DYNR/netbird
2
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-08-05 00:15:26 -04:00
Code Issues 23.5k Packages Projects Releases 10 Wiki Activity

[GH-ISSUE #5464] [Bug] [Android] network resources not reachable when defined with domain #11253

New Issue
Closed
opened 2026-08-05 01:29:04 -04:00 by saavagebueno · 6 comments
saavagebueno commented 2026-08-05 01:29:04 -04:00
Owner
Copy Link

Originally created by @kyuuk on GitHub (Feb 26, 2026).
Original GitHub issue: https://github.com/netbirdio/netbird/issues/5464

Describe the problem

When creating a network resource for a host with an FQDN instead of an ip the traffic is not routed for android clients (tested with a linux client works fine), also creating another resource for the same host but with IP works file

To Reproduce

Steps to reproduce the behavior:

  1. Create a network resource with an FQDN
  2. Create a policy to give access to that resource to an Android client
  3. Try accessing the resource with its FQDN from the Android Client
  4. It timeout

Expected behavior

The resource should be accessible as it is from a linux or windows client

Are you using NetBird Cloud?
no, self-host NetBird

NetBird version

  • Management, Relay, Signal : 0.66.0
  • Android client: 0.64.1 (Android version 16)

Is any other VPN software installed?

on the Android client : openVpn client
on the routing peer : OpenVpn server

Additional context

On the routing peer a tcpdump shows no traffic except the dns request when accessing using FQDN,
when accessing the same target but via ip (other resource created on the same network) traffic is flowing normally

Also the routing peer is configured as an exit-node, when i enable the exit-node on the client the resource is accessible normally

i see that the FQDN is resolved on the client

02-26 17:28:56.839 E/GoLog   (30125): [TRAC] [dns_id: ec99, request_id: 1b35a9d9] client/internal/routemanager/dnsinterceptor/handler.go:529 replaced real IP 192.168.0.4 with fake IP 240.0.0.1 in DNS response
02-26 17:28:56.840 E/GoLog   (30125): [TRAC] [request_id: 1b35a9d9, dns_id: ec99] client/internal/dns/handler_chain.go:264 response: domain=immich.MyDomain.com rcode=NOERROR answers=[240.0.0.1] peer=yvYE1pAnkt2U3g4VN7oBZkw8Yk2p4r31l+eiFq4ScWo= took=67.967291ms

via ADB i see that the target IP is replaced by a fake IP (in my case 240.0.0.1) and in both cases (via FQDN or IP) request seems to go the fake IP and in case of access with IP i see this additional logs :

02-26 17:29:35.939 E/GoLog   (30125): 2026-02-26T16:29:34+00:00 TRAC New egress TCP connection: 100.119.88.69:32842  192.168.0.4:80
02-26 17:29:35.940 E/GoLog   (30125): 2026-02-26T16:29:34+00:00 TRAC TCP connection 100.119.88.69:32842  192.168.0.4:80 transitioned from New to SYN Sent (dir: egress)
02-26 17:29:35.940 E/GoLog   (30125): 2026-02-26T16:29:34+00:00 TRAC Reverse DNAT: 192.168.0.4 -> 240.0.0.1
02-26 17:29:35.940 E/GoLog   (30125): 2026-02-26T16:29:34+00:00 TRAC Dropping local packet (ACL denied): rule_id= proto=TCP src=240.0.0.1:80 dst=100.119.88.69:32842
02-26 17:29:35.940 E/GoLog   (30125): 2026-02-26T16:29:34+00:00 TRAC New egress TCP connection: 100.119.88.69:32844  192.168.0.4:80
02-26 17:29:35.940 E/GoLog   (30125): 2026-02-26T16:29:34+00:00 TRAC TCP connection 100.119.88.69:32844  192.168.0.4:80 transitioned from New to SYN Sent (dir: egress)
02-26 17:29:35.940 E/GoLog   (30125): 2026-02-26T16:29:34+00:00 TRAC Reverse DNAT: 192.168.0.4 -> 240.0.0.1
02-26 17:29:35.940 E/GoLog   (30125): 2026-02-26T16:29:34+00:00 TRAC Dropping local packet (ACL denied): rule_id= proto=TCP src=240.0.0.1:80 dst=100.119.88.69:32844
02-26 17:29:35.940 E/GoLog   (30125): 2026-02-26T16:29:35+00:00 TRAC Reverse DNAT: 192.168.0.4 -> 240.0.0.1
02-26 17:29:35.940 E/GoLog   (30125): 2026-02-26T16:29:35+00:00 TRAC Dropping local packet (ACL denied): rule_id= proto=TCP src=240.0.0.1:80 dst=100.119.88.69:32842

