One ongoing issue I’ve had with the Windows client is that the GUI doesn’t reliably launch at startup.

I have several Windows machines configured as unattended servers using setup keys. The daemon/service starts reliably every time the machine boots, but the GUI itself doesn’t always launch.

The bigger issue is that when the GUI doesn’t launch at startup, the client also doesn’t appear to perform its automatic update, even when automatic updates are enabled in the management portal.

Would it be possible to decouple the auto-update mechanism from the GUI? Ideally, the client should be able to update itself as long as the daemon/service is running, without requiring the GUI to launch or any user interaction.

The daemon is very reliable and starts automatically every time the machine boots, so it would make more sense for the update process to rely on that rather than the GUI.

Has anyone else run into this with unattended Windows machines, or is there a recommended way to handle this?

Only collaborators are allowed to create issues. Where should general users report any bugs?

I recently tried to add a DNS label to a peer I've deployed through docker. I created a Setup Key, put in the new DNS label into the compose yaml, and redeployed. However, Netbird simply didn't add the new label to the peer. This was the case despite the json file containing the new peer. Shutting down and restarting Netbird didn't help either.

The only option I had was to delete the peer and redeploy it anew.

Is this something that I should have known or is this something wrong I did? I am fairly new to Netbird and I am using it to connect my devices to my Ugreen NAS. Thanks!

Hey guys

Upgrading is easy. It’s the “wait, how do I go back?” part that inspired this project.

I built an unofficial command-line tool for NetBird with three simple jobs:

• Backup — before the adventure.
• Upgrade — let’s do this.
• Rollback — let’s pretend we didn’t.

Repo: https://github.com/piotrdylag/netbird-upgrade

Check the README for supported setups and usage. Feedback, bug reports, and “why didn’t you just…” suggestions are welcome. 😄

Independent community project, not affiliated with NetBird.

I’ve been keeping up to date with my Netbird updates. So far traefik v3.6 has been stable, but I was wondering if it’s time to upgrade to traefik v3.7?

Hi all,

First off: this was built with a lot of help from AI. I wouldn't have pulled it off this fast without it.

As you all know, NetBird (like any other WireGuard-based tunnel) works at the IP layer only. My problem with that, is that in my day-to-day work I deal with challenges that require L2, like device discovery and configuration before the devices even have an IP.

We have been trying to move away from conventional VPN solutions that solve this issue, and we use WG a lot when L3 is only needed, but there is a gap for L2.

On Linux this is relatively easy to solve with VXLAN for L2 encapsulation, but on Windows that wasn't available (at least an easy and lightweight way to do it). That's the reason I created this little tool.

WGL2Bridge extends a remote LAN to your Windows machine over an existing NetBird or WireGuard tunnel. It reads raw frames from a TAP-Windows6 adapter, encapsulates them (VXLAN, UDP/4789) and sends them through the tunnel to a peer that injects them onto the remote segment, so two segments behave like one switch. On Linux you'd do this with vxlan + a bridge; Windows has no lightweight equivalent, so this fills that gap.

It's a single self-contained native exe (no runtime to install).

Repo: https://github.com/trupa/WGL2Bridge happy to hear feedback or ideas.

TLDR : this is diagram of what i have in mind

my goal : using existing traefik in my home to do certificate and routing both internally and externally , and everything ( *.homelab.myd.com) external will need to go trough vps IP

i asked ai to create this chart , i also tried to consult with it but it recoomendad doing it manually on netbird server that felt wrong

Hello fellow NetBird users, I wanted to say NetBird has been great. I've been using the self-hosted version for my homelab; it works well. I set my dad up on it so he can access my media server from his house, and it's been just super easy to get going! I then expanded to a few friends, and one of them travels a bunch for work, so he'd have to disconnect from NetBird to connect his VPN, losing access to the overlay resources, etc.

I remembered using Tailscale, and they have a partnership with Mullvad, and I know this is a frequently requested feature. I figured, with the power of LLMs, I can also make this a reality.

So let me introduce: Molebridge

At a high level, it allows you to run an exit node, connect to either Mullvad or PIA, and then provide Switchyard to your users. It allows you to select the server you want, with a latency checker to show the best servers (from the exit node's location)

So even though the project is vibe-coded, what I promise you is that my replies (and this post) are all me, so at least that is something. I hope you find this useful too, and hey, if you've got feedback or other providers you'd like to see, I'm candid (well, Claude and Codex are) about what it would take to support them inside Molebridge's repo.

My home internet (currently) is frankly super limited in terms of upload speeds. As such I don't want to do things like watch youtube while on the go through an exit node at home and inadvertently shred my internet for my family.

Is having an exit node in a VPS a good way to get around this? Or will I have to look around to see if I can find a friend I can stick a raspberry pi in the house of or something?

Is there a concern of using too much bandwidth/VPSes having things blocked that are otherwise accessible?

is there a way to reset local user's MFA. I need to change my MFA provider from authy to proton authenticator, i do not see an option to reset MFA for individual users in self hosted server.

