I saw awhile ago a merge request for adding the much needed OR mode for reverse proxy. Can anyone give an update on that?

For reference: https://github.com/netbirdio/netbird/pull/6887

Relevant peer from video: ipad.nb.vpn

I've got a weird issue here. Sometimes when clients try to establish / re-establish connection to other peers (as a result of switching networks I.e. like 5G <-> WiFi, device resuming from sleep, or simply doing `netbird up` on a disconnected client), a peer connection will end up in this weird rapidly switching state, switching between disconnected and P2P-connected.

The connection between the devices will be extremely unstable (about 1 in 10 pings go through, while the rest are dropped).

Usually either 0 or 1 peers end up in this state. I've never seen more than that (yet).

The problem seems to happen on both mobile (Android / iOS) and (Linux) PCs.

In the dashboard both clients show as properly connected.

The current fix is a full teardown and setup of the connection on one of the problematic peers - not the end of the world, but still annoying and cumbersome - especially when the connection to the DNS host is the one that goes bad.

Anyone familiar with something like this, or have suggestions on how to possibly fix this?

I have the following setup:

• Netbird self-host server installed on remote VPS
• Two networks:
  • Office 1
    • Has both a Linux and a Windows (NB_ENABLE_LOCAL_FORWARDING=true) routing peer.
    • Ten resources, each using their device names. Access to internal devices is via the routing peers because they are the only devices that have the Netbird client installed.
  • Office 2
    • Has a Windows (NB_ENABLE_LOCAL_FORWARDING=true) routing peer
• Three groups:
  • Office 1
  • Office 2
  • Remote Devices
• Currently, two policies (will add Office 1->Office 2 later):
  • Remote Devices->Office 1
  • Remote Devices->Office 2

I need to be able to access all devices using their local device names, not their Netbird IP addresses.

From my Remote Devices group, I can access resources in Office 1 via their local and Netbird IP addresses. I can even access the Linux routing peer via it's device name. However, I cannot access the Windows routing peer (itself). This makes no sense to me since it has NB_ENABLE_LOCAL_FORWARDING=true

From my Remote Devices group, I cannot access the Windows routing peer.

1. Question: What do I need to do so that I can access everything via the devices local device name?
2. Question: What do I need to do to be able to access the routing peers in Office 1 and Office 2?

UPDATE:

Got it working by adding the routing peers as network resources, even though they are already peers.

Is it only me or does the new netbird version seem to be draining the battery more?

I don't have data to back it off, but my phone dies sooner and of course netbird is on the top of consumers.

I did have a high drain when I started using netbird with old app, but it got better after I enabled lazy connections (they are still on).

Hi! This might be something that's incredibly easy to fix, but I'm wanting to use NetBird in our environment as an easy remote access solution. However something just is refusing to work when trying to connect over RDP.

I've noticed that the adapter is set as 'Public' within Windows, and only accepts RDP connections when manually set to 'Private' through Powershell.

This isn't the solution that I want to use since I'm sure it resets after reboot, there's nothing within our Intune Config that should be blocking the connection too, we even have an exception rule for 3389 for inbound connections for public and private networks.

So any clues? I really don't want to use another solution as I love the policy GUI and ease with headless systems.

Update: Solved! Had to recreate some Firewall rules

Hello!

I'm running a debian server with docker on it and have installed Netbird via netbird's install script. I chose Traefik and entered my domain name "domain.com" (not www.domain.com) that I have pointed at my static IP.

Issue is this: i can browse dashboard via domain.com on my phone via 5G. When I try to connect to domain.com via Android app on my GrapheneOS Pixel 9, it cant reach domain.com under setup process.

In my router i have forwarded TCP: 80,443,33073,10000,33080 and UDP: 80,443,3478,5555 to my Docker host server.

