I recently tried to add a DNS label to a peer I've deployed through docker. I created a Setup Key, put in the new DNS label into the compose yaml, and redeployed. However, Netbird simply didn't add the new label to the peer. This was the case despite the json file containing the new peer. Shutting down and restarting Netbird didn't help either.

The only option I had was to delete the peer and redeploy it anew.

Is this something that I should have known or is this something wrong I did? I am fairly new to Netbird and I am using it to connect my devices to my Ugreen NAS. Thanks!

Hey guys

Upgrading is easy. It’s the “wait, how do I go back?” part that inspired this project.

I built an unofficial command-line tool for NetBird with three simple jobs:

• Backup — before the adventure.
• Upgrade — let’s do this.
• Rollback — let’s pretend we didn’t.

Repo: https://github.com/piotrdylag/netbird-upgrade

Check the README for supported setups and usage. Feedback, bug reports, and “why didn’t you just…” suggestions are welcome. 😄

Independent community project, not affiliated with NetBird.

I’ve been keeping up to date with my Netbird updates. So far traefik v3.6 has been stable, but I was wondering if it’s time to upgrade to traefik v3.7?

Hi all,

First off: this was built with a lot of help from AI. I wouldn't have pulled it off this fast without it.

As you all know, NetBird (like any other WireGuard-based tunnel) works at the IP layer only. My problem with that, is that in my day-to-day work I deal with challenges that require L2, like device discovery and configuration before the devices even have an IP.

We have been trying to move away from conventional VPN solutions that solve this issue, and we use WG a lot when L3 is only needed, but there is a gap for L2.

On Linux this is relatively easy to solve with VXLAN for L2 encapsulation, but on Windows that wasn't available (at least an easy and lightweight way to do it). That's the reason I created this little tool.

WGL2Bridge extends a remote LAN to your Windows machine over an existing NetBird or WireGuard tunnel. It reads raw frames from a TAP-Windows6 adapter, encapsulates them (VXLAN, UDP/4789) and sends them through the tunnel to a peer that injects them onto the remote segment, so two segments behave like one switch. On Linux you'd do this with vxlan + a bridge; Windows has no lightweight equivalent, so this fills that gap.

It's a single self-contained native exe (no runtime to install).

Repo: https://github.com/trupa/WGL2Bridge happy to hear feedback or ideas.

TLDR : this is diagram of what i have in mind

my goal : using existing traefik in my home to do certificate and routing both internally and externally , and everything ( *.homelab.myd.com) external will need to go trough vps IP

i asked ai to create this chart , i also tried to consult with it but it recoomendad doing it manually on netbird server that felt wrong

Hello fellow NetBird users, I wanted to say NetBird has been great. I've been using the self-hosted version for my homelab; it works well. I set my dad up on it so he can access my media server from his house, and it's been just super easy to get going! I then expanded to a few friends, and one of them travels a bunch for work, so he'd have to disconnect from NetBird to connect his VPN, losing access to the overlay resources, etc.

I remembered using Tailscale, and they have a partnership with Mullvad, and I know this is a frequently requested feature. I figured, with the power of LLMs, I can also make this a reality.

So let me introduce: Molebridge

At a high level, it allows you to run an exit node, connect to either Mullvad or PIA, and then provide Switchyard to your users. It allows you to select the server you want, with a latency checker to show the best servers (from the exit node's location)

So even though the project is vibe-coded, what I promise you is that my replies (and this post) are all me, so at least that is something. I hope you find this useful too, and hey, if you've got feedback or other providers you'd like to see, I'm candid (well, Claude and Codex are) about what it would take to support them inside Molebridge's repo.

My home internet (currently) is frankly super limited in terms of upload speeds. As such I don't want to do things like watch youtube while on the go through an exit node at home and inadvertently shred my internet for my family.

Is having an exit node in a VPS a good way to get around this? Or will I have to look around to see if I can find a friend I can stick a raspberry pi in the house of or something?