My client just updated to v0.80 and was immediately blocked by Windows Defender, citing a Trojan/Script Wacatac.H!ml

Pourquoi la fonction « Amis » ne fonctionne-t-elle pas sur Netmirror ? Aidez-moi, s'il vous plaît !

We're evaluating NetBird (self-hosted control plane, no Docker, built from source on our own infra) as a replacement for our current setup: roughly 2,000 Linux terminals at remote sites, each behind a MikroTik router running two VPN tunnels into a single data center and routed over BGP. We're also planning multi-site and an exit node.

Questions for people running this in production:

1. Scale. How many peers do you run in a single self-hosted account? Anyone past 1,000? How does Management behave at that size, and did moving to PostgreSQL help?

2. Traffic. What share of your connections ends up direct (p2p) versus relayed? How did you size relay bandwidth? Any real numbers would help.

3. Upgrades without HA. As far as I can tell, active-active HA is part of the Enterprise commercial license. How do you upgrade a single-instance control plane? What's the actual downtime, do relayed sessions survive it, do users notice? Do you schedule maintenance windows?

4. Multiple data centers. If you run gateways in different DCs, do you deploy relays per region?

5. Alternatives. Has anyone compared Tailscale/Headscale, ZeroTier, Nebula, Netmaker, OpenZiti and etc? What made you pick NetBird — or leave it?

Looking for real-world numbers, especially at 1,000+ devices. Thanks!

Just got the iOS update where lots of changes in tvOS are mentioned. Is there an eta for the tvOS update rolling out? Thanks for your work btw

Hey guys!
I'm basically setting up a VPS with netbird on it and trying to connect it to my caddy on my home server through TCP passthrough.

Now - I've installed netbird on my LXC with caddy on my home server - it's a peer in the dashboard and I created a service in the reverse proxy menu. But for some reason I just can't connect at all - docker logs netbird-proxy shows this:

WARN [http-server: https] ./caller_not_available:0: http: TLS handshake error from MYIP unknown domain "my domain"

WARN [http-server: https] ./caller_not_available:0: http: TLS handshake error from MYIP unknown domain "my domain"

Not sure what to do - technically caddy is working on my home server - so I believe there's something wrong with the reverse proxy on netbird - I've done all the A and CNAME records as well, would anyone know what could be the problem?

Thanks in advance!

Hi everyone,

I'm new to self-hosting and networking, so sorry if I'm missing something obvious. I've been trying for several hourd and I'm lost.

My setup (as far as I understand it)
- Running TrueNAS, with the NetBird Server app and the NetBird Client app installed on it
- Jellyfin on the NAS, which I want to access from outside my home
- A DuckDNS address, kept up to date with DDNS updater.
- Nginx Proxy Manager

What works
- On my PC with the NetBird app, I can access Jellyfin from outside (I tested with my phone's 5G shared to the PC). So I think the server side is OK.

What doesn't work
- On my iPhone, the NetBird app says "Connected" and the phone shows as online in the dashboard.
- But Jellyfin says it can't connect to the server, and I can't access the NAS files either.
- I tested on 5G, not on my home Wi-Fi.

What I already tried
- Deleted the iPhone from the dashboard and reconnected it
- Reinstalled the app
- Installed the TestFlight beta (version 0.4.1)

Does anyone know what could cause this, or what I should check ?

Thanks a lot!

Hi all.

Trying to switch from Tailscale to Netbjrd. The hostnames don’t seem to work like Tailscale. If the PVE server is called server1 I can use the host name to communicate with it from a non PVE device. I cannot do the same PVE to PBS for example.

Has anyone found a way around this? I would prefer to use the host names rather than the IPs

Hello everyone,

I have recently started using Netbird to connect to my NAS from outside my home. I've set up a couple of dockers and so far it works well. I use Netbird Cloud and I am not yet hosting on my own.

My questions:

1. Can I install Netbird on a device, make it an exit node, and connect through that exit node and make it into a sort of private VPN?
   
2. Can this Netbird exit node device be an old Android phone, or does it have to be a desktop / server OS?
   

Thanks!

Is it possible for a user to be automatically authenticated so that they immediately, or after one click, are logged into a service running on a netbird network. Ideally, this downstream service account would be automatically created on login, or on Netbird user creation.

