DYNR/netbird
2
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-08-05 00:15:26 -04:00
Code Issues 23.5k Packages Projects Releases 10 Wiki Activity

[GH-ISSUE #5319] Arbitrary TCP/UDP support for the Reverse Proxy #10301

New Issue
Closed
opened 2026-08-05 01:25:20 -04:00 by saavagebueno · 28 comments
saavagebueno commented 2026-08-05 01:25:20 -04:00
Owner
Copy Link

Originally created by @xangelix on GitHub (Feb 14, 2026).
Original GitHub issue: https://github.com/netbirdio/netbird/issues/5319

Is your feature request related to a problem? Please describe.
The current Reverse Proxy implementation is limited to Layer 7 (HTTP/HTTPS) traffic. This prevents the adoption of NetBird as a complete replacement for legacy VPN concentrators in enterprise environments.

While HTTP covers web apps, critical enterprise workflows often rely on opaque TCP/UDP protocols that cannot be wrapped in HTTP. Specifically, we are unable to expose:

  • Legacy Healthcare/Financial Interfaces: Systems using HL7 (MLLP), DICOM, or FIX protocols which run over raw TCP.
  • Proprietary Thick Clients: ERP systems (e.g., SAP GUI), industrial control dashboards (SCADA), or custom internal tools that use non-standard TCP streams.
  • VoIP and Streaming: SIP/RTP traffic which requires UDP support.

Without Layer 4 proxy support, we are forced to maintain parallel infrastructure (legacy VPNs or firewall pinholes) for these non-web resources, which fragments our Zero Trust strategy.

Describe the solution you'd like
I would like the Reverse Proxy to support Layer 4 (Transport Layer) proxying.

  1. Protocol Selection: Extend the "Protocol" dropdown to include TCP and UDP.
  2. Stream Handling: When a Layer 4 protocol is selected, the proxy should forward the raw byte stream without attempting to inspect headers, terminate TLS (unless SNI routing is specifically configured), or enforce HTTP semantics.
  3. Single-Port/SNI Routing: Ideally, allow TCP traffic to be routed via SNI (Server Name Indication) so multiple TLS-wrapped TCP services can share port 443, or allow the allocation of dedicated public ports for non-TLS TCP/UDP traffic.

Describe alternatives you've considered

  • Cloudflare Tunnels: This is not a viable alternative because it requires the connecting client to install cloudflared or use WARP to access non-HTTP services. We cannot ask external vendors or public users to install middleware just to connect to a specific port.
  • Cloudflare Spectrum: While this supports "clientless" TCP/UDP, it is gatekept behind expensive Enterprise plans for arbitrary ports.
  • Port Forwarding / VPS iptables: We currently hack this together by manually forwarding ports on a VPS into the NetBird mesh, but this defeats the purpose of NetBird's managed management dashboard.
Originally created by @xangelix on GitHub (Feb 14, 2026). Original GitHub issue: https://github.com/netbirdio/netbird/issues/5319 **Is your feature request related to a problem? Please describe.** The current Reverse Proxy implementation is limited to Layer 7 (HTTP/HTTPS) traffic. This prevents the adoption of NetBird as a complete replacement for legacy VPN concentrators in enterprise environments. While HTTP covers web apps, critical enterprise workflows often rely on opaque TCP/UDP protocols that cannot be wrapped in HTTP. Specifically, we are unable to expose: * **Legacy Healthcare/Financial Interfaces:** Systems using HL7 (MLLP), DICOM, or FIX protocols which run over raw TCP. * **Proprietary Thick Clients:** ERP systems (e.g., SAP GUI), industrial control dashboards (SCADA), or custom internal tools that use non-standard TCP streams. * **VoIP and Streaming:** SIP/RTP traffic which requires UDP support. Without Layer 4 proxy support, we are forced to maintain parallel infrastructure (legacy VPNs or firewall pinholes) for these non-web resources, which fragments our Zero Trust strategy. **Describe the solution you'd like** I would like the Reverse Proxy to support **Layer 4 (Transport Layer)** proxying. 1. **Protocol Selection:** Extend the "Protocol" dropdown to include `TCP` and `UDP`. 2. **Stream Handling:** When a Layer 4 protocol is selected, the proxy should forward the raw byte stream without attempting to inspect headers, terminate TLS (unless SNI routing is specifically configured), or enforce HTTP semantics. 3. **Single-Port/SNI Routing:** Ideally, allow TCP traffic to be routed via SNI (Server Name Indication) so multiple TLS-wrapped TCP services can share port 443, or allow the allocation of dedicated public ports for non-TLS TCP/UDP traffic. **Describe alternatives you've considered** * **Cloudflare Tunnels:** This is not a viable alternative because it requires the *connecting client* to install `cloudflared` or use WARP to access non-HTTP services. We cannot ask external vendors or public users to install middleware just to connect to a specific port. * **Cloudflare Spectrum:** While this supports "clientless" TCP/UDP, it is gatekept behind expensive Enterprise plans for arbitrary ports. * **Port Forwarding / VPS iptables:** We currently hack this together by manually forwarding ports on a VPS into the NetBird mesh, but this defeats the purpose of NetBird's managed management dashboard.
saavagebueno added the feature-request label 2026-08-05 01:25:20 -04:00
saavagebueno commented 2026-08-05 01:25:21 -04:00
Author
Owner
Copy Link