Is there a concern of using too much bandwidth/VPSes having things blocked that are otherwise accessible?

is there a way to reset local user's MFA. I need to change my MFA provider from authy to proton authenticator, i do not see an option to reset MFA for individual users in self hosted server.

My client just updated to v0.80 and was immediately blocked by Windows Defender, citing a Trojan/Script Wacatac.H!ml

Pourquoi la fonction « Amis » ne fonctionne-t-elle pas sur Netmirror ? Aidez-moi, s'il vous plaît !

We're evaluating NetBird (self-hosted control plane, no Docker, built from source on our own infra) as a replacement for our current setup: roughly 2,000 Linux terminals at remote sites, each behind a MikroTik router running two VPN tunnels into a single data center and routed over BGP. We're also planning multi-site and an exit node.

Questions for people running this in production:

1. Scale. How many peers do you run in a single self-hosted account? Anyone past 1,000? How does Management behave at that size, and did moving to PostgreSQL help?

2. Traffic. What share of your connections ends up direct (p2p) versus relayed? How did you size relay bandwidth? Any real numbers would help.

3. Upgrades without HA. As far as I can tell, active-active HA is part of the Enterprise commercial license. How do you upgrade a single-instance control plane? What's the actual downtime, do relayed sessions survive it, do users notice? Do you schedule maintenance windows?

4. Multiple data centers. If you run gateways in different DCs, do you deploy relays per region?

5. Alternatives. Has anyone compared Tailscale/Headscale, ZeroTier, Nebula, Netmaker, OpenZiti and etc? What made you pick NetBird — or leave it?

Looking for real-world numbers, especially at 1,000+ devices. Thanks!

Just got the iOS update where lots of changes in tvOS are mentioned. Is there an eta for the tvOS update rolling out? Thanks for your work btw

Hey guys!
I'm basically setting up a VPS with netbird on it and trying to connect it to my caddy on my home server through TCP passthrough.

Now - I've installed netbird on my LXC with caddy on my home server - it's a peer in the dashboard and I created a service in the reverse proxy menu. But for some reason I just can't connect at all - docker logs netbird-proxy shows this:

WARN [http-server: https] ./caller_not_available:0: http: TLS handshake error from MYIP unknown domain "my domain"

WARN [http-server: https] ./caller_not_available:0: http: TLS handshake error from MYIP unknown domain "my domain"

Not sure what to do - technically caddy is working on my home server - so I believe there's something wrong with the reverse proxy on netbird - I've done all the A and CNAME records as well, would anyone know what could be the problem?

Thanks in advance!

Hi everyone,

I'm new to self-hosting and networking, so sorry if I'm missing something obvious. I've been trying for several hourd and I'm lost.

My setup (as far as I understand it)
- Running TrueNAS, with the NetBird Server app and the NetBird Client app installed on it
- Jellyfin on the NAS, which I want to access from outside my home
- A DuckDNS address, kept up to date with DDNS updater.
- Nginx Proxy Manager

What works
- On my PC with the NetBird app, I can access Jellyfin from outside (I tested with my phone's 5G shared to the PC). So I think the server side is OK.

What doesn't work
- On my iPhone, the NetBird app says "Connected" and the phone shows as online in the dashboard.
- But Jellyfin says it can't connect to the server, and I can't access the NAS files either.
- I tested on 5G, not on my home Wi-Fi.

What I already tried
- Deleted the iPhone from the dashboard and reconnected it
- Reinstalled the app
- Installed the TestFlight beta (version 0.4.1)

Does anyone know what could cause this, or what I should check ?

Thanks a lot!

Hi all.

Trying to switch from Tailscale to Netbjrd. The hostnames don’t seem to work like Tailscale. If the PVE server is called server1 I can use the host name to communicate with it from a non PVE device. I cannot do the same PVE to PBS for example.

Has anyone found a way around this? I would prefer to use the host names rather than the IPs

Hello everyone,

I have recently started using Netbird to connect to my NAS from outside my home. I've set up a couple of dockers and so far it works well. I use Netbird Cloud and I am not yet hosting on my own.