In summary :

  • i have a routing peer router-A on the lan 192.168.0.0/24

  • routing peer router-A is also configured as an Exit-Node

  • i have a host immich.mydomain.com resolves to 192.168.0.4 on router-A Lan

  • Exit-node Disabled :

    • resource with address=immich.mydomain.com => Not reachable
    • resource with address=192.168.0.4 => Reachable

  • Exit-node Enabled :

    • resource with address=immich.mydomain.com => Reachable
    • resource with address=192.168.0.4 => Reachable

other possible rellevant logs when i make a request :

02-26 22:57:37.624 19757 19953 E GoLog   : [TRAC] [request_id: 750c983b, dns_id: fc2c] client/internal/routemanager/dnsinterceptor/handler.go:398 allocated fake IP 240.0.0.1 for real IP 192.168.0.4
02-26 22:57:37.624 19757 19953 E GoLog   : [TRAC] client/internal/routemanager/refcounter/refcounter.go:299 [dnsinterceptor.(*DnsInterceptor).addRouteAndAllowedIP] Increasing ref count [0 -> 1] for key 240.0.0.1/32 with In [{}] Out [{}]
02-26 22:57:37.624 19757 19953 E GoLog   : [TRAC] client/internal/routemanager/refcounter/refcounter.go:299 [dnsinterceptor.(*DnsInterceptor).addRouteAndAllowedIP] Calling add for key 240.0.0.1/32
02-26 22:57:37.625 19757 19953 E GoLog   : [TRAC] [dns_id: d7f6, request_id: abeac398] client/internal/dns/handler_chain.go:221 question: domain=immich.mydomain.com. type=AAAA class=IN -> handler=immich.mydomain.com pattern=immich.mydomain.com. wildcard=false match_subdomain=false priority=100
02-26 22:57:37.637 19757 19797 E GoLog   : [WARN] client/iface/iface.go:118 Failed to get interface by name tun0: route ip+net: netlinkrib: permission denied
02-26 22:57:37.637 19757 19797 E GoLog   : [TRAC] client/internal/routemanager/refcounter/refcounter.go:299 [dnsinterceptor.(*DnsInterceptor).addAllowedIPForPrefix] Increasing ref count [0 -> 1] for key 192.168.0.4/32 with In [yvYE1pAnkt2U3g4VN7oBZkw8Yk2p4r31l+eiFq4ScWo=] Out []
02-26 22:57:37.637 19757 19797 E GoLog   : [TRAC] client/internal/routemanager/refcounter/refcounter.go:299 [dnsinterceptor.(*DnsInterceptor).addAllowedIPForPrefix] Calling add for key 192.168.0.4/32
02-26 22:57:37.637 19757 19797 E GoLog   : [DEBG] client/iface/iface.go:193 Adding allowed IP to interface tun0 and peer yvYE1pAnkt2U3g4VN7oBZkw8Yk2p4r31l+eiFq4ScWo=: allowed IP 192.168.0.4/32 
02-26 22:57:37.637 19757 19797 E GoLog   : [DEBG] [request_id: 750c983b, dns_id: fc2c] client/internal/routemanager/dnsinterceptor/handler.go:496 added DNAT mapping: 240.0.0.1 -> 192.168.0.4
02-26 22:57:37.637 19757 19797 E GoLog   : [DEBG] [request_id: 750c983b, dns_id: fc2c] client/internal/routemanager/dnsinterceptor/handler.go:368 added dynamic route(s) for domain=immich.mydomain.com. (pattern: domain=immich.mydomain.com): [192.168.0.4/32]
02-26 22:57:37.637 19757 19797 E GoLog   : [TRAC] [request_id: 750c983b, dns_id: fc2c] client/internal/routemanager/dnsinterceptor/handler.go:529 replaced real IP 192.168.0.4 with fake IP 240.0.0.1 in DNS response
02-26 22:57:37.637 19757 19797 E GoLog   : [TRAC] [dns_id: fc2c, request_id: 750c983b] client/internal/dns/handler_chain.go:264 response: domain=immich.mydomain.com. rcode=NOERROR answers=[240.0.0.1] peer=yvYE1pAnkt2U3g4VN7oBZkw8Yk2p4r31l+eiFq4ScWo= took=82.314791ms
02-26 22:57:37.682 19757 19953 E GoLog   : [TRAC] [request_id: abeac398, dns_id: d7f6] client/internal/dns/handler_chain.go:264 response: domain=immich.mydomain.com. rcode=NOERROR answers=[] peer=yvYE1pAnkt2U3g4VN7oBZkw8Yk2p4r31l+eiFq4ScWo= took=57.63875ms
02-26 22:57:37.761 19757 19797 E GoLog   : 2026-02-26T21:57:37+00:00 TRAC New egress UDP connection: 100.119.88.69:44783 → 100.119.196.38:22054
02-26 22:57:37.761 19757 19797 E GoLog   : 2026-02-26T21:57:37+00:00 TRAC New egress UDP connection: 100.119.88.69:41802 → 100.119.196.38:22054
02-26 22:57:37.762 19757 19797 E GoLog   : 2026-02-26T21:57:37+00:00 TRAC New egress UDP connection: 100.119.88.69:52991 → 100.119.196.38:22054

