[GH-ISSUE #5507] Failed to connect WebSocket when using reverse proxy #11330

Closed
opened 2026-08-05 01:29:20 -04:00 by saavagebueno · 0 comments
Owner

Originally created by @CKylinMC on GitHub (Mar 4, 2026).
Original GitHub issue: https://github.com/netbirdio/netbird/issues/5507

Describe the problem

When using reverse proxy, I can not connect any websocket. I have tried OpenClaw and MaiBot WebUI.

To Reproduce

Steps to reproduce the behavior:

  1. Create a reverse proxy for a webapp which have websocket connection.
  2. Login to the webapp and let it try connect with websocket
  3. See error

Expected behavior

WebSocket could be connected.

Are you using NetBird Cloud?

Please specify whether you use NetBird Cloud or self-host NetBird's control plane.

Self-host Netbird's control plane

NetBird version

Management
v0.66.1
Dashboard
v2.33.0

Is any other VPN software installed?

No.

Debug output

To help us resolve the problem, please attach the following anonymized status output

netbird status -dA

Peers detail:
 ckpc.anon-HsIoF.domain:
  NetBird IP: 100.123.7.141
  Public key: RDNl42fyDmdU9cEffbrNI1sDKnIDUkv5ou9snuj56EY=
  Status: Connecting
  -- detail --
  Connection type: -
  ICE candidate (Local/Remote): -/-
  ICE candidate endpoints (Local/Remote): -/-
  Relay server address: 
  Last connection update: 11 hours, 2 minutes ago
  Last WireGuard handshake: -
  Transfer status (received/sent) 0 B/0 B
  Quantum resistance: false
  Networks: -
  Latency: 126.633213ms

 mi17pm.anon-HsIoF.domain:
  NetBird IP: 100.123.57.198
  Public key: 9ovNi2nhM2HIQLLwVWvmbzi0mYKMnX346NU8ck7L0kM=
  Status: Connecting
  -- detail --
  Connection type: -
  ICE candidate (Local/Remote): -/-
  ICE candidate endpoints (Local/Remote): -/-
  Relay server address: 
  Last connection update: 12 hours, 50 minutes ago
  Last WireGuard handshake: -
  Transfer status (received/sent) 0 B/0 B
  Quantum resistance: false
  Networks: -
  Latency: 0s

 cknas.anon-HsIoF.domain:
  NetBird IP: 100.123.57.244
  Public key: 17eSh1ijzMQ4deg7RkeB0ZP5tk5kttEzUoWTzMubuTY=
  Status: Connecting
  -- detail --
  Connection type: -
  ICE candidate (Local/Remote): -/-
  ICE candidate endpoints (Local/Remote): -/-
  Relay server address: 
  Last connection update: 12 hours, 50 minutes ago
  Last WireGuard handshake: -
  Transfer status (received/sent) 0 B/0 B
  Quantum resistance: false
  Networks: -
  Latency: 0s

 airp-80-110.anon-HsIoF.domain:
  NetBird IP: 100.123.80.110
  Public key: ikWPm6jbemvEWl0qcE80rQmWB22/ZZJd0a9rKqxL6SQ=
  Status: Connecting
  -- detail --
  Connection type: -
  ICE candidate (Local/Remote): -/-
  ICE candidate endpoints (Local/Remote): -/-
  Relay server address: 
  Last connection update: 6 seconds ago
  Last WireGuard handshake: -
  Transfer status (received/sent) 0 B/0 B
  Quantum resistance: false
  Networks: -
  Latency: 0s

 maimai-87-102.anon-HsIoF.domain:
  NetBird IP: 100.123.87.102
  Public key: gp6RI14TB1Figf2YUWcuGj/GI8R0cG9Fn17LW88ANjM=
  Status: Connected
  -- detail --
  Connection type: Relayed
  ICE candidate (Local/Remote): -/-
  ICE candidate endpoints (Local/Remote): -/-
  Relay server address: rels://nb.anon-2Jlj0.domain:443
  Last connection update: 1 second ago
  Last WireGuard handshake: -
  Transfer status (received/sent) 0 B/0 B
  Quantum resistance: false
  Networks: -
  Latency: 0s