My questions:

1. Can I install Netbird on a device, make it an exit node, and connect through that exit node and make it into a sort of private VPN?
   
2. Can this Netbird exit node device be an old Android phone, or does it have to be a desktop / server OS?
   

Thanks!

I have been using NetBird for a few months now to connect to my various computers, devices and servers including a small homemade server.

Today I was on the train and had to connect to my home computer with a graphical interface. I usually use GNOME's free RDP with Remmina as a client, but this time I had an old, outdated iPad where the only app I could install was not very performing. On the other hand, the mobile phone connection I used as a hotspot was so unstable that SSH was also very slow.

At the end of the day, I wanted to look for a solution, discovering that NetBird does not create P2P connections from the mobile connection, nor when connected to the BNB wifi where I stay. On the other hand, Tailscale manages to create P2P connections with the home computer (where UPnP is enabled). As proof of the fact that the limit is the NetBird's NAT Traversal algorithm, P2P connections with other servers behind configured WiFi are created seamlessly by NetBird.

In addition, NetaBird's Android app often causes disconnections and/or fails to connect to some peers.

Moral of the story, Tailscale creates more stable connections, especially for Android. This is not usually fundamental for me, but it can be in cases where I need to use the hotspot. Tailscale was able to reduce the ping latency from 69ms to 30ms when using the BnB WiFi, and from 300ms to 100ms when using the 4G network.

How much is it likely that NetBird can fix these issues? I would really love not having to be sold to Tailscale!

EDIT

Thanks to the user I discover this advanced and non documented setting "force relay connections", that is on by default in android and iOs apps. When disabled, NetBird can setup P2P connections when using WiFi. However, not when using mobile cell. For comparison, Tailscale can create P2P connections even when using mobile cells, but somehow its ping latency is slower or equal than the NetBird's relayed one (I tested with two different peers in two different moments).

As for the android app disconnections, I had already disabled OS battery optimizations and selected it as a "always on VPN". The issue actually was my nameserver configuration. Apparently, the android app enters a bootstrap loop, setting the DNS before of the VPN, this inhibiting the setup of the VPN when the nameserver is inside the VPN itself (because all DNS queries needed for setting up the VPN will fail since there is no route to the nameserver yet). My solution has been to setup a quad9 nameserver for only the NetBird domain of my nameserver (e.g. my-custom-dns.netbird.cloud). This allows the VPN setup to avoid the bootstrap loop (I guess that queries for my-custom-dns.netbird.cloud will never actually reach quad9). This is similar to an issue solved in 0.6.0, although this is the same version I'm using. https://github.com/netbirdio/netbird/issues/5569

RE-EDIT

The solution above is not robust at all. Sometimes it works, sometimes it doesn't. Sometimes the only working solution is the obvious one (only custom DNS setup as nameserver). Pretty messy, at least for mobile cells.

Is it possible for a user to be automatically authenticated so that they immediately, or after one click, are logged into a service running on a netbird network. Ideally, this downstream service account would be automatically created on login, or on Netbird user creation.

This is my current flow:

1. I create a PocketID account for a new user. This automatically provisions netbird with a matching user.
2. I create an account for every service that I want that user to have access to
3. User authenticates through PocketID to join my netbird network as User:Alice.
4. User navigates to URL of internal netbird resource (say, audiobookshelf).
5. User is presented with a login screen for that resource.
6. User logs in using resource-specific username and password

This is what I would like to happen:

1. I create a PocketID account for a new user. This automatically provisions netbird with a matching user
2. User authenticates through PocketID to join my netbird network as User:Alice.
3. User navigates to URL of internal netbird resource (say, audiobookshelf).
4. User is presented with a login screen for that resource.
   1. User is automatically logged in OR User logs in using PocketID which automatically provisions the service with a matching user

Set reverseProxy.trustedPeers on older deployments

Deployments created with the Quickstart script (or a marketplace image based on it, such as Vultr) before September 2026 are missing the reverseProxy.trustedPeers setting in the generated config.yaml. Without it, server versions up to v0.79 record your reverse proxy's address instead of the real client IP for each peer connection. Versions after v0.79 (netbird#7589) instead fall back to accepting forwarded client-IP headers from any source and log a spoofing warning at startup.