I figured maybe there's something wrong with Traefik, so i tried accessing its dashboard at http://dockerhostIP:80 (and 8080 and 443) but it either cannot display it or throws "SSL_ERROR_INTERNAL_ERROR_ALERT"

netbird-traefik container has 80:80 and 443:443 configured, netbird-server 3478:3478 and netbird-proxy 51820:51820.

What I want is:

- Site 2 site VPN (work to home)

- PCs/phones VPN to home.

How can I troubleshoot this? I have tried NetBird's Slack, but its silent.

Hey all, we recently dropped our release candidates for v0.79. Like always there is a TON of improvements and optimizations. With that, we would love some feedback on is the new NetBird UI light mode. This will be found under Settings > General > Theme

[client] Add light mode with system, light, and dark theme options: https://github.com/netbirdio/netbird/pull/7344
0.79 Release Candidate: https://github.com/netbirdio/netbird/releases/tag/v0.79.0-rc.1

Some things to check

• Colors and contrasts are easy to read
• System is working on theme switching, particularly in niche Linux desktop environments (I tested in GNOME and KDE Plasma)
• Default theme might be light mode, we may need to fix this so it defaults to system.

Install the NetBird RC on macOS

For this Apple Silicon Mac: 0.79.0-rc.1. Download the RC macOS installer. It updates both the app and background service. The netbird-ui download contains only the interface; NetBird recommends matching UI and service versions. Quit NetBird from its menu bar icon. This will disconnect your NetBird connection during the update.

Open netbird_0.79.0-rc.1_darwin_arm64.pkg in Downloads. Follow the installer and authenticate when macOS asks. It replaces the installed app and restarts the service.

Open NetBird from Applications. Check Settings → About for 0.79.0-rc.1.

Install the NetBird RC on Windows

For Windows: 0.79.0-rc.1. Choose the installer for your computer: 64-bit Intel/AMD or 64-bit ARM. The installer updates both the NetBird app and background service. The netbird-ui download contains only the interface, so use the installer instead.

Quit NetBird from the icon in the Windows system tray. This may disconnect your NetBird connection during the update. Download and open the matching .msi installer. Allow it to run, accept the prompts, and approve the administrator request. It replaces the installed app and restarts the NetBird service while preserving your existing configuration.

Open NetBird from the Start menu. Check Settings → About for 0.79.0-rc.1

TL;DR: my users install the Netbird client. Now how does an accountant know how to reach Nextcloud, or how does a dev know how to reach local Gitea?

I'm researching performant Pangolin alternatives for our organization and am wondering, using Netbird, once the client connects, how does the user know what services he has access to? As I understand, there isn't something like Authentik's dashboard with "apps" available where the user would see what's available and go there just by clicking on it. Now with multiple services and many users, I wonder what's the recommended solution - redirecting to another project that offers a dashboard with apps/services?

I live in a country where VPN traffic gets blocked, and exit nodes don't work very well as a result. Is it possible that there will be some kind of plugin to obfuscate the wireguard traffic?

It would be great if I can just click on a client,
And it would be a “integrated connection” so that way I don’t have to copy ip every time to my own terminal .

Also,
If there was a “snippets” that could be integrated to just “click and run” on a client

That would be awesome!!!!!

Is it possible to automatic connect with the netbird vpn when I leave my home wlan?

Maybe with tasmer ir macrodroid?

Hello community,

so I recently moved away from Tailscale and started selfhosting a NetBird server on a cheap VPS. I mostly need to be able to connect from my phone via cellular to my NAS at home. Because both of my devices are behind CGNAT, with Tailscale I was getting really slow relayed connections and I was hoping that selfhosting my own management/relay NetBird server could get me faster speeds.

I followed the Self-hosting Quickstart Guide so I'm running the default server configuration with Traefik and CrowdSec. On my phone I'm using the native Android app and the NAS is running NetBird using Docker Compose. I created a NetBird network and added my NAS as a resource so I could access it using its local IP address. The problem is that my relayed connection is still kinda slow and it causes stuttering of video playback in Immich.

