[GH-ISSUE #4991] Can't ping routing peer's local IP after explicitly setting up a policy that allows access #10501

Open
opened 2026-08-05 01:26:08 -04:00 by saavagebueno · 5 comments
Owner

Originally created by @luantran96 on GitHub (Dec 24, 2025).
Original GitHub issue: https://github.com/netbirdio/netbird/issues/4991

Describe the problem

I want to access the local IP of a routing peer of a network as this server hosts many of my applications. I found the solution to this is mentioned in this PR which is to creating an access policy that explicitly allows access to the routing peers. Even after doing so, I'm still not able to ping to local IP of the routing peer

To Reproduce

Steps to reproduce the behavior:

  1. Create a network with the subnet 10.0.0.0/8 as a resource and assign it to group
  2. Assign a routing group (right now there's one peer) for the network
  3. Create an ACL for accessing the 10.0.0.0/8 subnet
  4. Create an ACL for accessing the routing peer group

Expected behavior

After creating a routing peer policy, I should be able to ping the local IP of the routing peer.

Are you using NetBird Cloud?

self hosted

NetBird version

0.60.8

Is any other VPN software installed?

No

If yes, which one?

Debug output

To help us resolve the problem, please attach the following anonymized status output

netbird status -dA

Create and upload a debug bundle, and share the returned file key:

netbird debug for 1m -AS -U

Uploaded files are automatically deleted after 30 days.

Alternatively, create the file only and attach it here manually:

netbird debug for 1m -AS

Screenshots

Image Image

Additional context

I'm trying to connect from a peer that is in the Admin group

Have you tried these troubleshooting steps?

  • Reviewed client troubleshooting (if applicable)
  • Checked for newer NetBird versions
  • Searched for similar issues on GitHub (including closed ones)
  • Restarted the NetBird client
  • Disabled other VPN software
  • Checked firewall settings
Originally created by @luantran96 on GitHub (Dec 24, 2025). Original GitHub issue: https://github.com/netbirdio/netbird/issues/4991 **Describe the problem** I want to access the local IP of a routing peer of a network as this server hosts many of my applications. I found the solution to this is mentioned in this [PR](https://github.com/netbirdio/docs/pull/401) which is to creating an access policy that explicitly allows access to the routing peers. Even after doing so, I'm still not able to ping to local IP of the routing peer **To Reproduce** Steps to reproduce the behavior: 1. Create a network with the subnet 10.0.0.0/8 as a resource and assign it to group 2. Assign a routing group (right now there's one peer) for the network 3. Create an ACL for accessing the 10.0.0.0/8 subnet 4. Create an ACL for accessing the routing peer group **Expected behavior** After creating a routing peer policy, I should be able to ping the local IP of the routing peer. **Are you using NetBird Cloud?** self hosted **NetBird version** `0.60.8` **Is any other VPN software installed?** No If yes, which one? **Debug output** To help us resolve the problem, please attach the following anonymized status output netbird status -dA Create and upload a debug bundle, and share the returned file key: netbird debug for 1m -AS -U *Uploaded files are automatically deleted after 30 days.* Alternatively, create the file only and attach it here manually: netbird debug for 1m -AS **Screenshots** <img width="573" height="574" alt="Image" src="https://github.com/user-attachments/assets/e6644a25-fa25-4942-a2ef-9918714d9707" /> <img width="1920" height="968" alt="Image" src="https://github.com/user-attachments/assets/6698ec9d-5b04-4469-b8df-d25b987309ba" /> **Additional context** I'm trying to connect from a peer that is in the Admin group **Have you tried these troubleshooting steps?** - [x] Reviewed [client troubleshooting](https://docs.netbird.io/how-to/troubleshooting-client) (if applicable) - [x] Checked for newer NetBird versions - [x] Searched for similar issues on GitHub (including closed ones) - [x] Restarted the NetBird client - [x] Disabled other VPN software - [x] Checked firewall settings
saavagebueno added the triage-needed label 2026-08-05 01:26:08 -04:00
Author
Owner

@coderabbitai[bot] commented on GitHub (Dec 24, 2025):

📝 CodeRabbit Plan Mode

Generate an implementation plan and prompts that you can use with your favorite coding agent.

  • Create Plan
Examples

🔗 Similar Issues

Related Issues

🔗 Related PRs

netbirdio/netbird#4802 - [management] Fix direct peer networks route [merged]

👤 Suggested Assignees

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord or schedule a call!