@xangelix commented on GitHub (Feb 14, 2026):

This would be a major advantage over competitors like Cloudflare Access!

<!-- gh-comment-id:3901211172 --> @xangelix commented on GitHub (Feb 14, 2026): This would be a major advantage over competitors like Cloudflare Access!
saavagebueno commented 2026-08-05 01:25:21 -04:00
Author
Owner
Copy Link

@DzigiBauk commented on GitHub (Feb 18, 2026):

This is the last thing I'd need to swap over from Pangolin

<!-- gh-comment-id:3923213814 --> @DzigiBauk commented on GitHub (Feb 18, 2026): This is the last thing I'd need to swap over from Pangolin
saavagebueno commented 2026-08-05 01:25:22 -04:00
Author
Owner
Copy Link

@Monkey-Business-2020 commented on GitHub (Feb 23, 2026):

Would absolutely love for this feature to be implemented!

<!-- gh-comment-id:3947774885 --> @Monkey-Business-2020 commented on GitHub (Feb 23, 2026): Would absolutely love for this feature to be implemented!
saavagebueno commented 2026-08-05 01:25:22 -04:00
Author
Owner
Copy Link

@JOEYSARMY commented on GitHub (Feb 23, 2026):

Currently using Pangolin. The features mentioned here are the only thing that is currently holding me back from switching over to NetBird.

Another important feature to me is support for PROXY protocol (v1 and v2) so I can pass real real IPs back to my services that aren't using HTTP. This isn't mission critical for me but would be nice to have.

<!-- gh-comment-id:3948341171 --> @JOEYSARMY commented on GitHub (Feb 23, 2026): Currently using Pangolin. The features mentioned here are the only thing that is currently holding me back from switching over to NetBird. Another important feature to me is support for PROXY protocol (v1 and v2) so I can pass real real IPs back to my services that aren't using HTTP. This isn't mission critical for me but would be nice to have.
saavagebueno commented 2026-08-05 01:25:22 -04:00
Author
Owner
Copy Link

@DzigiBauk commented on GitHub (Feb 23, 2026):

Likewise. PROXY protocol v1 specifically is essential to me.

<!-- gh-comment-id:3948407507 --> @DzigiBauk commented on GitHub (Feb 23, 2026): Likewise. PROXY protocol v1 specifically is essential to me.
saavagebueno commented 2026-08-05 01:25:22 -04:00
Author
Owner
Copy Link

@juroewsa commented on GitHub (Mar 4, 2026):

+1 this would also make it more easy to host my minecraft server

<!-- gh-comment-id:3999934245 --> @juroewsa commented on GitHub (Mar 4, 2026): +1 this would also make it more easy to host my minecraft server
saavagebueno commented 2026-08-05 01:25:22 -04:00
Author
Owner
Copy Link

@andrejcremoznik commented on GitHub (Mar 12, 2026):

Having this would completely eliminate my need to self-host and maintain 2 extra nodes. I'll gladly switch to a paid account on your cloud.

<!-- gh-comment-id:4048871760 --> @andrejcremoznik commented on GitHub (Mar 12, 2026): Having this would completely eliminate my need to self-host and maintain 2 extra nodes. I'll gladly switch to a paid account on your cloud.
saavagebueno commented 2026-08-05 01:25:22 -04:00
Author
Owner
Copy Link

@Crushedice commented on GitHub (Mar 17, 2026):

Greetings,
Yes. I agree with this totally.
So far i am pretty happy with Netbird and got really no negative things,
but i am also "forced" to use "zoraxy" beside it to utilize its "stream proxy" feature
As i got 3 public ips , where on one of them, most connections/ports are forwarded to a different backend server.

So , definitly would like to see a layer4 proxy
Maybe even

  • not only single ports, but port ranges?
  • maaaaybe the ability to route an ip completely (DNAT) ?? i know theres iptables and stuff. but its just f**ing rocket science ....