i saw a Warning about the inet interface
[WARN] client/iface/iface.go:118 Failed to get interface by name tun0: route ip+net: netlinkrib: permission denied
i checked with an ADB shell, the interface for netbird was tun1

EDIT 14-03-2026:
i did further tests, and i observed that at the time of the connection the interface is first created as tun0 and then it immediatly changes to tun1 (tested on android 14, 15 & 16 using android studio virtual devices)

Have you tried these troubleshooting steps?

  • Reviewed client troubleshooting (if applicable)
  • Checked for newer NetBird versions
  • Searched for similar issues on GitHub (including closed ones)
  • Restarted the NetBird client
  • Disabled other VPN software
  • Checked firewall settings
Originally created by @kyuuk on GitHub (Feb 26, 2026). Original GitHub issue: https://github.com/netbirdio/netbird/issues/5464 **Describe the problem** When creating a network resource for a host with an FQDN instead of an ip the traffic is not routed for android clients (tested with a linux client works fine), also creating another resource for the same host but with IP works file **To Reproduce** Steps to reproduce the behavior: 1. Create a network resource with an FQDN 2. Create a policy to give access to that resource to an Android client 3. Try accessing the resource with its FQDN from the Android Client 4. It timeout **Expected behavior** The resource should be accessible as it is from a linux or windows client **Are you using NetBird Cloud?** no, self-host NetBird **NetBird version** - Management, Relay, Signal : 0.66.0 - Android client: 0.64.1 (Android version 16) **Is any other VPN software installed?** on the Android client : openVpn client on the routing peer : OpenVpn server **Additional context** On the routing peer a tcpdump shows no traffic except the dns request when accessing using FQDN, when accessing the same target but via ip (other resource created on the same network) traffic is flowing normally Also the routing peer is configured as an exit-node, when i enable the exit-node on the client the resource is accessible normally i see that the FQDN is resolved on the client ``` 02-26 17:28:56.839 E/GoLog (30125): [TRAC] [dns_id: ec99, request_id: 1b35a9d9] client/internal/routemanager/dnsinterceptor/handler.go:529 replaced real IP 192.168.0.4 with fake IP 240.0.0.1 in DNS response 02-26 17:28:56.840 E/GoLog (30125): [TRAC] [request_id: 1b35a9d9, dns_id: ec99] client/internal/dns/handler_chain.go:264 response: domain=immich.MyDomain.com rcode=NOERROR answers=[240.0.0.1] peer=yvYE1pAnkt2U3g4VN7oBZkw8Yk2p4r31l+eiFq4ScWo= took=67.967291ms ``` via ADB i see that the target IP is replaced by a fake IP (in my case 240.0.0.1) and in both cases (via FQDN or IP) request seems to go the fake IP and in case of access with IP i see this additional logs : ``` 02-26 17:29:35.939 E/GoLog (30125): 2026-02-26T16:29:34+00:00 TRAC New egress TCP connection: 100.119.88.69:32842 ÔåÆ 192.168.0.4:80 02-26 17:29:35.940 E/GoLog (30125): 2026-02-26T16:29:34+00:00 