 proxy-d6c0rf8gn00c73fo1pig-244-228.anon-HsIoF.domain:
  NetBird IP: 100.123.244.228
  Public key: IodffFTtmGkAACZsI84pF01BNrG6njgkORxUlBIZCz8=
  Status: Connected
  -- detail --
  Connection type: P2P
  ICE candidate (Local/Remote): host/prflx
  ICE candidate endpoints (Local/Remote): 198.51.100.0:51820/198.51.100.1:33497
  Relay server address: rels://nb.anon-2Jlj0.domain:443
  Last connection update: 12 hours, 48 minutes ago
  Last WireGuard handshake: 1 minute, 37 seconds ago
  Transfer status (received/sent) 844.2 KiB/5.6 MiB
  Quantum resistance: false
  Networks: -
  Latency: 1.076417ms

Events:
  [INFO] SYSTEM (b5b7a9b6-11a5-4771-8cbe-e4822b74957a)
    Message: Network map updated
    Time: 12 hours, 50 minutes ago
  [INFO] SYSTEM (8262c9b4-3d7b-4d13-af28-8516fbcc513a)
    Message: Network map updated
    Time: 12 hours, 48 minutes ago
  [INFO] SYSTEM (cb36f705-6694-4006-8622-2046eda19ded)
    Message: Network map updated
    Time: 10 minutes, 10 seconds ago
OS: linux/amd64
Daemon version: 0.66.1
CLI version: 0.66.1
Profile: default
Management: Connected to https://nb.anon-2Jlj0.domain:443
Signal: Connected to https://nb.anon-2Jlj0.domain:443
Relays: 
  [stun:nb.anon-2Jlj0.domain:3478] is Available
  [rels://nb.anon-2Jlj0.domain:443] is Available
Nameservers: 
FQDN: hk12.anon-HsIoF.domain
NetBird IP: 100.123.165.236/16
Interface type: Kernel
Quantum resistance: false
Lazy connection: false
SSH Server: Disabled
Networks: -
Peers count: 2/6 Connected

Create and upload a debug bundle, and share the returned file key:

netbird debug for 1m -AS -U

Uploaded files are automatically deleted after 30 days.

649383a274f50a722725784c9b6b5ce097f57b7f09bb6367646865e2f32c12a7/346ed205-0194-4e50-a822-eecdd6c7d9b2

Alternatively, create the file only and attach it here manually:

netbird debug for 1m -AS

Screenshots

If applicable, add screenshots to help explain your problem.

Additional context

Add any other context about the problem here.

Got these logs in proxy container

Blurred IP and host

2026-03-05T03:59:36Z WARN [peer: gp6RI14TB1Figf2YUWcuGj/GI8R0cG9Fn17LW88ANjM=] client/internal/peer/wg_watcher.go:127: WireGuard handshake timed out: 0001-01-01 00:00:00 +0000 UTC
2026-03-05T03:59:36Z WARN [peer: gp6RI14TB1Figf2YUWcuGj/GI8R0cG9Fn17LW88ANjM=] client/internal/peer/conn.go:586: WireGuard handshake timeout detected, closing current connection
2026-03-05T03:59:36Z ERRO client/iface/wgproxy/bind/proxy.go:185: failed to read from remote conn: rels://**blurred**:443, use of closed network connection
2026-03-05T03:59:39Z WARN [peer: ikWPm6jbemvEWl0qcE80rQmWB22/ZZJd0a9rKqxL6SQ=] client/internal/peer/wg_watcher.go:127: WireGuard handshake timed out: 0001-01-01 00:00:00 +0000 UTC
2026-03-05T03:59:39Z WARN [peer: ikWPm6jbemvEWl0qcE80rQmWB22/ZZJd0a9rKqxL6SQ=] client/internal/peer/conn.go:586: WireGuard handshake timeout detected, closing current connection
2026-03-05T03:59:39Z ERRO client/iface/wgproxy/bind/proxy.go:185: failed to read from remote conn: rels://**blurred**:443, use of closed network connection
2026-03-05T03:59:44Z WARN proxy/internal/proxy/reverseproxy.go:297: proxy error: request_id=d6kfvc56ugqc73c6bs7g client_ip=**blurred** method=GET host=**blurred** path=/ status=502 title="Connection Error" err=can't switch protocols using non-Hijacker ResponseWriter type *accesslog.statusWriter

Have you tried these troubleshooting steps?