Thanks

<!-- gh-comment-id:4077379689 --> @Crushedice commented on GitHub (Mar 17, 2026): Greetings, Yes. I agree with this totally. So far i am pretty happy with Netbird and got really no negative things, but i am also "forced" to use "zoraxy" beside it to utilize its "stream proxy" feature As i got 3 public ips , where on one of them, most connections/ports are forwarded to a different backend server. So , definitly would like to see a layer4 proxy Maybe even - not only single ports, but port ranges? - maaaaybe the ability to route an ip completely (DNAT) ?? i know theres iptables and stuff. but its just f**ing rocket science .... Thanks
saavagebueno commented 2026-08-05 01:25:22 -04:00
Author
Owner
Copy Link

@BLACK4585 commented on GitHub (Mar 17, 2026):

Yes I totally agree about port ranges! I want to be able to also reverse proxy eg my coTURN server which requires ranges.

<!-- gh-comment-id:4077401918 --> @BLACK4585 commented on GitHub (Mar 17, 2026): Yes I totally agree about port ranges! I want to be able to also reverse proxy eg my coTURN server which requires ranges.
saavagebueno commented 2026-08-05 01:25:22 -04:00
Author
Owner
Copy Link

@xangelix commented on GitHub (Mar 18, 2026):

Some of these goals here are in!

https://github.com/netbirdio/dashboard/pull/579

https://github.com/netbirdio/netbird/pull/5530

https://github.com/netbirdio/netbird/pull/5612

<!-- gh-comment-id:4085639874 --> @xangelix commented on GitHub (Mar 18, 2026): Some of these goals here are in! https://github.com/netbirdio/dashboard/pull/579 https://github.com/netbirdio/netbird/pull/5530 https://github.com/netbirdio/netbird/pull/5612
saavagebueno commented 2026-08-05 01:25:22 -04:00
Author
Owner
Copy Link

@heywander commented on GitHub (Mar 22, 2026):

For a while now I've just been changing the traefik yaml and compose file to allow the ports I wanted that were raw tcp/udp

This is literally everything that I wanted (besides being able to use a custom domains root as another service clients can reach)

This next release is gonna be sick 🤯

<!-- gh-comment-id:4106819325 --> @heywander commented on GitHub (Mar 22, 2026): For a while now I've just been changing the traefik yaml and compose file to allow the ports I wanted that were raw tcp/udp This is literally everything that I wanted (besides being able to use a custom domains root as another service clients can reach) This next release is gonna be sick 🤯
saavagebueno commented 2026-08-05 01:25:22 -04:00
Author
Owner
Copy Link

@MichalisDBA commented on GitHub (Mar 23, 2026):

@xangelix With the latest release v0.67.0 can we say that the feature you posted is complete?

<!-- gh-comment-id:4111454900 --> @MichalisDBA commented on GitHub (Mar 23, 2026): @xangelix With the latest release v0.67.0 can we say that the feature you posted is complete?
saavagebueno commented 2026-08-05 01:25:22 -04:00
Author
Owner
Copy Link

@xangelix commented on GitHub (Mar 24, 2026):

@MichalisDBA -- I would assume so! And I encourage anyone who feels like their use case is not covered here to open secondary issues as feature requests and link them back here if they'd like 😁 .

Separately though, I don't seem to be able to actually use the feature on the latest versions?

Image

With a fresh install, on both my cluster domain, and a custom domain, I only see "HTTP/S Service" for the Service Type drop down.

Image

If anyone can provide any guidance it would be much appreciated!

proxy.env

NB_PROXY_DEBUG_LOGS=false

NB_PROXY_MANAGEMENT_ADDRESS=http://netbird-server:80
NB_PROXY_ALLOW_INSECURE=true

NB_PROXY_DOMAIN=proxy.mydomain.com
NB_PROXY_ADDRESS=:8443

NB_PROXY_TOKEN=REDACTED

NB_PROXY_CERTIFICATE_DIRECTORY=/certs
NB_PROXY_ACME_CERTIFICATES=true
NB_PROXY_ACME_CHALLENGE_TYPE=tls-alpn-01

NB_PROXY_OIDC_CLIENT_ID=netbird-proxy
NB_PROXY_OIDC_ENDPOINT=https://netbird.mydomain.com/oauth2
NB_PROXY_OIDC_SCOPES=openid,profile,email
NB_PROXY_FORWARDED_PROTO=https

