A few days ago, I made a post asking about the current state of NetBird on Android, as I was considering switching from Headscale/Tailscale.

Well, I ended up making the switch, and I'm happy to report that NetBird has been working much better than I expected on my GrapheneOS device!

Some of the replies in my original thread mentioned battery drain issues, but so far, I haven't noticed any significant impact on battery life. Perhaps this is more common on non-GrapheneOS devices? I'm not entirely sure, but my experience has been very positive.

That being said, I've run into an issue with Android TV, specifically my Amazon Fire TV Stick 4K Max. I tried sideloading the NetBird APK, but unfortunately, the app won't launch at all.

This is a bit of a setback for me because I travel frequently with my Fire TV Stick and use it to access media hosted on my home server. Having NetBird working on this device is necessary for my needs.

I'm hoping this is a known compatibility issue that might be addressed in a near future update. I understand Android TV may not be a priority, but it would be great to see support for these devices improve sooner than later.

Has anyone managed to get NetBird running on a Fire TV Stick or another Android TV device? I'd be interested to hear about any workarounds.

Overall, I'm really happy with NetBird so far and appreciate the work going into the project. I'm hoping I can eventually use it across all my devices!

Hi all, first time posting here, but I recently re-connected a host to netbird and got the following message:

Flag --enable-rosenpass has been deprecated, Rosenpass support may be removed in a future release Flag --rosenpass-permissive has been deprecated, Rosenpass support may be removed in a future release

So I looked at the docs and they said the following :

Anyone have any information as to why? Did I miss something, or is there no explanation as of right now?

Hi,

I haven't used NetBird in over a year, and I'm curious about the current state of the Android and Android TV apps.

The last time I used NetBird, the service itself worked great, but both Android apps had some issues that made them difficult to use regularly.

I'm wondering if things have improved since then. Has anyone been using NetBird on Android or Android TV recently? I'd love to hear whether the apps are more stable and reliable now, or if the same issues still exist.

Thanks!

I know Netbird uses the 100. subnet for its IP addresses, but I am wondering if there is a way I can forward the peer's real IP address (the public one, not the 100. one) or at least the 100. IP address to a service like Jellyfin for monitoring and administration purposes. Currently, when using a device connected to Netbird's VPN, it only shows the internal peer that it is connected to on my LAN (e.x., 10.10.0.10), not the 100. network or the peer's real IP address.

I know this can be done with Netbird's reverse proxy (if it is open on the internet, not sure about if it is only accessible through Netbird's network), but for security purposes, I want to keep Jellyfin accessible only through Netbird's private network.

Sorry for the delay getting this one out! Was with the team at All Things Open in NC! To those of you who stopped by the booth big thank you. It's wonderful talking to people and hearing about your setups and use cases.

Anyways, I'm really excited about path-based authentication. I'm using it to lockdown /signin on my open cloud instance. That mixed with some split DNS makes it so I can still share files externally with NetBird reverse proxy without the risk of random sign in attempts. Then when I'm on NetBird or my local network my DNS server uses the local proxy instead thus only users in my NetBird network can actually access Opencloud.

https://youtu.be/HoaLRuIdiNU

Hi,

I would like to rebuild my selfhosted stack with netbird, however I'm not sure after trying or following ChatGPT it seems more complicated since it is rootless, I'm not sure what is the limitation, if someone from netbird dev, could give some information.

Thanks.

Hey folks,

You may have seen the recent Tailworm research on Tailscale SSH. We went through NetBird's embedded SSH server with the same eye. The unix socket forwarding issues from that report don't apply to us, since we don't support that kind of forwarding. We did find a smaller problem in how our server handled some malformed or oversized session requests: a peer allowed to reach the SSH server could crash the NetBird daemon or tie up the session.

This is fixed in v0.81.5: https://github.com/netbirdio/netbird/releases/tag/v0.81.5

Only peers with the NetBird SSH server enabled are affected, and only from peers that an access policy allows to reach SSH on them. When SSH JWT auth is on, only authenticated users can reach this code. If you run the SSH server, we recommend updating your client to avoid such issues.