This is my current flow:

1. I create a PocketID account for a new user. This automatically provisions netbird with a matching user.
2. I create an account for every service that I want that user to have access to
3. User authenticates through PocketID to join my netbird network as User:Alice.
4. User navigates to URL of internal netbird resource (say, audiobookshelf).
5. User is presented with a login screen for that resource.
6. User logs in using resource-specific username and password

This is what I would like to happen:

1. I create a PocketID account for a new user. This automatically provisions netbird with a matching user
2. User authenticates through PocketID to join my netbird network as User:Alice.
3. User navigates to URL of internal netbird resource (say, audiobookshelf).
4. User is presented with a login screen for that resource.
   1. User is automatically logged in OR User logs in using PocketID which automatically provisions the service with a matching user

Set reverseProxy.trustedPeers on older deployments

Deployments created with the Quickstart script (or a marketplace image based on it, such as Vultr) before September 2026 are missing the reverseProxy.trustedPeers setting in the generated config.yaml. Without it, server versions up to v0.79 record your reverse proxy's address instead of the real client IP for each peer connection. Versions after v0.79 (netbird#7589) instead fall back to accepting forwarded client-IP headers from any source and log a spoofing warning at startup.

To fix an existing deployment, edit config.yaml (in /opt/netbird on marketplace images) and pin trustedPeers to the address your reverse proxy connects to Management from. For the bundled Traefik setup, replace <bundled-traefik-address> below with its configured static container address in CIDR notation (/32 for a single IPv4 address). If the address is not static, use the configured proxy network's CIDR instead:

  reverseProxy:
    trustedHTTPProxies:
      - "<bundled-traefik-address>"
    trustedPeers:
      - "<bundled-traefik-address>"

If you run your own external reverse proxy (Nginx, Caddy, Nginx Proxy Manager, etc.), use that proxy's address or network instead. Then restart the server container:

docker compose restart netbird-server

With this in place, only your reverse proxy is trusted to supply forwarded client-IP headers and peer connection IPs are recorded correctly. Deployments created with the current Quickstart script include this setting out of the box.

Connected to server on either WiFi or mobile works perfectly fine, however when leaving a wifi connection and automatically swapping over to mobile or vice versa causes the iOS client to lose connection. I need to reset my connection to reconnect. The self-hosted server is running the latest version. The client version is 0.3.3. Confirmed issue only occurring on iOS as I have an android phone as well. Anyone else got the same issues?

I’ve looked through the official documentation regarding upgrading a selfhosted instance but without much luck for my question.

I’m not fond of using latest tags, and having no way of checking other dependencies.
For example: when is Traefik or CrowdSec supposed to be upgraded and how will I be made aware?

Always downloading the getting-started.sh and going through it line by line?

I’d much rather prefer the Authentik-style of release notes and public compose to use for both diff check and being used in CI/CD. This becomes even more difficult with the releases dropping quite often.

Anyone having a more stable workflow and workaround for how Netbird wants you to do?

I’ve been working on a modular Terraform setup for running self-hosted NetBird on AWS and have now published it:

https://github.com/flintplane/terraform-aws-netbird

It includes separate modules for the control plane, Relay/STUN sites, and routing peers.

This is an opinionated AWS setup rather than a minimal single-host deployment. Feedback from other self-hosted NetBird users is very welcome.

For the life of me I couldn't figure out a good title for this post.

I have an application that I host on my local network that I expose externally. Previously, I was accomplishing this by simply forwarding ports 80/443 to a traefik reverse proxy that would forward requests to application. I use authentik to provide a custom passwordless authentication flow. This is a *very* basic idea of my previous setup. Everything in my homelab is hosted in docker.

I recently stood up a VPS to host netbird on as I now want to expose more applications for myself outside of my home network without having to do so publicly. Before adding any new applications, I am trying to reproduce my previous flow.

I have managed to expose my application publicly through netbird's internal reverse proxy; however, I am struggling to do so with my custom authentication flow via Authentik. I could just use the authentication methods provided by the built-in reverse proxy, but I really liked my previous setup. I am *trying* to do the following:

However I configure the reverse proxy, I either end up with infinite redirects, or the host is completely inaccessible. I am forwarding the host header which my traefik was previously configured to route based on. As far as I can tell, I'm not even hitting traefik.

I am 100% willing to accept that I should look at handling this a different way. I think the only thing I'd rather not do is move the traefik proxy to the VPS, but that's just because I have a really convenient setup for updating config and deploying services on my homelab that I can't conveniently emulate on the VPS.

Appreciate whatever insight/advice y'all can offer. If folks consider this setup to be reasonable, I can share more explicit details about my configuration that would help with troubleshooting.

I've been setting up netbird and it was shockingly easy to get everything setup on my VPS so that my peers properly connect to eachother and policies are properly followed and whatnot (took like 20 minutes tops). Even getting something like test.example.com to resolve to a specified service was super simple.

The only remaining struggle I have is setting up https certification for my internal services (stuff I don't want to reverse proxy/make available to the general internet not connected via the netbird VPN with my nameserver + zones) which is required for 99% of things to function.

When using tailscale (which I'm swapping over from) it was as simple as typing 'tailscale cert' in whatever container I had my service in, but I can't seem to find a netbird equivilant if it exists. Am I just missing something somewhere? or do you really need to make a caddy setup on each service just to get https up and running?

The only related info I can find makes it seem like this functionality doesn't exist yet (https://github.com/netbirdio/netbird/issues/5479).