NB_PROXY_PROXY_PROTOCOL=true
NB_PROXY_TRUSTED_PROXIES=172.30.0.10
<!-- gh-comment-id:4115710273 --> @xangelix commented on GitHub (Mar 24, 2026): @MichalisDBA -- I would assume so! And I encourage anyone who feels like their use case is not covered here to open secondary issues as feature requests and link them back here if they'd like 😁 . Separately though, I don't seem to be able to actually use the feature on the latest versions? <img width="227" height="78" alt="Image" src="https://github.com/user-attachments/assets/e482b589-0b0d-4869-9748-0dbc7228db99" /> With a fresh install, on both my cluster domain, and a custom domain, I only see "HTTP/S Service" for the Service Type drop down. <img width="666" height="586" alt="Image" src="https://github.com/user-attachments/assets/ac865326-8d6b-4609-8c1e-5c40eb186481" /> If anyone can provide any guidance it would be much appreciated! `proxy.env` ```env NB_PROXY_DEBUG_LOGS=false NB_PROXY_MANAGEMENT_ADDRESS=http://netbird-server:80 NB_PROXY_ALLOW_INSECURE=true NB_PROXY_DOMAIN=proxy.mydomain.com NB_PROXY_ADDRESS=:8443 NB_PROXY_TOKEN=REDACTED NB_PROXY_CERTIFICATE_DIRECTORY=/certs NB_PROXY_ACME_CERTIFICATES=true NB_PROXY_ACME_CHALLENGE_TYPE=tls-alpn-01 NB_PROXY_OIDC_CLIENT_ID=netbird-proxy NB_PROXY_OIDC_ENDPOINT=https://netbird.mydomain.com/oauth2 NB_PROXY_OIDC_SCOPES=openid,profile,email NB_PROXY_FORWARDED_PROTO=https NB_PROXY_PROXY_PROTOCOL=true NB_PROXY_TRUSTED_PROXIES=172.30.0.10 ```
saavagebueno commented 2026-08-05 01:25:22 -04:00
Author
Owner
Copy Link

@JOEYSARMY commented on GitHub (Mar 24, 2026):

Thought I was crazy - I spent my evening configuring and reconfiguring, did a fresh deployment as well, no dice. I can only see HTTP/S.

All reinstalls/reconfigurations were done with Traefik as the proxy engine, nginx and others untested in my environment.

<!-- gh-comment-id:4115746878 --> @JOEYSARMY commented on GitHub (Mar 24, 2026): Thought I was crazy - I spent my evening configuring and reconfiguring, did a fresh deployment as well, no dice. I can only see HTTP/S. All reinstalls/reconfigurations were done with Traefik as the proxy engine, nginx and others untested in my environment.
saavagebueno commented 2026-08-05 01:25:22 -04:00
Author
Owner
Copy Link

@Monkey-Business-2020 commented on GitHub (Mar 24, 2026):

Yeah I’m the same, I can only select from the HTTP/S service, there are no additional options for TCP and UDP.

However, I did notice that if I login to a machine with a NetBird agent installed on it I can run the NetBird expose command and that shows options now for TCP and UDP connections.

I ran a tmux session with split panes to expose 2 TCP services for now and I believe it worked. But would be nice to see this in the web app.

<!-- gh-comment-id:4115788589 --> @Monkey-Business-2020 commented on GitHub (Mar 24, 2026): Yeah I’m the same, I can only select from the HTTP/S service, there are no additional options for TCP and UDP. However, I did notice that if I login to a machine with a NetBird agent installed on it I can run the `NetBird expose` command and that shows options now for TCP and UDP connections. I ran a tmux session with split panes to expose 2 TCP services for now and I believe it worked. But would be nice to see this in the web app.
saavagebueno commented 2026-08-05 01:25:22 -04:00
Author
Owner
Copy Link

@lixmal commented on GitHub (Mar 24, 2026):

Did you guys update the reverse-proxy container? Traefik has nothin to do with this

<!-- gh-comment-id:4116893008 --> @lixmal commented on GitHub (Mar 24, 2026): Did you guys update the reverse-proxy container? Traefik has nothin to do with this
saavagebueno commented 2026-08-05 01:25:23 -04:00
Author
Owner
Copy Link

@xangelix commented on GitHub (Mar 24, 2026):

Did you guys update the reverse-proxy container? Traefik has nothin to do with this

Yes, to 0.67.0. (sha256:05216b3b1d0592f7a5540d3fde4b1a0e3fddcd3a65e12f1d4b0b40b416ad678f).

<!-- gh-comment-id:4119519809 --> @xangelix commented on GitHub (Mar 24, 2026): > Did you guys update the reverse-proxy container? Traefik has nothin to do with this Yes, to `0.67.0`. (`sha256:05216b3b1d0592f7a5540d3fde4b1a0e3fddcd3a65e12f1d4b0b40b416ad678f`).
saavagebueno commented 2026-08-05 01:25:23 -04:00
Author
Owner
Copy Link

@Monkey-Business-2020 commented on GitHub (Mar 24, 2026):