<!-- gh-comment-id:3688890146 --> @coderabbitai[bot] commented on GitHub (Dec 24, 2025): <!-- This is an auto-generated issue plan by CodeRabbit --> ### 📝 CodeRabbit Plan Mode Generate an implementation plan and prompts that you can use with your favorite coding agent. - [ ] <!-- {"checkboxId": "8d4f2b9c-3e1a-4f7c-a9b2-d5e8f1c4a7b9"} --> Create Plan <details> <summary>Examples</summary> - [Example 1](https://github.com/coderabbitai/git-worktree-runner/issues/29#issuecomment-3589134556) - [Example 2](https://github.com/coderabbitai/git-worktree-runner/issues/12#issuecomment-3606665167) </details> --- <details> <summary><b>🔗 Similar Issues</b></summary> **Related Issues** - https://github.com/netbirdio/netbird/issues/4841 - https://github.com/netbirdio/netbird/issues/4765 - https://github.com/netbirdio/netbird/issues/4787 - https://github.com/netbirdio/netbird/issues/3841 </details> <details> <summary><b>🔗 Related PRs</b></summary> netbirdio/netbird#4802 - [management] Fix direct peer networks route [merged] </details> <details> <summary><b>👤 Suggested Assignees</b></summary> - [ninjack-dev](https://github.com/ninjack-dev) - [mitchplze](https://github.com/mitchplze) - [philzett](https://github.com/philzett) - [drewhemm](https://github.com/drewhemm) - [pascal-fischer](https://github.com/pascal-fischer) </details> --- <details> <summary> 🧪 Issue enrichment is currently in open beta.</summary> You can configure auto-planning by selecting labels in the issue_enrichment configuration. To disable automatic issue enrichment, add the following to your `.coderabbit.yaml`: ```yaml issue_enrichment: auto_enrich: enabled: false ``` </details> 💬 Have feedback or questions? Drop into our [discord](https://discord.gg/coderabbit) or [schedule a call](https://calendly.com/parth-coderabbit/issues-feedback)!
Author
Owner

@Billy5804 commented on GitHub (Feb 19, 2026):

I believe I'm also having this issue. I've got a network configured with 2 domain resources that with one resolving x.x.x.4 and the other resolving x.x.x.2 which is the LAN IP of the routing peer. Both of the resources have been added to the same group and a policy is configured to give my client peer access to the group. I am able to access the resource domain that resolves x.x.x.4, but the domain that resolves x.x.x.2 is not accessible and gets no response when pinged.

Since the service I'm trying to access with the domain that resolves the routing peer is running under docker on the peer host I also tried modifying the resolution of the domain using the extra_hosts in my compose file for the routing peer netbird client to resolve the domain as "host-gateway" and when that also didn't work I changed it to the gateway IP of the docker network that the target service is using, but that also failed to work.

I'm also self hosted and running 0.65.2 on both my server and windows/docker clients.

<!-- gh-comment-id:3927643732 --> @Billy5804 commented on GitHub (Feb 19, 2026): I believe I'm also having this issue. I've got a network configured with 2 domain resources that with one resolving x.x.x.4 and the other resolving x.x.x.2 which is the LAN IP of the routing peer. Both of the resources have been added to the same group and a policy is configured to give my client peer access to the group. I am able to access the resource domain that resolves x.x.x.4, but the domain that resolves x.x.x.2 is not accessible and gets no response when pinged. Since the service I'm trying to access with the domain that resolves the routing peer is running under docker on the peer host I also tried modifying the resolution of the domain using the extra_hosts in my compose file for the routing peer netbird client to resolve the domain as "host-gateway" and when that also didn't work I changed it to the gateway IP of the docker network that the target service is using, but that also failed to work. I'm also self hosted and running 0.65.2 on both my server and windows/docker clients.
Author
Owner

@gmits-tim commented on GitHub (Mar 2, 2026):

Similar issue here.

For example, I have a resource for the subnet 10.174.60.0/24.I can access all other 10.174.60.xx hosts. I cannot access my routing peer for the resource, which is at 10.174.60.2. I can, however, access the routing peer using its Netbird 100.x.x.x IP.

I already have an access control policy allow access to the routing peer and I still can't ping it.

<!-- gh-comment-id:3986079755 --> @gmits-tim commented on GitHub (Mar 2, 2026): Similar issue here. For example, I have a resource for the subnet 10.174.60.0/24.I can access all other 10.174.60.xx hosts. I cannot access my routing peer for the resource, which is at 10.174.60.2. I can, however, access the routing peer using its Netbird 100.x.x.x IP. I already have an access control policy allow access to the routing peer and I still can't ping it.
Author
Owner

@emrcbrn commented on GitHub (Apr 24, 2026):

Hi @gmits-tim / @luantran96 (or any future wanderer) - could I ask you to reach out to support@netbird.io as we'd like to investigate / fix this issue? Please reference this issue once you do. Thanks!

<!-- gh-comment-id:4313939620 --> @emrcbrn commented on GitHub (Apr 24, 2026): Hi @gmits-tim / @luantran96 (or any future wanderer) - could I ask you to reach out to support@netbird.io as we'd like to investigate / fix this issue? Please reference this issue once you do. Thanks!
Author
Owner

@gmits-tim commented on GitHub (Apr 27, 2026):

I created ticket 352377 a while back with Netbird support. Last I heard was support was checking internally. I'm busy with some projects and I don't really have time to troubleshoot further right now, but I'm confident the issue could be reproduced easily as I describe it above. My routing peer is a Windows server if that matters. Hope this helps.

<!-- gh-comment-id:4328165817 --> @gmits-tim commented on GitHub (Apr 27, 2026): I created ticket 352377 a while back with Netbird support. Last I heard was support was checking internally. I'm busy with some projects and I don't really have time to troubleshoot further right now, but I'm confident the issue could be reproduced easily as I describe it above. My routing peer is a Windows server if that matters. Hope this helps.
Sign in to join this conversation.
No Label triage-needed
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: DYNR/netbird#10501