TRAC TCP connection 100.119.88.69:32842 ÔåÆ 192.168.0.4:80 transitioned from New to SYN Sent (dir: egress) 02-26 17:29:35.940 E/GoLog (30125): 2026-02-26T16:29:34+00:00 TRAC Reverse DNAT: 192.168.0.4 -> 240.0.0.1 02-26 17:29:35.940 E/GoLog (30125): 2026-02-26T16:29:34+00:00 TRAC Dropping local packet (ACL denied): rule_id= proto=TCP src=240.0.0.1:80 dst=100.119.88.69:32842 02-26 17:29:35.940 E/GoLog (30125): 2026-02-26T16:29:34+00:00 TRAC New egress TCP connection: 100.119.88.69:32844 ÔåÆ 192.168.0.4:80 02-26 17:29:35.940 E/GoLog (30125): 2026-02-26T16:29:34+00:00 TRAC TCP connection 100.119.88.69:32844 ÔåÆ 192.168.0.4:80 transitioned from New to SYN Sent (dir: egress) 02-26 17:29:35.940 E/GoLog (30125): 2026-02-26T16:29:34+00:00 TRAC Reverse DNAT: 192.168.0.4 -> 240.0.0.1 02-26 17:29:35.940 E/GoLog (30125): 2026-02-26T16:29:34+00:00 TRAC Dropping local packet (ACL denied): rule_id= proto=TCP src=240.0.0.1:80 dst=100.119.88.69:32844 02-26 17:29:35.940 E/GoLog (30125): 2026-02-26T16:29:35+00:00 TRAC Reverse DNAT: 192.168.0.4 -> 240.0.0.1 02-26 17:29:35.940 E/GoLog (30125): 2026-02-26T16:29:35+00:00 TRAC Dropping local packet (ACL denied): rule_id= proto=TCP src=240.0.0.1:80 dst=100.119.88.69:32842 ``` In summary : - i have a routing peer `router-A` on the lan `192.168.0.0/24` - routing peer `router-A` is also configured as an Exit-Node - i have a host immich.mydomain.com resolves to 192.168.0.4 on `router-A` Lan - Exit-node Disabled : - resource with address=immich.mydomain.com => Not reachable - resource with address=192.168.0.4 => Reachable - Exit-node Enabled : - resource with address=immich.mydomain.com => Reachable - resource with address=192.168.0.4 => Reachable other possible rellevant logs when i make a request : ``` 02-26 22:57:37.624 19757 19953 E GoLog : [TRAC] [request_id: 750c983b, dns_id: fc2c] client/internal/routemanager/dnsinterceptor/handler.go:398 allocated fake IP 240.0.0.1 for real IP 192.168.0.4 02-26 22:57:37.624 19757 19953 E GoLog : [TRAC] client/internal/routemanager/refcounter/refcounter.go:299 [dnsinterceptor.(*DnsInterceptor).addRouteAndAllowedIP] Increasing ref count [0 -> 1] for key 240.0.0.1/32 with In [{}] Out [{}] 02-26 22:57:37.624 19757 19953 E GoLog : [TRAC] client/internal/routemanager/refcounter/refcounter.go:299 [dnsinterceptor.(*DnsInterceptor).addRouteAndAllowedIP] Calling add for key 240.0.0.1/32 02-26 22:57:37.625 19757 19953 E GoLog : [TRAC] [dns_id: d7f6, request_id: abeac398] client/internal/dns/handler_chain.go:221 question: domain=immich.mydomain.com. type=AAAA class=IN -> handler=immich.mydomain.com pattern=immich.mydomain.com. wildcard=false match_subdomain=false priority=100 02-26 22:57:37.637 19757 19797 E GoLog : [WARN] client/iface/iface.go:118 Failed to get interface by name tun0: route ip+net: netlinkrib: permission denied 02-26 22:57:37.637 19757 19797 E GoLog : [TRAC] client/internal/routemanager/refcounter/refcounter.go:299 [dnsinterceptor.