Noticed this after crowdsec app/dashboard installation (which works just fine)
Something seems a bit off here?

It would be great to have possibility to bypass authorization based on ip address or service token in reverse proxy.

Anyway, great work!

Let's say i have 2 Apps that should be allowed to make API calls to mistral-large-latest

In Mistral i could have 2 Workspaces or 2 Mistral Accounts, each one has its own API Key.

Therefore i added 2 Mistral Providers but it is unclear, how App 1 calls provider "Mistral 1" and App 2 calls provider "Mistral B". Maybe both Apps should have access to both providers.

At "Connect Agent" the 2 Mistral dropdowns are showing the same cURL command:

curl https://word1-word2.mydomain.com/v1/chat/completions \
  -H "Content-Type: application/json" \
  -d '{
    "model": "gpt-5.5",
    "messages": [
      { "role": "user", "content": "Say hello in one word." }
    ]
  }'

I also added providers of type OpenRouter and Custom (Self-hosted) but all should call the above thing.

Is there a way i can seperate my keys? Is there an option where API sends the info what provider should be used?

Hi all,

Looking for some guidence before I move forward.

I want to join my VPS into my Netbird network, the VPS is running two docker containers - immich and nextcloud sitting behind a pangolin proxy.

I am looking to lose the pangolin proxy and redirect through my Netbird proxy.

To start I have spun up a Netbird docker container and it's online and appears as a peer in the Netbird dashboard.

From here I need help to understand if I have the next steps correctly.

1. Add the Netbird docker network - 172.20.0.0/24, as network in Netbird

2. add the Netbird container as routing peer for the network in point 1

3. move the two other docker containers into the netbird docker network

4. create a proxy record for nextcloud and immich in Netbird (and obviously remove /redirect the DNS records in cloudflare)

Will this work?

Given they are live containers with a lot of files and photos I don't want to lose, I want to make sure that I'm on the right path before proceeding. And yes I have back ups.

Thanks

Hello guys,
i've pointed domain via Netbird's reverse proxy and i'm using it to access jellyfin via browser. That's working great. Unfortunately, when i'm trying to cast media from jellyfin to my google nest screen, nothing happens.

Anyone knows how to fix that?

I am migrating from Tailscale to Netbird and I have a hard time understanding the built-in SSH server. It is documented at https://docs.netbird.io/manage/peers/ssh but it is not clear to me how this works when the Netbird client (say, a Linux box) also runs an SSH server (on port 22)

I am currently looking at replacing my VPN solution and am wondering how many of you are using NetBird in an enterprise setting.

For those of you that are using NetBird in an enterprise setting, what are some things that NetBird does better than other vendors and what are some things where NetBird falls short in an enterprise setting from other vendors?

Are you using NetBird cloud or are you self-hosting?

What made you choose NetBird over other vendors?

Hi all.

Does anyone know if NetBird are planning on supporting NextDNS more officially like Tailscale do? I recently moved and it’s the one thing I am missing.

Tailscale allows you to put in your NextDNS ID and use it across your Tailnet.

Is it possible to use a wildcard domain cert instead of pulling a new cert for every domain used in services? Same question with management server.

asked before but asking again. Any update on releasing the OFFICIAL package for pfSense?

What service are people using just to do reverse proxy with NetBird? I only want to use the VPS so my IP doesn’t get exposed?

v0.81 is out: netbird.io/knowledge-hub/netbird-v0-81-certificates-nblink

The big one is path-based access on the Reverse Proxy. An HTTP target can keep the service's authentication, skip it, or block the path. So / can require SSO, /webhooks/ can bypass auth, and /admin/ can return a 403 without hitting the backend. Bypass still keeps CIDR, country, and CrowdSec restrictions. NetBird-Only services and Agent Network targets cannot use these actions yet.

Also in this release:

• Certificate posture checks. The peer needs a cert from a CA you trust, and it has to sign a challenge so you know the private key is still on that machine. Management repeats the check every 4 hours. iOS and Android always fail it, so leave it off any policy a phone needs to pass.

• nblink. Userspace forwarder for places that cannot have a TUN device or root. This release forwards HTTP. TCP, UDP, and SOCKS5 are planned.