  • Reviewed client troubleshooting (if applicable)
  • Checked for newer NetBird versions
  • Searched for similar issues on GitHub (including closed ones)
  • Restarted the NetBird client
  • Disabled other VPN software
  • Checked firewall settings
Originally created by @CKylinMC on GitHub (Mar 4, 2026). Original GitHub issue: https://github.com/netbirdio/netbird/issues/5507 **Describe the problem** When using reverse proxy, I can not connect any websocket. I have tried OpenClaw and MaiBot WebUI. **To Reproduce** Steps to reproduce the behavior: 1. Create a reverse proxy for a webapp which have websocket connection. 2. Login to the webapp and let it try connect with websocket 3. See error **Expected behavior** WebSocket could be connected. **Are you using NetBird Cloud?** Please specify whether you use NetBird Cloud or self-host NetBird's control plane. Self-host Netbird's control plane **NetBird version** Management `v0.66.1` Dashboard `v2.33.0` **Is any other VPN software installed?** No. **Debug output** To help us resolve the problem, please attach the following anonymized status output netbird status -dA <details> ``` Peers detail: ckpc.anon-HsIoF.domain: NetBird IP: 100.123.7.141 Public key: RDNl42fyDmdU9cEffbrNI1sDKnIDUkv5ou9snuj56EY= Status: Connecting -- detail -- Connection type: - ICE candidate (Local/Remote): -/- ICE candidate endpoints (Local/Remote): -/- Relay server address: Last connection update: 11 hours, 2 minutes ago Last WireGuard handshake: - Transfer status (received/sent) 0 B/0 B Quantum resistance: false Networks: - Latency: 126.633213ms mi17pm.anon-HsIoF.domain: NetBird IP: 100.123.57.198 Public key: 9ovNi2nhM2HIQLLwVWvmbzi0mYKMnX346NU8ck7L0kM= Status: Connecting -- detail -- Connection type: - ICE candidate (Local/Remote): -/- ICE candidate endpoints (Local/Remote): -/- Relay server address: Last connection update: 12 hours, 50 minutes ago Last WireGuard handshake: - Transfer status (received/sent) 0 B/0 B Quantum resistance: false Networks: - Latency: 0s cknas.anon-HsIoF.domain: NetBird IP: 100.123.57.244 Public key: 17eSh1ijzMQ4deg7RkeB0ZP5tk5kttEzUoWTzMubuTY= Status: Connecting -- detail -- Connection type: - ICE candidate (Local/Remote): -/- ICE candidate endpoints (Local/Remote): -/- Relay server address: Last connection update: 12 hours, 50 minutes ago Last WireGuard handshake: - Transfer status (received/sent) 0 B/0 B Quantum resistance: false Networks: - Latency: 0s airp-80-110.anon-HsIoF.domain: NetBird IP: 100.123.80.110 Public key: ikWPm6jbemvEWl0qcE80rQmWB22/ZZJd0a9rKqxL6SQ= Status: Connecting -- detail -- Connection type: - ICE candidate (Local/Remote): -/- ICE candidate endpoints (Local/Remote): -/- Relay server address: Last connection update: 6 seconds ago Last WireGuard handshake: - Transfer status (received/sent) 0 B/0 B Quantum resistance: false Networks: - Latency: 0s maimai-87-102.anon-HsIoF.domain: NetBird IP: 100.123.87.102 Public key: gp6RI14TB1Figf2YUWcuGj/GI8R0cG9Fn17LW88ANjM= Status: Connected -- detail -- Connection type: Relayed ICE candidate (Local/Remote): -/- ICE candidate endpoints (Local/Remote): -/- Relay server address: rels://nb.anon-2Jlj0.domain:443 Last connection update: 1 second ago Last WireGuard handshake: - Transfer status (received/sent) 0 B/0 B Quantum resistance: false Networks: - Latency: 0s proxy-d6c0rf8gn00c73fo1pig-244-228.anon-HsIoF.domain: NetBird IP: 100.123.244.228 Public key: IodffFTtmGkAACZsI84pF01BNrG6njgkORxUlBIZCz8= Status: Connected -- detail -- Connection type: P2P ICE candidate (Local/Remote): host/prflx ICE candidate endpoints (Local/Remote): 198.51.100.0:51820/198.51.100.1:33497 