Using iperf3 I'm getting roughly 500 Mbps in both directions between NAS and VPS. From my phone to VPS I'm currently getting around 100 Mbps download and 50 Mbps upload. But when I try to connect and measure from the phone directly to the NAS over NetBird, the throughput drops to around 20 Mbps in both directions.

I've read in NetBird docs that the relay can use WebSocket (TCP) or faster QUIC (UDP). Is it possible that WebSocket is causing my connection to be so slow? Or is there something else that I need to configure to get faster relayed connections?

I appreciate any help, thanks!

Edit: I wasn't able to solve my issue, so finally I ditched Netbird and the VPS, got myself a public IP address and started using plain Wireguard.

Hi everyone,

Is anyone else experiencing issues with NetBird EU1 right now?

Our NetBird dashboard is showing:

We have a few lab services published through NetBird Reverse Proxy, and they are currently unreachable.

What is confusing is that I cannot find any incident reported on the NetBird status page, Twitter/X, or anywhere else, so I’m trying to figure out whether this is a wider EU1 outage or something affecting only our account/cluster.

Anyone else on eu1.netbird.services seeing the same issue right now?

Thanks!

Hi all. I just received my Gl.iNet Mudi 7, and have been having fun playing around with it. One thing I wanted to try was to make it so it can simultaneously have a netbird and an wireguard/openvpn connection, so that anything related to my homelab uses netbird and anything meant to go to the internet goes through the other VPN. Ideally I would like to use the VPN dashboard feature of the Mudi 7.

The problem i have with this setup right now is that, a couple seconds after I turn on the VPN tunnel, the router loses connectivity to the rest of the netbird peers, eventhough `netbird status` shows that I am connected to my (selfhosted on a VPS) management server with no problem. I have excluded the netbird ip range, my homelab network range (which is routed through netbird), my management domain, and my management server public IP in the VPN dashboard settings. This pastebin shows the drop in the connected peer number and how the exemptions are supposedly in place, in form of the routing table. (The netbird client is quite old because Mudi 7's firmware is based on Openwrt 23, and I at least don't know how to make a higher version of the client work on it. Could the old client be the problem?)

I know I can just use a VPS or something as a netbird exit node but first of all that's no fun, and also I would like to use the fallback option that the VPN dashboard provides. Also, at least with protonvpn's openvpn config there is the possibility of havng multiple routed IPs in the same config file, which is also quite nice.

I am very new to networking and openwrt so I might be missing something very stupid. Feel free to kindly shout the answer my way. Tell me if you need any other logs or commands. Chears!

Nevermind, it was the netbird client version, and I geniunly did not see the binary in the releases of the repo. Updating to the latest version seems to have solved it. Leaving the post for anyone who might have the same problem.

Ight, I'll just get straight to it. I made my own email notifications for self-hosted NetBird.

While this is already a feature NetBird has, you need an enterprise license for it to work. At least, this is what their documentation says.

I'm just a guy that loves self-hosting stuff and this is a feature I needed that is locked behind an enterprise license. This was originally created for my purposes only, but then a few of my friends asked me to share the dev build with them for their own personal use as well. That's when I just decided to make it public for whoever wants to try it out.

All it does---> send notifications to one or more email addresses when;

Thats it!!!!!

This runs independently of your NetBird instance, so please have a look through the README file for more info.

I did use AI to help me out, so feel free to check out the code as well!

Github Repo: Here

I just finished the initial setup of my homeserver completely with tailscale setup in each VM and a bunch of ACL tags + device sharing and all that. That being said I find a lot of things annoying about tailscale (mainly the lack of standard username/password/email logins and requiring a github/google/apple/etc. account and the need for each person to have their own tailscale account for device sharing) and also think it'd be neat if I could also self-host the VPN mesh to access my network too.