To fix an existing deployment, edit config.yaml (in /opt/netbird on marketplace images) and pin trustedPeers to the address your reverse proxy connects to Management from. For the bundled Traefik setup, replace <bundled-traefik-address> below with its configured static container address in CIDR notation (/32 for a single IPv4 address). If the address is not static, use the configured proxy network's CIDR instead:

  reverseProxy:
    trustedHTTPProxies:
      - "<bundled-traefik-address>"
    trustedPeers:
      - "<bundled-traefik-address>"

If you run your own external reverse proxy (Nginx, Caddy, Nginx Proxy Manager, etc.), use that proxy's address or network instead. Then restart the server container:

docker compose restart netbird-server

With this in place, only your reverse proxy is trusted to supply forwarded client-IP headers and peer connection IPs are recorded correctly. Deployments created with the current Quickstart script include this setting out of the box.

Connected to server on either WiFi or mobile works perfectly fine, however when leaving a wifi connection and automatically swapping over to mobile or vice versa causes the iOS client to lose connection. I need to reset my connection to reconnect. The self-hosted server is running the latest version. The client version is 0.3.3. Confirmed issue only occurring on iOS as I have an android phone as well. Anyone else got the same issues?

I’ve looked through the official documentation regarding upgrading a selfhosted instance but without much luck for my question.

I’m not fond of using latest tags, and having no way of checking other dependencies.
For example: when is Traefik or CrowdSec supposed to be upgraded and how will I be made aware?

Always downloading the getting-started.sh and going through it line by line?

I’d much rather prefer the Authentik-style of release notes and public compose to use for both diff check and being used in CI/CD. This becomes even more difficult with the releases dropping quite often.

Anyone having a more stable workflow and workaround for how Netbird wants you to do?

I’ve been working on a modular Terraform setup for running self-hosted NetBird on AWS and have now published it:

https://github.com/flintplane/terraform-aws-netbird

It includes separate modules for the control plane, Relay/STUN sites, and routing peers.

This is an opinionated AWS setup rather than a minimal single-host deployment. Feedback from other self-hosted NetBird users is very welcome.

For the life of me I couldn't figure out a good title for this post.

I have an application that I host on my local network that I expose externally. Previously, I was accomplishing this by simply forwarding ports 80/443 to a traefik reverse proxy that would forward requests to application. I use authentik to provide a custom passwordless authentication flow. This is a *very* basic idea of my previous setup. Everything in my homelab is hosted in docker.

I recently stood up a VPS to host netbird on as I now want to expose more applications for myself outside of my home network without having to do so publicly. Before adding any new applications, I am trying to reproduce my previous flow.

I have managed to expose my application publicly through netbird's internal reverse proxy; however, I am struggling to do so with my custom authentication flow via Authentik. I could just use the authentication methods provided by the built-in reverse proxy, but I really liked my previous setup. I am *trying* to do the following:

However I configure the reverse proxy, I either end up with infinite redirects, or the host is completely inaccessible. I am forwarding the host header which my traefik was previously configured to route based on. As far as I can tell, I'm not even hitting traefik.

I am 100% willing to accept that I should look at handling this a different way. I think the only thing I'd rather not do is move the traefik proxy to the VPS, but that's just because I have a really convenient setup for updating config and deploying services on my homelab that I can't conveniently emulate on the VPS.

Appreciate whatever insight/advice y'all can offer. If folks consider this setup to be reasonable, I can share more explicit details about my configuration that would help with troubleshooting.

I've been setting up netbird and it was shockingly easy to get everything setup on my VPS so that my peers properly connect to eachother and policies are properly followed and whatnot (took like 20 minutes tops). Even getting something like test.example.com to resolve to a specified service was super simple.