Relay server address: rels://nb.anon-2Jlj0.domain:443 Last connection update: 12 hours, 48 minutes ago Last WireGuard handshake: 1 minute, 37 seconds ago Transfer status (received/sent) 844.2 KiB/5.6 MiB Quantum resistance: false Networks: - Latency: 1.076417ms Events: [INFO] SYSTEM (b5b7a9b6-11a5-4771-8cbe-e4822b74957a) Message: Network map updated Time: 12 hours, 50 minutes ago [INFO] SYSTEM (8262c9b4-3d7b-4d13-af28-8516fbcc513a) Message: Network map updated Time: 12 hours, 48 minutes ago [INFO] SYSTEM (cb36f705-6694-4006-8622-2046eda19ded) Message: Network map updated Time: 10 minutes, 10 seconds ago OS: linux/amd64 Daemon version: 0.66.1 CLI version: 0.66.1 Profile: default Management: Connected to https://nb.anon-2Jlj0.domain:443 Signal: Connected to https://nb.anon-2Jlj0.domain:443 Relays: [stun:nb.anon-2Jlj0.domain:3478] is Available [rels://nb.anon-2Jlj0.domain:443] is Available Nameservers: FQDN: hk12.anon-HsIoF.domain NetBird IP: 100.123.165.236/16 Interface type: Kernel Quantum resistance: false Lazy connection: false SSH Server: Disabled Networks: - Peers count: 2/6 Connected ``` </details> Create and upload a debug bundle, and share the returned file key: netbird debug for 1m -AS -U *Uploaded files are automatically deleted after 30 days.* `649383a274f50a722725784c9b6b5ce097f57b7f09bb6367646865e2f32c12a7/346ed205-0194-4e50-a822-eecdd6c7d9b2` Alternatively, create the file only and attach it here manually: netbird debug for 1m -AS **Screenshots** If applicable, add screenshots to help explain your problem. **Additional context** Add any other context about the problem here. <details> <summary>Got these logs in proxy container</summary> *Blurred IP and host* ``` 2026-03-05T03:59:36Z WARN [peer: gp6RI14TB1Figf2YUWcuGj/GI8R0cG9Fn17LW88ANjM=] client/internal/peer/wg_watcher.go:127: WireGuard handshake timed out: 0001-01-01 00:00:00 +0000 UTC 2026-03-05T03:59:36Z WARN [peer: gp6RI14TB1Figf2YUWcuGj/GI8R0cG9Fn17LW88ANjM=] client/internal/peer/conn.go:586: WireGuard handshake timeout detected, closing current connection 2026-03-05T03:59:36Z ERRO client/iface/wgproxy/bind/proxy.go:185: failed to read from remote conn: rels://**blurred**:443, use of closed network connection 2026-03-05T03:59:39Z WARN [peer: ikWPm6jbemvEWl0qcE80rQmWB22/ZZJd0a9rKqxL6SQ=] client/internal/peer/wg_watcher.go:127: WireGuard handshake timed out: 0001-01-01 00:00:00 +0000 UTC 2026-03-05T03:59:39Z WARN [peer: ikWPm6jbemvEWl0qcE80rQmWB22/ZZJd0a9rKqxL6SQ=] client/internal/peer/conn.go:586: WireGuard handshake timeout detected, closing current connection 2026-03-05T03:59:39Z ERRO client/iface/wgproxy/bind/proxy.go:185: failed to read from remote conn: rels://**blurred**:443, use of closed network connection 2026-03-05T03:59:44Z WARN proxy/internal/proxy/reverseproxy.go:297: proxy error: request_id=d6kfvc56ugqc73c6bs7g client_ip=**blurred** method=GET host=**blurred** path=/ status=502 title="Connection Error" err=can't switch protocols using non-Hijacker ResponseWriter type *accesslog.statusWriter ``` </details> **Have you tried these troubleshooting steps?** - [x] Reviewed [client troubleshooting](https://docs.netbird.io/how-to/troubleshooting-client) (if applicable) - [ ] Checked for newer NetBird versions - [x] Searched for similar issues on GitHub (including closed ones) - [x] Restarted the NetBird client - [ ] Disabled other VPN software - [x] Checked firewall settings
saavagebueno added the triage-needed label 2026-08-05 01:29:20 -04:00
Sign in to join this conversation.
No Label triage-needed
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: DYNR/netbird#11330