(*DnsInterceptor).addAllowedIPForPrefix] Increasing ref count [0 -> 1] for key 192.168.0.4/32 with In [yvYE1pAnkt2U3g4VN7oBZkw8Yk2p4r31l+eiFq4ScWo=] Out [] 02-26 22:57:37.637 19757 19797 E GoLog : [TRAC] client/internal/routemanager/refcounter/refcounter.go:299 [dnsinterceptor.(*DnsInterceptor).addAllowedIPForPrefix] Calling add for key 192.168.0.4/32 02-26 22:57:37.637 19757 19797 E GoLog : [DEBG] client/iface/iface.go:193 Adding allowed IP to interface tun0 and peer yvYE1pAnkt2U3g4VN7oBZkw8Yk2p4r31l+eiFq4ScWo=: allowed IP 192.168.0.4/32 02-26 22:57:37.637 19757 19797 E GoLog : [DEBG] [request_id: 750c983b, dns_id: fc2c] client/internal/routemanager/dnsinterceptor/handler.go:496 added DNAT mapping: 240.0.0.1 -> 192.168.0.4 02-26 22:57:37.637 19757 19797 E GoLog : [DEBG] [request_id: 750c983b, dns_id: fc2c] client/internal/routemanager/dnsinterceptor/handler.go:368 added dynamic route(s) for domain=immich.mydomain.com. (pattern: domain=immich.mydomain.com): [192.168.0.4/32] 02-26 22:57:37.637 19757 19797 E GoLog : [TRAC] [request_id: 750c983b, dns_id: fc2c] client/internal/routemanager/dnsinterceptor/handler.go:529 replaced real IP 192.168.0.4 with fake IP 240.0.0.1 in DNS response 02-26 22:57:37.637 19757 19797 E GoLog : [TRAC] [dns_id: fc2c, request_id: 750c983b] client/internal/dns/handler_chain.go:264 response: domain=immich.mydomain.com. rcode=NOERROR answers=[240.0.0.1] peer=yvYE1pAnkt2U3g4VN7oBZkw8Yk2p4r31l+eiFq4ScWo= took=82.314791ms 02-26 22:57:37.682 19757 19953 E GoLog : [TRAC] [request_id: abeac398, dns_id: d7f6] client/internal/dns/handler_chain.go:264 response: domain=immich.mydomain.com. rcode=NOERROR answers=[] peer=yvYE1pAnkt2U3g4VN7oBZkw8Yk2p4r31l+eiFq4ScWo= took=57.63875ms 02-26 22:57:37.761 19757 19797 E GoLog : 2026-02-26T21:57:37+00:00 TRAC New egress UDP connection: 100.119.88.69:44783 → 100.119.196.38:22054 02-26 22:57:37.761 19757 19797 E GoLog : 2026-02-26T21:57:37+00:00 TRAC New egress UDP connection: 100.119.88.69:41802 → 100.119.196.38:22054 02-26 22:57:37.762 19757 19797 E GoLog : 2026-02-26T21:57:37+00:00 TRAC New egress UDP connection: 100.119.88.69:52991 → 100.119.196.38:22054 ``` i saw a Warning about the inet interface `[WARN] client/iface/iface.go:118 Failed to get interface by name tun0: route ip+net: netlinkrib: permission denied` i checked with an ADB shell, the interface for netbird was `tun1` EDIT 14-03-2026: i did further tests, and i observed that at the time of the connection the interface is first created as `tun0` and then it immediatly changes to `tun1` (tested on android 14, 15 & 16 using android studio virtual devices) **Have you tried these troubleshooting steps?** - [X] Reviewed [client troubleshooting](https://docs.netbird.io/how-to/troubleshooting-client) (if applicable) - [X] Checked for newer NetBird versions - [X] Searched for similar issues on GitHub (including closed ones) - [X] Restarted the NetBird client - [x] Disabled other VPN software - [ ] Checked firewall settings
saavagebueno added the triage-needed label 2026-08-05 01:29:04 -04:00
saavagebueno commented 2026-08-05 01:29:04 -04:00
Author
Owner
Copy Link