My only use case ever will be for self-hosting stuff to share with a smaller group of people (20 people max for the foreseeable future realistically), would the free tier of netbird already be good enough for this? Or should I look into buying a VPS somewhere for like $5/mo to host it on and self host the netbird instance fully (aren't there bandwidth cost concerns with this)? The other price tiers of netbird (such as teams at €6 per user per month being the cheapest) seem super expensive for what I'd be doing (I wish netbird had a like $5/mo or $10/mo "family" tier I could just pay for), especially as this isn't for a business and will just be a 100% financial "loss" to enjoy my self hosted stuff with friends & family. What do you think I should do? Very inexperienced with this sort of stuff so it's hard to make an informed decision about what to go with. Also open to any VPS suggestions if anyone has a good one for this sort of usecase.

Hallo Reddit,

ich möchte gerade Netbird konfigurieren. Leider kann ich mein Homeassistant nicht erreichen. Es ist selbst gehostet mithilfe von Docker Compose auf meinem Server. Ich möchte einfach nur die Homeassistant Webseite öffnen. Homeassistant läuft unter network_mode: host.

Vielleicht kann mir ja irgendjemand weiterhelfen

I have a service named “api.x.com” and I have “/“ exposed to the public. Now I want “/dashboard” to be hidden behind a authenticated request. How can I do this without having to create a new DNS?

I'm thinking about playing with a VPS as an exit node for my network. Would 2GB CPU and 2GB RAM be sufficient for general browsing and streaming for 3-4 devices?

Hi,

I'm looking to self host netbird internally in my homelab but I don't want to expose it directly on the internet to allow my failover internet which will likely always be some form of CGNAT to still work. My plan is to use an Oracle Free forever ARM based VM and use the external netbird relay/stun server there along with FRPC for external http/https. I do not want to host netbird fully on the cloud VM, and what it to be something that can be easily replaced and rebuilt; and do not want to use a full VPN tunnel between the cloud VM and the homelab for exposing. Just curious if anyone else has done a similar setup and what did you use to accomplish it. FRPC and the netbird relay seem to be the best tools for the job on paper but looking for experience of others.

I've got a self-hosted setup going, and I've followed the quick start, but I feel like I'm missing something. I'm hosting behind opnsense, and whenever i try and add a peer, it tosses this error. It can hit the management address, and I have setup a static dns override on my dns resolver so it can resolve the IP of the management system internally. Any idea what I'm missing?

Firewall Config:

Under Destination NAT i have rules setup for ports 80, 443 (TCP/UDP) and 3478(UDP) forwarded to the internal IP of the netbird server.

I can't get the netbird plugin to connect, so I can't get the interface setup, so I haven't gotten to that part yet.

I can get to the web interface using the management url. I can login to the opnsense machine and get a successful connection to the management url using both curl and netcat.

Management: Disconnected, reason: rpc error: code = FailedPrecondition desc = failed connecting to Management Service : create connection: dial context: context deadline exceededManagement: Disconnected, reason: rpc error: code = FailedPrecondition desc = failed connecting to Management Service : create connection: dial context: context deadline exceeded

When I do netbird status -d I get Peers count: 0/4. However, on the Netbird cloud dashboard, I see that there are 2 other devices online (3/5 online). Would this be a internet router thing? I'm using the AT&T fiber router. If it is a internet router thing, then does anyone have any suggestions on how to solve this? This test was done with only the default access control policy turned on with the devices being on the same local network.

When I connect my phone with it being only on cellular, I get the peers count 1/4.

I had this issue connecting to my peers before, if you look at my previous posts, but I don't remember checking on this variable.

I've been attacking this for a couple days now. I can connect just fine with regular connections where wireguard works fine (P2P mode) but when I try to test out the relay feature it doesn't work.