This is what I have:
Management v0.67.0
Dashboard v2.35.0

root@srv1337007:~# netbird status OS: linux/amd64 Daemon version: 0.67.0 CLI version: 0.67.0 Profile: default Management: Connected Signal: Connected Relays: 2/2 Available Nameservers: 0/0 Available FQDN: Redacted NetBird IP: 100.68.x.x/16 Interface type: Kernel Quantum resistance: false Lazy connection: false SSH Server: Disabled Networks: - Peers count: 9/14 Connected root@srv1337007:~#

<!-- gh-comment-id:4119951941 --> @Monkey-Business-2020 commented on GitHub (Mar 24, 2026): This is what I have: Management v0.67.0 Dashboard v2.35.0 `root@srv1337007:~# netbird status OS: linux/amd64 Daemon version: 0.67.0 CLI version: 0.67.0 Profile: default Management: Connected Signal: Connected Relays: 2/2 Available Nameservers: 0/0 Available FQDN: Redacted NetBird IP: 100.68.x.x/16 Interface type: Kernel Quantum resistance: false Lazy connection: false SSH Server: Disabled Networks: - Peers count: 9/14 Connected root@srv1337007:~#`
saavagebueno commented 2026-08-05 01:25:23 -04:00
Author
Owner
Copy Link

@wgetnz commented on GitHub (Mar 26, 2026):

@MichalisDBA——我猜也是！我也鼓励任何觉得自己的使用场景没有被涵盖在这里的人，以功能请求的形式提交其他问题，并根据需要链接到这里😁。

不过另外，我似乎无法在最新版本中使用这个功能？

图像 在我的集群域和自定义域上全新安装后，服务类型下拉列表中只显示“HTTP/S 服务”。 图像 如果有人能提供任何指导，我将不胜感激！

proxy.env

NB_PROXY_DEBUG_LOGS=false

NB_PROXY_MANAGEMENT_ADDRESS=http://netbird-server:80
NB_PROXY_ALLOW_INSECURE=true

NB_PROXY_DOMAIN=proxy.mydomain.com
NB_PROXY_ADDRESS=:8443

NB_PROXY_TOKEN=REDACTED

NB_PROXY_CERTIFICATE_DIRECTORY=/certs
NB_PROXY_ACME_CERTIFICATES=true
NB_PROXY_ACME_CHALLENGE_TYPE=tls-alpn-01

NB_PROXY_OIDC_CLIENT_ID=netbird-proxy
NB_PROXY_OIDC_ENDPOINT=https://netbird.mydomain.com/oauth2
NB_PROXY_OIDC_SCOPES=openid,profile,email
NB_PROXY_FORWARDED_PROTO=https

NB_PROXY_PROXY_PROTOCOL=true
NB_PROXY_TRUSTED_PROXIES=172.30.0.10

同样的问题

<!-- gh-comment-id:4136063530 --> @wgetnz commented on GitHub (Mar 26, 2026): > [@MichalisDBA](https://github.com/MichalisDBA)——我猜也是！我也鼓励任何觉得自己的使用场景没有被涵盖在这里的人，以功能请求的形式提交其他问题，并根据需要链接到这里😁。 > > 不过另外，我似乎无法在最新版本中使用这个功能？ > > <img alt="图像" width="227" height="78" src="https://private-user-images.githubusercontent.com/16216097/568140064-e482b589-0b0d-4869-9748-0dbc7228db99.png?jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3NzQ1Mzk3NTEsIm5iZiI6MTc3NDUzOTQ1MSwicGF0aCI6Ii8xNjIxNjA5Ny81NjgxNDAwNjQtZTQ4MmI1ODktMGIwZC00ODY5LTk3NDgtMGRiYzcyMjhkYjk5LnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNjAzMjYlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjYwMzI2VDE1MzczMVomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPWE2OTMzOGQyYzY1NDY3NDQ2NzkxMTY2NjU0OTRlMzQ3M2RhYTdkM2U5OGZiYTJlNTQ3YzVmM2NmOWYzOTNhMTQmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0In0.ZUUkgK7Gf_ck9Ta3ChYU72AS5zNfcgV_xk7g0iWfBDA"> > 在我的集群域和自定义域上全新安装后，服务类型下拉列表中只显示“HTTP/S 服务”。 > > <img alt="图像" width="666" height="586" src="https://private-user-images.githubusercontent.com/16216097/568140530-ac865326-8d6b-4609-8c1e-5c40eb186481.png?jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3NzQ1Mzk3NTEsIm5iZiI6MTc3NDUzOTQ1MSwicGF0aCI6Ii8xNjIxNjA5Ny81NjgxNDA1MzAtYWM4NjUzMjYtOGQ2Yi00NjA5LThjMWUtNWM0MGViMTg2NDgxLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNjAzMjYlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjYwMzI2VDE1MzczMVomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTc1M2JmOWVlNjFhYmY5N2ZkZDJiYWU3MWExMDc5ODVmYjUyZjI4YmZjNGZjYjI1MmU3NWQ2MTgzNzI0YjE5YmMmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0In0.QoVZi_wLZyTA-dfx5hnh_tb3o4XCI-xBUot76tEmDMU"> > 如果有人能提供任何指导，我将不胜感激！ > > `proxy.env` > > NB_PROXY_DEBUG_LOGS=false > > NB_PROXY_MANAGEMENT_ADDRESS=http://netbird-server:80 > NB_PROXY_ALLOW_INSECURE=true > > NB_PROXY_DOMAIN=proxy.mydomain.com > NB_PROXY_ADDRESS=:8443 > > NB_PROXY_TOKEN=REDACTED > > NB_PROXY_CERTIFICATE_DIRECTORY=/certs > NB_PROXY_ACME_CERTIFICATES=true > NB_PROXY_ACME_CHALLENGE_TYPE=tls-alpn-01 > > NB_PROXY_OIDC_CLIENT_ID=netbird-proxy > NB_PROXY_OIDC_ENDPOINT=https://netbird.mydomain.com/oauth2 > NB_PROXY_OIDC_SCOPES=openid,profile,email > NB_PROXY_FORWARDED_PROTO=https > > NB_PROXY_PROXY_PROTOCOL=true > NB_PROXY_TRUSTED_PROXIES=172.30.0.10 同样的问题
saavagebueno commented 2026-08-05 01:25:23 -04:00
Author
Owner
Copy Link

