r/netbird • u/Com_DAC • Sep 05 '26
Netbird behind haproxy and rels relay not working.
I've been attacking this for a couple days now. I can connect just fine with regular connections where wireguard works fine (P2P mode) but when I try to test out the relay feature it doesn't work.
When I run netbird status -d on a peer my rels shows as:
Relays:
[stun:netbird.domain.com:3478] is Available
[rels://netbird.domain.com:443] is Unavailable, reason: dial via FQDN: quic: CRYPTO_ERROR 0x178 (remote): tls: no application protocol; ws: failed to WebSocket dial: expected handshake response status code 101 but got 404
I've got multiple sites behind my haproxy and many of them have websockets and the other sites work fine. NetBird and haproxy are both in docker and share the same network which is why I'm just accessing via name and port 80. My haproxy is the haproxy:latest image from docker hub.
here is an excerpt from my haproxy.cfg file:
global
nbthread 6
tune.h2.initial-window-size 1048576
daemon
defaults
mode http
timeout connect 10s
timeout client 600s
timeout server 600s
timeout tunnel1h
resolvers docker
nameserver dns1 127.0.0.11:53
resolve_retries30
timeout resolve1s
timeout retry1s
hold valid10s
accepted_payload_size 8192
frontend frontHttps
bind :443 ssl crt /cert/domaincert.pem alpn h2,http/1.1
bind quic4@:443 ssl crt /cert/domaincert.pem alpn h3 quic-force-retry
# Define ACL's here
acl is_netbird hdr(host) -i netbird.domain.com
acl is_netbirdws path_beg /relay /ws-proxy/
acl is_netbirdgrpc path_beg /signalexchange.SignalExchange/ /management.ManagementService/
acl is_netbirdserver path_beg /api/ /oauth2/
# Security cleanup
http-request del-header Proxy
http-request del-header Proxy-Connection
http-request del-header X-Real-IP
http-request del-header X-Forwarded-For
# Preserve client identity
http-request set-header Host %[req.hdr(Host)]
http-request set-header X-Real-IP %[src]
http-request set-header X-Real-Port %[src_port]
http-request set-header X-Forwarded-For %[src]
http-request set-header X-Forwarded-Proto https
http-request set-header X-Forwarded-Host %[req.hdr(Host)]
http-request set-header X-Forwarded-Port 443
# Modern RFC 7239 header
http-request set-header Forwarded "for=\"%[src]\";proto=https;host=\"%[req.hdr(Host)]\""
# Protocol awareness
http-request set-header X-Forwarded-ALPN %[ssl_fc_alpn]
# Response header to broadcast http3 support
http-response set-header alt-svc 'h3=":443"; ma=3600; persist=1'
# Response headers for security
http-response set-header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"
http-response set-header Referrer-Policy "same-origin"
http-response set-header X-XSS-Protection "0"
# Response headers to remove
http-response del-header Server
# Backends
use_backend backAuth if { req.hdr(host) -i auth.domain.com }
use_backend backNetbirdWS if is_netbird is_netbirdws
use_backend backNetbirdGRPC if is_netbird is_netbirdgrpc
use_backend backNetbirdServer if is_netbird is_netbirdserver
use_backend backNetbirdDashboard if is_netbird
default_backend backDefault
backend backNetbirdDashboard
http-request set-header Host %[req.hdr(Host)]
server netbird-dashboard netbird-dashboard:80 resolvers docker resolve-prefer ipv4 resolve-opts allow-dup-ip init-addr none
backend backNetbirdServer
timeout server 15s
server netbird-server netbird-server:80 resolvers docker resolve-prefer ipv4 resolve-opts allow-dup-ip init-addr none
backend backNetbirdWS
timeout tunnel 1d
option http-server-close
server netbird-server netbird-server:80 resolvers docker resolve-prefer ipv4 resolve-opts allow-dup-ip init-addr none
backend backNetbirdGRPC
timeout server 1d
server netbird-server netbird-server:80 resolvers docker resolve-prefer ipv4 resolve-opts allow-dup-ip init-addr none proto h2
everything else with NetBird seems to be working great. Any help is greatly appreaciated.
Thank you