@PeterR-SK commented on GitHub (Mar 12, 2026):

I am currently investigating very similar (or maybe even the same) issue. In my case, network resources defined with FQDN are accessible on Android client, but not reliably. I installed application called Termux on my Android phone, which gives access to terminal and some commands. I can confirm network resolution works and all hosts are resolved to 240.0.0.1 IP.

Also curl to my internal websites defined with resources is working when performed in Termux. However, Chrome on Android and Firefox on Android seems to have some kind of issue. They are sometimes able to connect, but often not. Interestingly, I observed this on resources that are available both internally and from the internet at the same time. My Authentik instance is good example, as this I have available both in internal network as well as from internet (required for Netbird clients to be able to authenticate). For websites hosted internally only, these seem to work reliably.

After my preliminary assessment, it seems that name resolution is working, routing peer is performing the resolution and Android Netbird client is getting everything resolved to 240.0.0.1. However, perhaps this is incompatible with Internet browsers on Android, for which I have no idea how they are doing the DNS resolution.

Also, everything was working fine when I connected with Windows PC using the Android phone as mobile hotspot.

@kyuuk My suggestion would be if you could try also curl on Android phone to rule out if the issue is isolated just to Internet browser or to the client as a whole.

<!-- gh-comment-id:4050726941 --> @PeterR-SK commented on GitHub (Mar 12, 2026): I am currently investigating very similar (or maybe even the same) issue. In my case, network resources defined with FQDN are accessible on Android client, but not reliably. I installed application called **Termux** on my Android phone, which gives access to terminal and some commands. I can confirm network resolution works and all hosts are resolved to 240.0.0.1 IP. Also `curl` to my internal websites defined with resources is working when performed in **Termux**. However, Chrome on Android and Firefox on Android seems to have some kind of issue. They are sometimes able to connect, but often not. Interestingly, I observed this on resources that are available both internally and from the internet at the same time. My Authentik instance is good example, as this I have available both in internal network as well as from internet (required for Netbird clients to be able to authenticate). For websites hosted internally only, these seem to work reliably. After my preliminary assessment, it seems that name resolution is working, routing peer is performing the resolution and Android Netbird client is getting everything resolved to 240.0.0.1. However, perhaps this is incompatible with Internet browsers on Android, for which I have no idea how they are doing the DNS resolution. Also, everything was working fine when I connected with Windows PC using the Android phone as mobile hotspot. @kyuuk My suggestion would be if you could try also `curl` on Android phone to rule out if the issue is isolated just to Internet browser or to the client as a whole.
saavagebueno commented 2026-08-05 01:29:04 -04:00
Author
Owner
Copy Link

@kyuuk commented on GitHub (Mar 13, 2026):