@viapix commented on GitHub (Mar 29, 2026):

I'm also only able to see the HTTP/HTTPS option in the Reverse Proxy page of the dashboard, after updating the server, dashboard, and proxy containers. Should this be raised as a separate issue or should the discussion continue here?

<!-- gh-comment-id:4151561462 --> @viapix commented on GitHub (Mar 29, 2026): I'm also only able to see the HTTP/HTTPS option in the Reverse Proxy page of the dashboard, after updating the server, dashboard, and proxy containers. Should this be raised as a separate issue or should the discussion continue here?
saavagebueno commented 2026-08-05 01:25:23 -04:00
Author
Owner
Copy Link

@MichalisDBA commented on GitHub (Mar 30, 2026):

@xangelix Yes i have the same problem. Installed v0.67.1 and the only Service Type is HTTP/S Service

<!-- gh-comment-id:4153624415 --> @MichalisDBA commented on GitHub (Mar 30, 2026): @xangelix Yes i have the same problem. Installed v0.67.1 and the only `Service Type` is `HTTP/S Service`
saavagebueno commented 2026-08-05 01:25:23 -04:00
Author
Owner
Copy Link

@shuuri-labs commented on GitHub (Apr 2, 2026):

@xangelix @JOEYSARMY @Monkey-Business-2020 @viapix @MichalisDBA

This "L4 proxy options not showing up" bug has been identified and fixed as of v0.67.2. Could you please try updating your instances and seeing if the options show up for you now?

If all looks good, I'll close this issue :)

<!-- gh-comment-id:4175529074 --> @shuuri-labs commented on GitHub (Apr 2, 2026): @xangelix @JOEYSARMY @Monkey-Business-2020 @viapix @MichalisDBA This "L4 proxy options not showing up" bug has been identified and fixed as of v0.67.2. Could you please try updating your instances and seeing if the options show up for you now? If all looks good, I'll close this issue :)
saavagebueno commented 2026-08-05 01:25:23 -04:00
Author
Owner
Copy Link

@j6y commented on GitHub (Apr 2, 2026):

The proxy options show up but don't seem to do anything, just shows Creating service... indefinitely. Not sure what to look for in the logs.

<!-- gh-comment-id:4175795499 --> @j6y commented on GitHub (Apr 2, 2026): The proxy options show up but don't seem to do anything, just shows `Creating service...` indefinitely. Not sure what to look for in the logs.
saavagebueno commented 2026-08-05 01:25:23 -04:00
Author
Owner
Copy Link

@shuuri-labs commented on GitHub (Apr 2, 2026):

The proxy options show up but don't seem to do anything, just shows Creating service... indefinitely. Not sure what to look for in the logs.

Just an excerpt from the proxy service logs when you try to create an L4 proxy would be helpful here. Would you mind sharing one?

<!-- gh-comment-id:4175999354 --> @shuuri-labs commented on GitHub (Apr 2, 2026): > The proxy options show up but don't seem to do anything, just shows `Creating service...` indefinitely. Not sure what to look for in the logs. Just an excerpt from the proxy service logs when you try to create an L4 proxy would be helpful here. Would you mind sharing one?
saavagebueno commented 2026-08-05 01:25:23 -04:00
Author
Owner
Copy Link

@viapix commented on GitHub (Apr 2, 2026):

The proxy options show up but don't seem to do anything, just shows Creating service... indefinitely. Not sure what to look for in the logs.

