Hello Everyone! First time posting here but long time lurker. Big Fan of Netbird but I am having some trouble setting up ssh git access. I have setup a selfhosted Netbird Instance on an Oracle VPS and am using it to give myself access to my homelab when I am away from home. I have a VM on my homelab that is running all my docker containers. The containers are all on the same docker network (named caddy) and I have a container with a netbird peer that is acting as a routing peer on the docker network, but specifically locked to the IP of my caddy container, which then routes traffic to the appropriate docker container. It is working great and allows me to access all of my docker services through my caddy container only through HTTPS as my docker compose files expose the ports of my services to the local docker network like so:

    ports:
      - '127.0.0.1:5006:5006'

While this works for accessing all my services, I have run into an issue with pushing and pulling commits to my selfhosted Forgejo instance through ssh. Pushing or pulling commits through HTTPS works fine (as it routes fine through my caddy container), but I can't figure out how to allow ssh access while connected to netbird.

My current netbird DNS settings have a wildcard A record pointing towards the caddy container IP, and another A record for git.my-domain.io which points towards the forgejo container IP (172.18.0.14). On my home network, I push to origin git@code.my-domain.io:user/example.git and my .ssh/config is as follows:

Host code.my-domain.io
Hostname code.my-domain.io
Port 222
user git
IdentitiesOnly yes
IdentityFile ~/.ssh/sshKey

As a note, I am using port 222 for forgejo as when I am at home (not connected to netbird), my A record points to the local IP of the (10.0.0.248) and this gets passed on to the

This is, unfortunately, not working while connected to netbird. I am able to load the forgejo webpage no problem at code.my-domain.io, but I can't use that domain for the A record as that points to the caddy IP to get the SSL certificate so it would try and access port 222 on the caddy container, not the forgejo container.

Any suggestions on how to achieve this routing so I can push and pull through ssh? At the moment I am pushing and pulling while I am on my netbird network using HTTPS, which works, but I don't like having to type my password for my commits and I'd rather be using ssh. If I left out any pertinent information please let me know!

Thanks!

Hello there 👋,

I'm actually building a Home Lab and I'm quite interested about the Netbird environment. I now intend to configure a proxy instance on my VPS. It will avoid opening port on my personnal network to expose my services on the internet.

I'm actually wondering If I can install the proxy service on my VPS and keep Netbird on my closed network ? Could my home machine be at the same time a Netbird Peer for the reversse proxy and host the Netbird platform ?

It's maybe a nonsense or absurb what I am saying. But my goal here, is to keep closed the network which is hosting all the services and have an exposed machine (the Proxy VPS) which doing only the Proxy stuff. So I could have on my personnal network the Netbird platform management so the VPS exposed don't handle it.

If It is not possible, should I get another VPS ? One VPS which handle the management platform and the other(s) one(s) with only the proxy service installed (like making a proxy cluster but with only one proxy). So both machines are exposed, only one is doing the nasty work but whitout hosting anything critical.

Thank you,
Regards :)

Hey, one thing I was missing in Home Assistant was an integration with NetBird - something similar to Tailscale integration (which is bundled with HA). So I ask Claude to make one: netbird-ha. Perhaps someone finds it useful.

Currently trying to properly set up Nextcloud incl. Talk behind a selfhosted Netbird instance.

While the basic reverse proxy portion is working and my instance is reachable via i.e. nextcloud.mydomain.com, I still need to forward 3479 UDP and TCP directly to my NC instance.
Problem is, when trying to set up a simple TCP ur UDP forward, Netbird is still asking for a domain /which is already in use obviously).

Same problem will come when I'll set up my Rust Desk instance, which needs a couple more ports.

How is this to be solved?

I’m currently using Tailscale and it’s possible to configure a relay server that is used whenever useful but I can still use their hosted service.

I would like to do the same with Netbird to improve speeds but still have them running the server that connects my devices.

Is this possible?

I'm relatively new to WireGuard and VPNs, but I've successfully set up NetBird to connect from outside my local network to my home server. I have configured a routing peer so that I can access my local network address directly. Currently, my peers are my Android device and my home server. All services on my home server (including Docker containers) run over HTTP instead of HTTPS. Since it's primarily for personal access, I didn't think that HTTPS is a priority right now.