Hello @PeterR-SK, i pretty much tried everything, and i can confirm that it is not just a browser thing

a tcpdump on the routing peer show literally nothing except the dns queries :/

here is the curl

130|r9q:/ $ timeout 10 curl immich.example.com -v
* Host immich.example.com:80 was resolved.
* IPv6: (none)
* IPv4: 240.0.0.1
*   Trying 240.0.0.1:80...
124|r9q:/ $

the tcpdump on the routing peer for the same timeframe

user@router:~# tcpdump -ni wt0
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on wt0, link-type RAW (Raw IP), snapshot length 262144 bytes
18:06:09.621654 IP 100.119.88.69.47012 > 100.119.196.38.22054: UDP, length 33
18:06:09.622039 IP 100.119.88.69.39298 > 100.119.196.38.22054: UDP, length 33
18:06:09.622251 IP 100.119.196.38.22054 > 100.119.88.69.47012: UDP, length 33
18:06:09.622394 IP 100.119.196.38.22054 > 100.119.88.69.39298: UDP, length 64
<!-- gh-comment-id:4056652062 --> @kyuuk commented on GitHub (Mar 13, 2026): Hello @PeterR-SK, i pretty much tried everything, and i can confirm that it is not just a browser thing a tcpdump on the routing peer show literally nothing except the dns queries :/ here is the curl ``` 130|r9q:/ $ timeout 10 curl immich.example.com -v * Host immich.example.com:80 was resolved. * IPv6: (none) * IPv4: 240.0.0.1 * Trying 240.0.0.1:80... 124|r9q:/ $ ``` the tcpdump on the routing peer for the same timeframe ``` user@router:~# tcpdump -ni wt0 tcpdump: verbose output suppressed, use -v[v]... for full protocol decode listening on wt0, link-type RAW (Raw IP), snapshot length 262144 bytes 18:06:09.621654 IP 100.119.88.69.47012 > 100.119.196.38.22054: UDP, length 33 18:06:09.622039 IP 100.119.88.69.39298 > 100.119.196.38.22054: UDP, length 33 18:06:09.622251 IP 100.119.196.38.22054 > 100.119.88.69.47012: UDP, length 33 18:06:09.622394 IP 100.119.196.38.22054 > 100.119.88.69.39298: UDP, length 64 ```
saavagebueno commented 2026-08-05 01:29:04 -04:00
Author
Owner
Copy Link

@kyuuk commented on GitHub (Mar 13, 2026):

another test i just did, i used another android device (on android 13 i don't know if that's relevant),
and on this device the netbird interface was tun0 and everything worked correctly.

so what i observed:

  • 2 devices where interface is tun1 => no traffic except dns
  • 1 device where interface is tun0 => work perfectly
<!-- gh-comment-id:4057505121 --> @kyuuk commented on GitHub (Mar 13, 2026): another test i just did, i used another android device (on android 13 i don't know if that's relevant), and on this device the netbird interface was `tun0` and everything worked correctly. so what i observed: - 2 devices where interface is tun1 => no traffic except dns - 1 device where interface is tun0 => work perfectly
saavagebueno commented 2026-08-05 01:29:04 -04:00
Author
Owner
Copy Link

@PeterR-SK commented on GitHub (Mar 13, 2026):

My device is Android 14 and I see VPN interface is tun0. Indeed it looks like yours is not getting any traffic through with tun1 interface. I think my issue is really related to browsers handling DNS. Unfortunately I am not good with investigating on phones due to lack of tools compared to Windows or Linux.

<!-- gh-comment-id:4057649433 --> @PeterR-SK commented on GitHub (Mar 13, 2026): My device is Android 14 and I see VPN interface is tun0. Indeed it looks like yours is not getting any traffic through with tun1 interface. I think my issue is really related to browsers handling DNS. Unfortunately I am not good with investigating on phones due to lack of tools compared to Windows or Linux.
saavagebueno commented 2026-08-05 01:29:04 -04:00
Author
Owner
Copy Link

@kyuuk commented on GitHub (Mar 13, 2026):

@PeterR-SK, thank you for the confirmation,

for your case you should open a new issue

also you should check if the private DNS setting is disabled on your device i remember having issues with local dns resolution for private domains

<!-- gh-comment-id:4058217299 --> @kyuuk commented on GitHub (Mar 13, 2026): @PeterR-SK, thank you for the confirmation, for your case you should open a new issue also you should check if the `private DNS` setting is disabled on your device i remember having issues with local dns resolution for private domains
saavagebueno commented 2026-08-05 01:29:04 -04:00
Author
Owner
Copy Link