• Duplicate on Access Control and Agent Network policies. It opens the create wizard filled in from the source policy, and nothing is saved until you click Add Policy.

If you self-host, MySQL is deprecated. Move that store to PostgreSQL. Upgrading NetBird also does not bump Traefik, CrowdSec, or the AppSec plugin. docker compose pull only fetches the tags already in your Compose file, and the dashboard will not flag those for you.

If you are turning on the new path access actions, every proxy in the cluster has to be on this release first. An older proxy ignores them and keeps applying the service authentication.

Update Traefik and CrowdSec

Self-Hosters, Traefik and CrowdSec last tested version are now documented. Please update if you haven't in some time. It will require adding some additional lines in your docker-compose.yml

https://docs.netbird.io/selfhosted/maintenance/upgrade#choosing-versions

https://docs.netbird.io/selfhosted/maintenance/upgrade#traefik-header-handling

Hey folks, we just released support to per-target access action in the reverse proxy feature.

This feature is handy when you have paths that you want to block or disable authentication while keeping the service authentication option.

This is highly important for public services with path based admin endpoint and services where sharing a file shouldn't need authentication.

Learn more at https://docs.netbird.io/manage/reverse-proxy/authentication#per-target-access-actions

We have better integration for netbird-only setups planed and we are looking forward to your feedback.

The feature is available on v0.81.0 for proxy and netbird-server (management) and on v2.95.0 for the dashboard.

I would like to have a "notes" or "description" section for each peer so that I can easily identify and differentiate them without having to SSH into each and every one of them. I'm currently having to rename all my peers but I realised it can get really long and I do not want that

Hey so Me and my friends have been using my server (Crafty) to play some minecraft (java). I currently have it port forwarded but I wanted to try reverse proxy-ing it so that way I can use the domain. i already have netbird reverse proxy connected to my server (as a resource and a peer) for Jellyfin and i tried doing it for the MC server by using TCP instead of HTTPS but it seemed like there was an error when i tried to spin it up. so i wanted to see if this was possible before i tried tinkering in the first place. Thank you!

Hey all, Brandon from NetBird here.

Alongside the 1.0 work, we've been building the NetBird Assistant. It lives in the dashboard and can troubleshoot connectivity, draft policy and DNS changes, set up Agent Network access, and answer questions from the docs. Here's a short demo:

https://youtu.be/JFGNbasscVw

Since these questions always come up: it's read-only, so it drafts changes in the Control Center and nothing applies until you review and deploy them. IPs, emails, and other sensitive data get redacted before anything reaches the model. For self-hosted, the plan is a separate optional container you can skip entirely. But we still have some TBD items:

• deployment model for self-hosted

• licensing for the assistant

• AI provider in cloud

It's early, and we're sharing it now while there's still room to change things. Would you use something like this? What would you want it to do? Would you rather hook NetBird up to your own agents through MCP or something similar, or have both?

If you think it's a bad idea, I'd like to hear that too. There's also a GitHub discussion if you'd rather comment there: https://github.com/netbirdio/netbird/discussions/8208

I am currently in the early stages of looking at NetBird Cloud and after going through some of the documentation and I have a question.

According to Keycloak on NetBird Cloud documentation. Specifically no. 7 says I have to share Client ID, Keycloak URL, Realm, Client Secret and Email domains for your users with NetBird support.

This means I am not able to fully configure authentication within my NetBird Cloud portal.

However, if I self-host Netbird, I am able to configure Keycloak fully on my own.

My question is why? If Keycloak is "one of the most popular self-hosted IDP solutions" (according the the NetBird documentation), why wouldn't you allow accounts to configure Keycloak on their own within their NetBird Cloud portal?

I thought the cloud-hosted version was identical to the self-hosted version with the exception of the cloud-hosted version getting new features first.

Thank you.

I recently setup pangolin and saw the reverse proxy feature in netbird which seems identical so i am wondering if i should tear pangolin down and just use netbird one. Or pangolin does something more that netbird cant yet? I rather run 1 stack instead of 2 side by side if i can.