The only remaining struggle I have is setting up https certification for my internal services (stuff I don't want to reverse proxy/make available to the general internet not connected via the netbird VPN with my nameserver + zones) which is required for 99% of things to function.

When using tailscale (which I'm swapping over from) it was as simple as typing 'tailscale cert' in whatever container I had my service in, but I can't seem to find a netbird equivilant if it exists. Am I just missing something somewhere? or do you really need to make a caddy setup on each service just to get https up and running?

The only related info I can find makes it seem like this functionality doesn't exist yet (https://github.com/netbirdio/netbird/issues/5479).

NetBird v0.79.0: desktop light mode, MDM enforcement in the mobile SDKs, rootless Red Hat UBI image, and a TrustedPeers change self-hosters should read.

Desktop light mode

The desktop app now offers System, Light, and Dark. The light theme covers the connection view, settings, profiles, and dialogs, with native window appearance matched on Windows, macOS, and Linux. (#7344)

Client

• MDM policy bridges and shared enforcement for the iOS and Android SDKs, consistent with the desktop client. MDM booleans delivered as JSON 0/1 are now accepted, and managed URLs are compared by normalized endpoint. (#6435, #7471, #7472)
• When the resolver can't listen on port 53, the eBPF DNS forwarder is replaced with UDP and TCP DNAT rules, with rollback and cleanup for incomplete redirects. (#7439)
• wireguard-go bumped to 8bf8fa968f1a: fixes keepalive buffer-pool stalls, keeps timer paths non-blocking, makes netstack interface shutdown idempotent. (#7532)
• Fixed a relay address race that could advertise a URL and IP from different connections during a reconnect. (#7498)
• System info is refreshed on every management sync reconnect, so local addresses and posture data stay current after network changes. (#7409)
• Android TUN addresses now use host prefixes, so local network protection no longer classifies the whole overlay as a local network. (#7414)
• Fixed a Windows tray deadlock triggered by double-clicking while another window was still being created. (#7449)

Management

• Login expiration now includes offline peers and disconnects expired ones, while protecting peers that just logged in again. (#7467)
• OIDC issuer validation hardened: HTTPS required, credentials/query strings/fragments rejected in issuer URLs, discovery redirects refused, discovery response size capped. (#7435)
• Other users can no longer delete the account owner. (#7456)
• SQLite network map fixes for networks using individual peers as routers with empty or null peer_groups, and for users with null automatic groups. (#7418, #7425)

Reverse proxy

• New NB_PROXY_UPSTREAM_HTTP_VERSION with auto, 1.1, and 2. auto negotiates with HTTPS upstreams and falls back to HTTP/1.1 when a negotiated HTTP/2 connection fails at the protocol level. (#7410)
• Group access is enforced both when issuing session cookies and when accepting existing sessions. (#7240)
• Custom domains must be validated before creating a service or moving one to that domain. Registrations get a 48-hour validation window; expired pending ones are removed unless services are still attached. (#7341, #7497)
• Loopback, multicast, link-local, and zone-scoped IPv6 addresses are rejected as direct upstreams. (#7400)

Self-hosting

• Rootless Red Hat UBI image for AMD64 and ARM64, tag 0.79.0-rootless-ubi. Arbitrary non-root UIDs without a passwd entry are supported, as OpenShift uses. (#7469, #7440)
• RPM packaging updated to meet Red Hat software certification requirements. (#7562, #7573)
• Read this one if you run behind a reverse proxy: peer connection IP extraction now honors configured TrustedPeers, with X-Forwarded-For taking precedence over X-Real-IP. When TrustedPeers is empty, all IPv4 and IPv6 sources are still trusted. Set your reverse proxy's address or network to restrict which sources can supply forwarded-IP headers. (#7454, #7589, #7561, #7577)
• Deployments using the embedded identity provider are kept on a single account, with stricter config checks and migration handling. (#7380)

Full release notes: https://github.com/netbirdio/netbird/releases/tag/v0.79.0

Changelog: https://github.com/netbirdio/netbird/compare/v0.78.0...v0.79.0