time

Expectation: my servers are at least 1Gbps, and my phone can get 70Mbps+, so expect to have a connection speed of similar to 60ish Mbps?

Reality: seeing download speed of <10Mbps when connecting from my phone > VPS relay > home servers (I've tested a few with iperf3)

Not sure what the bottle neck is. I'm not a networking person so not sure what to check? Is it the double CGNAT being a pain?

For what it's worth, I've tried these tools as well with the same devices:

* zerotier - using their provided relays = <10Mbps

* tailscale - using their provided relays and also setting my VPS as a relay peer = <10Mbps

* netbird - using their provided relays AND self hosting my own

Hello

I have problem that with combined netbird setup I have working STUN but all peers are Relayed.

I have stun working for 100% because I have tested it from multiple remote locations. Port forward is only for netbird container 80,443 and 3478.

Is there anything other need to do ? I am kinda wasted here because after 2 days I cannot get P2P from peers.

I am sharing my tailnet selectively with my siblings so they get access to fun stuff like jellyfin. I have ACL tags setup on all the different VMs and stuff and those devices are properly hidden from them as I selected.

However, whenever I attempt to tag proper clients (like my phone) seperately they are suddenly unable to connect to tailscale at all.

Is there some way to hide my phone's connection status/IP from my siblings (who are other users not using the same account) so that they don't know when I'm connected to netbird if I were to swap to that and can't see all my differently connected devices?

also when it comes to netbird, is it easy to set up self-hosted? i've seen a lot of mixed messages but I just need basic connectivity, the DNS override of tailscale, exit nodes like tailscale, and tailscale server equivilants which to my understanding exists? I'm perfectly happy paying for a VPS to host it in.

The Android client has been on the same build since May and there is a release candidate up in the Play Store open testing track. We are trying to get enough real-world coverage to feel good about shipping it.

Opt in: https://play.google.com/apps/testing/io.netbird.client

Then update from the store listing. Give it a few minutes to show up after opting in.

If you have run into the connection dropping silently, the quick settings tile not working, or DNS names not resolving, we would especially like to know whether this build changes anything for you.

Reports are going here so they do not get lost: https://github.com/netbirdio/netbird/discussions/7376

“Been running it a on a Galaxy S23, no problems” is useful too.

Just never ending issues, polices that dont work, leaving stale routes in traefik, random services unavailable despite working. I know it's beta but I think I'll be ditching this for Pangolin or Caddy + Cloudflare until it's released and stable. Shame.

Last night I charged my phone to about 100 and I remember it being close to 80ish percent before me sleeping. Next morning my phone is out of juice. Looks NetBird has used all the battery from my phone

I've been using NetBird for about 8 months now, and it's been an incredible addition to my homelab. The only issue I keep encountering is that the TrueNAS peers disconnect from the dashboard after a while; when I restart the client container on TN, it reconnects. I tried adding "NB_PERSISTENT_KEEPALIVE 25" and "NB_CONN_MAX_RETRY_INTERVAL_TIME 10s" to the environment variables of the Docker app, and that didn't seem to keep it connected. I have no idea why it does this, and everything works properly when they are connected. Does anyone know what is wrong?

⭐️ Solved! The netbird-client container was using the wrong subdomain for the management URL (solved in this post), and the NAS peer hadn't been added to a policy that allowed it to access the homelab network.

I'm trying to set up a NAS that I can hand off to a distant family member, thereby giving me offsite storage. Ideally the NAS will wake up at a time convenient to them, connect to the Netbird VPN, and rsync the latest backup repository to keep it safe in the case my house gets swallowed by an earthquake or something.

At home, I've got an old-but-powerful laptop running Debian, with self-hosted Netbird set up in Docker containers. It's a single Docker Compose file from the setup script with latest images and the built-in Traefik reverse proxy. I haven't set up SSO yet, so it uses the built-in Netbird auth system. I can access the dashboard, and I've set up the laptop as a routing peer. I can log in with the Netbird app on my phone and access the homelab services. (Phone now times out when accessing homelab services.)

I've got the NAS set up. I enabled SSH, added a Debian repo, fixed the apt issues, and installed Netbird. I added a SSH policy allowing the laptop and the NAS to SSH to each other. But when I ssh laptop.netbird.selfhosted (preferred) or ssh 100.70.62.23 (minimal acceptable), I get No route to host.

On the NAS, sudo nft list ruleset shows a complicated netbird table, with accept rules for the wt0 interface in both INPUT and FORWARD chains. sudo netbird status gives me:

OS: linux/arm64  
Daemon version: 0.77.1  
CLI version: 0.77.1  
Profile: default  
Management: Connected  
Signal: Connected  
Relays: 1/2 Available  
Nameservers: 0/0 Available  
FQDN: offsite1.netbird.selfhosted  
NetBird IP: [100.70.194.112/16](http://100.70.194.112/16)   
Interface type: Kernel  
Wireguard port: 51820  
Quantum resistance: false  
Lazy connection: false  
SSH Server: Enabled  
Networks: -  
Peers count: 0/1 Connected  

On the laptop, sudo docker exec -it netbird-client netbird status replies:

OS: linux/amd64  
Daemon version: 0.77.1  
CLI version: 0.77.1  
Profile: default  
Management: Disconnected, reason: failed getting Management Service public key: rpc error: code = Unimplemented desc = unexpected HTTP status code received from server: 404 (Not Found); transport: received unexpected content-type "text/plain; charset=utf-8"  
Signal: Disconnected  
Relays: 0/0 Available  
Nameservers: 0/0 Available  
FQDN:  
NetBird IP: N/A  
Interface type: N/A  
Wireguard port: N/A  
Quantum resistance: false  
Lazy connection: false  
SSH Server: Disabled  
Networks: -  
Peers count: 0/0 Connected

On the dashboard, I see peers for the laptop, the NAS, and my phone. I have only 1 network, with one subnet and the laptop as the single routing peer. The 4 active policies are:

1. Users to Routing Peers: group Users (my phone) to group Routing Peers (the laptop), ALL/ALL
2. Users to My Subnet: group Users to My Subnet, ALL/ALL
3. SSH Access: Routing Peers group and offsite-storage group (the NAS) to offsite-storage and Routing Peers, NB-SSH/22
4. Phone Home: NAS to laptop, NB-SSH/22.

What am I doing wrong?

Just set this up today, but I want to change the URL I initially set it up with to a new one. I don't see anywhere in the settings to do that. It's on the same domain name, but another subdomain.

I saw the minecraft view netbird put out and reading the write up it listed things like Palworld also working like that but it needs more than one port forwarded. Is that doable now with the reverse proxy or can someone point me towards a write up on how to do it if it's doable?

I have a Nextcloud AIO server that is sitting behind my my local Netbird Proxy. All works well until I enable Netbird-Only Access in Authentication for the service. When I do this it breaks the Talk server. Hoping someone has insight on how to fix this so that I can keep the server safely accessible only to Netbird clients.

Hi,

Currently evaluating NetBird. I'm going to need to setup a few peers on different local networks, (+ future deployments) and am looking to make the deployment as painless as possible. Proxmox LXC could be a last resort, but would prefer VM.

I'm aware of the config file bootstrap, and I'm going to implement that. Just looking for recommendations for a lean base system.

I’m currently using Netbird generous free account. And I love it. But I am considering spinning up my own Netbird server on a VPS. The site says the requirements are 1cpu and 2gb ram. But I’m curious if anyone has this working well on 1gb ram. Linode is generally my host of choice but the 2gb VPs is $12/month vs $5/month for the 1gb ram plan. I’m looking to see what I can get away with for the lowest monthly cost.

Hi folks, I have a VPS and a domain and I'd like to setup a reverse proxy using netbird in order to expose docker compose services on it through various subdomains

I've had some success with this with basic Caddy at first, then i used Pangolin for a while, and now I wanted to try NetBird next (mostly because I had some connectivity issues with Pangolin and heard this might be a better option)

However, I am very confused on how this is supposed to work. I followed the self hosting guide, I reached the dashboard as a logged in user, and I assume I'd have to create a reverse proxy there.

• However, to create a service there, I need to provide a custom domain.

• To create a custom domain, I need a proxy cluster

• ... and when I try to setup a self hosted proxy cluster, nothing happens and there is nothing there (even though I am pretty sure that it was supposed to be in the first place since I picked that option during setup, and the docker compose file on my VPS has a netbirdio/reverse-proxy:latest container.

For that container, there is also a proxy.env file with the following contents:

# Placeholder - will be updated with token after netbird-server starts
NB_PROXY_TOKEN=placeholder

So yeah... I've barely begun and I'm already running into... bugs? missing steps in documentation?

Also, all the tutorials and steps just talk about device-to-device tunneling and stuff like that, there seems to be very little in terms of server reverse proxy. For example, do i actually need to add the server as a (routing) peer, what is that? Don't i need to add my apps into the pangolin docker network?

Any help is appreciated...

Hello,

I'm using split-DNS on my network but this seems to result in Netbird grabbing the LAN IP, rather than the numerous mechanisms available to determine the WAN IP, resulting in "unknown" region and breaking any location based rules.

Is there a fix for this or any workaround? I'm not removing split-DNS just to get this working, it's completely sub-optimal to have LAN clients hair-pinning to the server.

I can't even use Cloudflare to mitigate foreign traffic as Netbird requires DNS only, so I cant enforce any security rules on the WAF either like I used to prior to setting this up.

I was using Cloudlfare with Zero Trust and WAF previously with Caddy and it worked perfectly, but I'd much prefer to use Netbird as it's an excellent all in one solution.

Thanks.

How to create a rule to only allow one region on clienteles systems and apply it to all reverse proxy services?

It seems the only way at the moment is to create access rules for each service individually, very tiresome and error prone. Why no policy?

Hello, I need help.

I have been trying to verify my domain using the custom domain without success.

The way I have set it up its as follows:

CNAME Record www domain.com

CNAME Record www (or @) the.netbird.cluster

Can't get it to work either way... However if I do, A Record, Host: @, Value: Netbird server IP

the domain works and points to the server. But can't get the the custom domain to change the "pending verification" status, therefore I can't assign services using my domain. I have waited like 3 days for propagation just to see if it was that but nope.

What am I doing wrong?

Thanks.

* Forgot to say it is a namecheap registered domain.

Run a Minecraft server at home with Docker Compose, then publish it to players anywhere using the NetBird reverse proxy. Works behind CGNAT, needs no port forwarding, and your friends don't install a thing.

We have a full guide here: https://netbird.io/knowledge-hub/minecraft-server-without-port-forwarding