@kyuuk commented on GitHub (Apr 13, 2026):

this seems to be fixed in client version 0.68.0. so i'm closing the issue

<!-- gh-comment-id:4239558230 --> @kyuuk commented on GitHub (Apr 13, 2026): this seems to be fixed in client version 0.68.0. so i'm closing the issue
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
2021 Q4
2021 Q4
2021 Q4
2022 Q1
2022 Q1
2022 Q1
2022 Q1
2022 Q1
2022 Q1
accessibility
accessibility
accessibility
acl
acl
acl
agent
agent
agent
agent
agent
agent
Android
Android
Android
Android
Android
Android
api
api
api
authentik
authentik
authentik
automation
automation
automation
azure
azure
azure
battery-usage
battery-usage
battery-usage
bug
cache
cache
cache
client
client
client
client-ui
client-ui
client-ui
cloud
cloud
cloud
cloud-only
cloud-only
cloud-only
cloudflare
cloudflare
cloudflare
community
community
community
compatibility
compatibility
compatibility
config-idp
config-idp
config-idp
config-issue
config-issue
config-issue
connection
connection
connection
contribution
contribution
contribution
coturn
coturn
coturn
cross-vpn
cross-vpn
cross-vpn
dashboard
dashboard
dashboard
data-usage
data-usage
data-usage
distribution
distribution
distribution
dns
dns
dns
docker
docker
docker
documentation
documentation
documentation
duplicate
duplicate
duplicate
enhancement
enhancement
event-stream
event-stream
event-stream
feature-request
feature-request
feature-request
freebsd
freebsd
freebsd
getting-started
getting-started
getting-started
go
go
go
good first issue
good first issue
good first issue
gui
gui
gui
help wanted
help wanted
help wanted
home-assistant
home-assistant
home-assistant
idp
idp
idp
inconsistency
inconsistency
inconsistency
integration
integration
integration
integrations
integrations
integrations
ios
ios
ios
ipv6
ipv6
ipv6
jwt
jwt
jwt
k8s
k8s
k8s
keycloak
keycloak
keycloak
linux
linux
linux
login
login
login
macos
macos
macos
management-service
management-service
management-service
Medium
Medium
Medium
missing-docs
missing-docs
missing-docs
mobile
mobile
mobile
moved-internal
moved-internal
moved-internal
needs-review
needs-review
needs-review
netbird-ui
netbird-ui
netbird-ui
networking
networking
networking
new-platform
new-platform
new-platform
nginx
nginx
nginx
notification
notification
notification
okta
okta
okta
openwrt
openwrt
openwrt
P2
P2
P2
packaging
packaging
packaging
peer-management
peer-management
peer-management
peer-management
peer-management
peer-management
peer-management
peer-management
peer-management
performance
performance
performance
postgres
postgres
postgres
posture-checks
posture-checks
posture-checks
psk
psk
psk
pull-request
Mirrored from GitHub Pull Request
 question
question
question
refactor
refactor
refactor
relay
relay
relay
release
release
release
rfc
rfc
rfc
routes
routes
routes
security
security
security
security-improvement
security-improvement
security-improvement
security-related
security-related
security-related
self-hosting
self-hosting
self-hosting
server
server
server
signal
signal
signal
sleep-issue
sleep-issue
sleep-issue
ssh
ssh
ssh
ssl
ssl
ssl
status
status
status
store
store
store
synology
synology
synology
system-compatibility-issue
system-compatibility-issue
system-compatibility-issue
test-suite
test-suite
test-suite
third-party-integration
third-party-integration
third-party-integration
triage
triage
triage
triage
triage
triage
triage-needed
triage-needed
triage-needed
troubleshooting
troubleshooting
troubleshooting
UX
UX
UX
waiting-feedback
waiting-feedback
waiting-feedback
windows
windows
windows
wontfix
wontfix
wontfix
zitadel
zitadel
zitadel
No Label triage-needed
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
dynr-servers saavagebueno
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: DYNR/netbird#11253
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?