Just an excerpt from the proxy service logs when you try to create an L4 proxy would be helpful here. Would you mind sharing one?

Same problem on my end for any of the three new options. I tried checking the docker compose logs of the dashboard, server, and proxy, but there doesn't seem to be any logs showing up the moment i try to add the TCP / UDP / TLS service.

For the proxy, though, after some time hanging on the dashboard, i get the following logs:

netbird-proxy  | 2026-04-02T09:57:27.365Z WARN [http-server: https] ./caller_not_available:0: http: TLS handshake error from 193.32.248.252:49316: unknown domain "test.home.viapix.net"
netbird-proxy  | 2026-04-02T09:57:29.243Z WARN [http-server: https] ./caller_not_available:0: http: TLS handshake error from 193.32.248.252:57030: unknown domain "test.home.viapix.net"
netbird-proxy  | 2026-04-02T09:57:32.141Z WARN [http-server: https] ./caller_not_available:0: http: TLS handshake error from 193.32.248.252:57034: unknown domain "test.home.viapix.net"
netbird-proxy  | 2026-04-02T09:57:33.805Z WARN [http-server: https] ./caller_not_available:0: http: TLS handshake error from 193.32.248.252:57050: unknown domain "test.home.viapix.net"
netbird-proxy  | 2026-04-02T09:57:36.527Z WARN [http-server: https] ./caller_not_available:0: http: TLS handshake error from 193.32.248.252:57066: unknown domain "test.home.viapix.net"
netbird-proxy  | 2026-04-02T09:57:40.739Z WARN [http-server: https] ./caller_not_available:0: http: TLS handshake error from 193.32.248.252:55854: unknown domain "test.home.viapix.net"

... where test.home.viapix.net is the domain of the new service I try to register with TCP. (Or the other two)

<!-- gh-comment-id:4176086922 --> @viapix commented on GitHub (Apr 2, 2026): > > The proxy options show up but don't seem to do anything, just shows `Creating service...` indefinitely. Not sure what to look for in the logs. > > Just an excerpt from the proxy service logs when you try to create an L4 proxy would be helpful here. Would you mind sharing one? Same problem on my end for any of the three new options. I tried checking the `docker compose logs` of the dashboard, server, and proxy, but there doesn't seem to be any logs showing up the moment i try to add the TCP / UDP / TLS service. For the proxy, though, after some time hanging on the dashboard, i get the following logs: ```bash netbird-proxy | 2026-04-02T09:57:27.365Z WARN [http-server: https] ./caller_not_available:0: http: TLS handshake error from 193.32.248.252:49316: unknown domain "test.home.viapix.net" netbird-proxy | 2026-04-02T09:57:29.243Z WARN [http-server: https] ./caller_not_available:0: http: TLS handshake error from 193.32.248.252:57030: unknown domain "test.home.viapix.net" netbird-proxy | 2026-04-02T09:57:32.141Z WARN [http-server: https] ./caller_not_available:0: http: TLS handshake error from 193.32.248.252:57034: unknown domain "test.home.viapix.net" netbird-proxy | 2026-04-02T09:57:33.805Z WARN [http-server: https] ./caller_not_available:0: http: TLS handshake error from 193.32.248.252:57050: unknown domain "test.home.viapix.net" netbird-proxy | 2026-04-02T09:57:36.527Z WARN [http-server: https] ./caller_not_available:0: http: TLS handshake error from 193.32.248.252:57066: unknown domain "test.home.viapix.net" netbird-proxy | 2026-04-02T09:57:40.739Z WARN [http-server: https] ./caller_not_available:0: http: TLS handshake error from 193.32.248.252:55854: unknown domain "test.home.viapix.net" ``` ... where `test.home.viapix.net` is the domain of the new service I try to register with TCP. (Or the other two)
saavagebueno commented 2026-08-05 01:25:23 -04:00
Author
Owner
Copy Link

@viapix commented on GitHub (Apr 2, 2026):

After updating to 0.67.3 and properly exposing the necessary port, this works now on my end!

<!-- gh-comment-id:4181160957 --> @viapix commented on GitHub (Apr 2, 2026): After updating to 0.67.3 and properly [exposing the necessary port](https://docs.netbird.io/selfhosted/migration/enable-reverse-proxy#exposing-l4-ports), this works now on my end!
saavagebueno commented 2026-08-05 01:25:23 -04:00
Author
Owner
Copy Link

@zburgermeiszter commented on GitHub (Apr 5, 2026):

The SaaS Reverse Proxy Add Service form still only shows http/s.