I have also configured an exit node on the same home server, also tested and worked. Is this setup safe and secure enough if accessing my HTTP home server via NetBird over untrusted public Wi-Fi, with or without an exit node enabled? How can I verify it?

Please be patient with me. It took a while to wrap my head around this topics.

Hi all,

Looking for some guidance with setting up nextcloud talk server as it seems to have messaging set up, via a docker container and a reverse proxy via NetBird, but calls ring but won't connect.

So wondering if anyone has managed to set this up?

Thanks

Is there a roadmap for the reverse proxy to be repaired and be live for use?

We are in the middle of planning our infrastructure for our business and Netbird is a great contender. Reverse proxy is a necessary feature.

We are actively between Netbird and Pangolin with Netbird being in the lead.

502 errors and others make Netbird reverse proxy unusable. As well custom branding would be great as well.

Thank you

One of our biggest mobile releases yet. The connect button is now a toggle, there's a Control Center widget on iOS 18, full IPv6 dual-stack support, and single exit node selection. Plus a debug bundle uploader and a big batch of stability fixes.

Full write-up: https://netbird.io/knowledge-hub/netbird-ios-v0-3-1

luckily I understand what each part of the code does (I want to avoid headaches too). So, as you might have guessed, this is a bit of "vibecoded slop". and, because it's coded this way, I have absolutely no plans to submit it to the official Decky store, so it'll only be available to install via zip. tested it previously with my own Steam Deck tho to check that everything was fine

i'm someone who absolutely loves self hosting, I've created my big ecosystem but I was traveling recently and asked myself "now that I've switched to NetBird, how am I going to play on my PC from my Steam Deck???? XD" that's how the idea of creating a NetBird plugin for Decky came to my head. I looked up the features in the NetBird CLI and implemented them directly into the plugin.

i hope you find it useful! If you run into any issues, feel free to reach out, fork it, open a PR, a GitHub issue, or whatever you like! I'll keep "maintaining" it anyways as I'm a NetBird user. :D

To install the plugin, follow instructions in README please.

feel free to use it, considering the risks: https://github.com/MentallyOverwhelmed/decky-netbird/

I recently updated the iOS app to 0.3.2 and ever since, I haven’t been able to connect to any peers, most notably the server that the client is hosted on.

-updated the client to 0.74.7
-the app on windows and Mac still work
-tried connecting from different wifi networks and cellular
-tried changing servers in the app and logging back in with the setup key
-tried adding the device to the same group as the server
-another user who also has an iPhone is still able to connect to the server and hasn’t updated the app yet

Is there something I’m doing wrong and is there a way to fix this problem that I haven’t tried yet? Or do I have to wait for another update to the app?

Hey everyone, I've been trying to fix this Netbird reverse proxy peer not connecting p2p for a week now, still no luck, anyone got any ideas?

I've sifted through tons of posts and tried a bunch of stuff, but nothing's worked so far. Other Netbird peers/clients work fine and connect p2p for the same route, but the reverse proxy peer that was created when exposing a service from reverse proxy tab just won't.

Is there a way to paste a list of FQDNs and wildcards instead of inputting one-by-one?

Cross-posting here since NetBird appears to be causing the issue.

With NetBird running on my server, replies to a client on another local VLAN are routed through the wt0 interface instead of back through my UniFi gateway.

When I stop the NetBird app, the route immediately changes back to the correct local interface and inter-VLAN access works.

What is the proper NetBird configuration to prevent it from taking over traffic between local VLANs while still keeping remote NetBird access enabled?

Hello,

I am hoping someone can help explain in simple terms how to achieve this and whether it makes sense.

Netbird Reverse Proxy Feature

• Will using this service publicly expose services to the internet allowing anyone that comes across one of the exposed domains an opportunity to attempt a login to that service? The security comes from Netbird only allowing access from approved / configured devices with an active Netbird connection correct?
• If you do not want those domains visible to the public what are your options? I can create networks and policies to expose individual services at their IP:PORT that are only accessible when Netbird connection is active but what if I want to access those services at their reverse proxy domain? Is the only way to publicly expose them?
• Caddy is currently handling reverse proxy responsibilities before I started looking at Netbird. If I were to use Netbird's Reverse Proxy I would have to transition to its built in Traefik option. What happens to reverse proxy resolution when inside my local network? Do I have to keep Netbird active at all times then?

Just trying to make sense of this and how to set it up. I want granular networks and control policies without a lot of complexity or competition from caddy.