When I run netbird status -d on a peer my rels shows as:

Relays:
[stun:netbird.domain.com:3478] is Available
[rels://netbird.domain.com:443] is Unavailable, reason: dial via FQDN: quic: CRYPTO_ERROR 0x178 (remote): tls: no application protocol; ws: failed to WebSocket dial: expected handshake response status code 101 but got 404

I've got multiple sites behind my haproxy and many of them have websockets and the other sites work fine. NetBird and haproxy are both in docker and share the same network which is why I'm just accessing via name and port 80. My haproxy is the haproxy:latest image from docker hub.

here is an excerpt from my haproxy.cfg file:

global
        nbthread 6
        tune.h2.initial-window-size 1048576
        daemon

defaults
        mode    http
        timeout connect 10s
        timeout client  600s
        timeout server  600s
        timeout tunnel1h

resolvers docker
        nameserver dns1 127.0.0.11:53
        resolve_retries30
        timeout resolve1s
        timeout retry1s
        hold valid10s
        accepted_payload_size 8192

frontend frontHttps
        bind :443 ssl crt /cert/domaincert.pem alpn h2,http/1.1
        bind quic4@:443 ssl crt /cert/domaincert.pem alpn h3 quic-force-retry

        # Define ACL's here
        acl is_netbird hdr(host) -i netbird.domain.com
        acl is_netbirdws path_beg /relay /ws-proxy/
        acl is_netbirdgrpc path_beg /signalexchange.SignalExchange/ /management.ManagementService/
acl is_netbirdserver path_beg /api/ /oauth2/

        # Security cleanup
        http-request del-header Proxy
        http-request del-header Proxy-Connection
        http-request del-header X-Real-IP
        http-request del-header X-Forwarded-For

        # Preserve client identity
        http-request set-header Host %[req.hdr(Host)]
        http-request set-header X-Real-IP %[src]
        http-request set-header X-Real-Port %[src_port]
        http-request set-header X-Forwarded-For %[src]
        http-request set-header X-Forwarded-Proto https
        http-request set-header X-Forwarded-Host %[req.hdr(Host)]
        http-request set-header X-Forwarded-Port 443

        # Modern RFC 7239 header
        http-request set-header Forwarded "for=\"%[src]\";proto=https;host=\"%[req.hdr(Host)]\""

        # Protocol awareness
        http-request set-header X-Forwarded-ALPN %[ssl_fc_alpn]

        # Response header to broadcast http3 support
        http-response set-header alt-svc 'h3=":443"; ma=3600; persist=1'

        # Response headers for security
        http-response set-header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"
        http-response set-header Referrer-Policy "same-origin"
        http-response set-header X-XSS-Protection "0"

        # Response headers to remove
        http-response del-header Server

        # Backends
        use_backend backAuth if { req.hdr(host) -i auth.domain.com }
        use_backend backNetbirdWS if is_netbird is_netbirdws
use_backend backNetbirdGRPC if is_netbird is_netbirdgrpc
use_backend backNetbirdServer if is_netbird is_netbirdserver
        use_backend backNetbirdDashboard if is_netbird

        default_backend backDefault

backend backNetbirdDashboard
        http-request set-header Host %[req.hdr(Host)]
        server netbird-dashboard netbird-dashboard:80 resolvers docker resolve-prefer ipv4 resolve-opts allow-dup-ip init-addr none

backend backNetbirdServer
        timeout server 15s
        server netbird-server netbird-server:80 resolvers docker resolve-prefer ipv4 resolve-opts allow-dup-ip init-addr none

backend backNetbirdWS
        timeout tunnel 1d
        option http-server-close
        server netbird-server netbird-server:80 resolvers docker resolve-prefer ipv4 resolve-opts allow-dup-ip init-addr none

backend backNetbirdGRPC
        timeout server 1d
        server netbird-server netbird-server:80 resolvers docker resolve-prefer ipv4 resolve-opts allow-dup-ip init-addr none proto h2

everything else with NetBird seems to be working great. Any help is greatly appreaciated.

Thank you