<!-- gh-comment-id:4189526772 --> @zburgermeiszter commented on GitHub (Apr 5, 2026): The SaaS Reverse Proxy Add Service form still only shows http/s.
saavagebueno commented 2026-08-05 01:25:23 -04:00
Author
Owner
Copy Link

@xangelix commented on GitHub (Apr 6, 2026):

Working great for me on the latest version!

To all who have issues or feature requests that you feel aren't resolved (like maybe port ranges!), I'd encourage you to open up separate issues that can also link back to here. I think we can call this one complete!

@zburgermeiszter Just updating the container images was enough to resolve the issue for me.

Thanks so much to the NetBird developers and contributors for getting this relatively complex feature in so quickly!

<!-- gh-comment-id:4194384479 --> @xangelix commented on GitHub (Apr 6, 2026): Working great for me on the latest version! To all who have issues or feature requests that you feel aren't resolved (like maybe port ranges!), I'd encourage you to open up separate issues that can also link back to here. I think we can call this one complete! @zburgermeiszter Just updating the container images was enough to resolve the issue for me. Thanks so much to the NetBird developers and contributors for getting this relatively complex feature in so quickly!
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
2021 Q4
2021 Q4
2021 Q4
2022 Q1
2022 Q1
2022 Q1
2022 Q1
2022 Q1
2022 Q1
accessibility
accessibility
accessibility
acl
acl
acl
agent
agent
agent
agent
agent
agent
Android
Android
Android
Android
Android
Android
api
api
api
authentik
authentik
authentik
automation
automation
automation
azure
azure
azure
battery-usage
battery-usage
battery-usage
bug
cache
cache
cache
client
client
client
client-ui
client-ui
client-ui
cloud
cloud
cloud
cloud-only
cloud-only
cloud-only
cloudflare
cloudflare
cloudflare
community
community
community
compatibility
compatibility
compatibility
config-idp
config-idp
config-idp
config-issue
config-issue
config-issue
connection
connection
connection
contribution
contribution
contribution
coturn
coturn
coturn
cross-vpn
cross-vpn
cross-vpn
dashboard
dashboard
dashboard
data-usage
data-usage
data-usage
distribution
distribution
distribution
dns
dns
dns
docker
docker
docker
documentation
documentation
documentation
duplicate
duplicate
duplicate
enhancement
enhancement
event-stream
event-stream
event-stream
feature-request
feature-request
feature-request
freebsd
freebsd
freebsd
getting-started
getting-started
getting-started
go
go
go
good first issue
good first issue
good first issue
gui
gui
gui
help wanted
help wanted
help wanted
home-assistant
home-assistant
home-assistant
idp
idp
idp
inconsistency
inconsistency
inconsistency
integration
integration
integration
integrations
integrations
integrations
ios
ios
ios
ipv6
ipv6
ipv6
jwt
jwt
jwt
k8s
k8s
k8s
keycloak
keycloak
keycloak
linux
linux
linux
login
login
login
macos
macos
macos
management-service
management-service
management-service
Medium
Medium
Medium
missing-docs
missing-docs
missing-docs
mobile
mobile
mobile
moved-internal
moved-internal
moved-internal
needs-review
needs-review
needs-review
netbird-ui
netbird-ui
netbird-ui
networking
networking
networking
new-platform
new-platform
new-platform
nginx
nginx
nginx
notification
notification
notification
okta
okta
okta
openwrt
openwrt
openwrt
P2
P2
P2
packaging
packaging
packaging
peer-management
peer-management
peer-management
peer-management
peer-management
peer-management
peer-management
peer-management
peer-management
performance
performance
performance
postgres
postgres
postgres
posture-checks
posture-checks
posture-checks
psk
psk
psk
pull-request
Mirrored from GitHub Pull Request
 question
question
question
refactor
refactor
refactor
relay
relay
relay
release
release
release
rfc
rfc
rfc
routes
routes
routes
security
security
security
security-improvement
security-improvement
security-improvement
security-related
security-related
security-related
self-hosting
self-hosting
self-hosting
server
server
server
signal
signal
signal
sleep-issue
sleep-issue
sleep-issue
ssh
ssh
ssh
ssl
ssl
ssl
status
status
status
store
store
store
synology
synology
synology
system-compatibility-issue
system-compatibility-issue
system-compatibility-issue
test-suite
test-suite
test-suite
third-party-integration
third-party-integration
third-party-integration
triage
triage
triage
triage
triage
triage
triage-needed
triage-needed
triage-needed
troubleshooting
troubleshooting
troubleshooting
UX
UX
UX
waiting-feedback
waiting-feedback
waiting-feedback
windows
windows
windows
wontfix
wontfix
wontfix
zitadel
zitadel
zitadel
No Label feature-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
dynr-servers saavagebueno
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: DYNR/netbird#10301
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?