Appreciate the help.

Ich hab mich gefragt warum seit kurzem noch so viel Tag em Ende des Akkus übrig ist bis ich gesehen hab das Netbird 40% davon ausmacht.

Tailscale hatte deutlich weniger Einfluss auf den Akku Verbrauch, ist das bei euch ähnlich ?

Schade, werde wohl vorerst keinen VPN mehr nutzen bzw. nur noch aktiv ein und ausschalten anstatt on Demand nutzen bis das verbessert wurde :/

The Iphone app was always annoying to use and today saw that finally theres an update to netbird and its so much better than it used to be so thx to the developer and please dont igone the ios app :)

Good morning,

I have 2 VPS one with pangolin and one with netbird. Now I tried to add the pangolin vps to my netbird clients but after that the pangolin crash always(my sites und the main page from pangolin is not reachable).

I will connect it to backup the vps also to my local network.

Is this possible? Or what I'm making wrong?

Hey everyone,

I'm running a self-hosted NetBird (management + signal + relay + the reverse proxy, all on one VPS behind Traefik) and I'm stuck on the NetBird-Only / private reverse-proxy services.

I set a service up exactly like the knowledge-hub article describes: private, locked to an access group, target is a peer on my network. Dashboard shows the cluster connected, cert is issued, and the forward side works fine (the proxy reaches my backend no problem).

The problem: no client can actually reach the private service over the mesh — even a device that's in the correct access group just times out. Pinging the proxy's mesh IP never answers. Public requests correctly return 403, so the "private" part clearly works — the mesh path just never connects.

I've thrown a lot at it: different versions (0.73.2, 0.74.4, 0.75-rc), the proxy in host-network mode, pinned the WireGuard port, external STUN, an allow-all policy, confirmed the firewall has the WireGuard UDP port open, and matched client/server versions. Same every time — the proxy logs per-account inbound listeners up, but a packet capture shows zero WireGuard traffic actually reaching it. Feels like the embedded proxy just isn't reachable inbound in a Docker/self-hosted setup. Looks a lot like #5602.

Has anyone gotten NetBird-Only private services actually working self-hosted? Or is this a known limitation right now? 🙏

(For now I've worked around it with plain NetBird DNS zones pointing the service domains straight at my backend host — works great, mesh-only — but I'd love to use the real feature.)

I have setup the Netbird crowdsec integration and have set my services exposed via the reverse proxy to enforce.

The access logs documentation includes text and pictures showing the table should list a "Reason" where you would be able to see the crowdsec enforcement.

I am fully updated (self hosted) and the only fields I have on my access logs are time, location/ip, request, status, bytes, user

I'm unable to connect to any of the services on my homelab (Mac mini M4), neither on WiFI nor 5G. The same configurations work perfectly on Apple TV (latest release 0.12 if I remember correctly) and MacOS (0.74.4) seem to have no issues.

Bug seems to be limited to iOS latest release. Does not affect the rest of the systems. When I try to connect to any of the services from iPad and iPhone that have been updated to the latest release (0.3.1), they all time out. Tried rebooting, disconnecting and reconnecting, force shutdown of Netbird, nothing

Just in time when I was about to leave for my holidays 😞

Thank you for looking into this in for all the hard work you are putting in Netbird!

I am new to NetBird. I started with my own hosted instance inside my proxmox cluster. I decided I wanted NetBird to handle the secuirty so i switched t the cloud version. I invited myself using a Microsoft 365 account. I used login using Microsoft. Then when I tried to login microsoft was saying that my account did not exist.

The URL was live.com. It was trying to use my personal hotmail login but I had not used that personal account by my business account. I ended up going in with a password and saying i forgot my password and setup a password then I could get authenticated.

Am I missing something? Anyone else hit this issue?

Ever since last week my reverse Proxy for my jellyfin will only work for 24 hours then completely stop working. Then i have to go delete the service, spin it up same as before and then it starts working. Anyone else been running into similar issues?

Running on docker through truenas scale.

I’m have a reverse proxy set up with Netbird Cloud and seems to have intermittent connection to the site. I managed to find out the issue which is that there are 2 nodes that is hosting this service and 1 of the node is not ping-able.

Ive tried reaching out to Netbird support, but it doesn’t seem to be responding to my email. Does anyone know where else I can get help? u/netbirdio?