DYNR/netbird
2
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-08-05 00:15:26 -04:00
Code Issues 23.5k Packages Projects Releases 10 Wiki Activity

[GH-ISSUE #5517] Stuck on issuing certificate #11339

New Issue
Open
opened 2026-08-05 01:29:22 -04:00 by saavagebueno · 31 comments
saavagebueno commented 2026-08-05 01:29:22 -04:00
Owner
Copy Link

Originally created by @LordJuice1 on GitHub (Mar 5, 2026).
Original GitHub issue: https://github.com/netbirdio/netbird/issues/5517

Describe the problem

After finally getting the reverse proxy container working ( #5473) I tried setting up a proxy to one of my services. It seems to be stuck on "issuing certificate". I'm trying to use a custom domain, and not the proxy.site.tld method since my services have been subdomain.domain.tld for years. However, using proxy.site.tld yields the same results. My service also hasn't been reachable

Image

To Reproduce

Steps to reproduce the behavior:

  1. start proxy cluster
  2. make reverse proxy
  3. wait
  4. See error

Expected behavior

For the service to get its cert and be reachable

Are you using NetBird Cloud?

Self hosted.

NetBird version

0.66.1

Is any other VPN software installed?

no

Debug output

To help us resolve the problem, please attach the following anonymized status output

netbird status -dA

Create and upload a debug bundle, and share the returned file key:

netbird debug for 1m -AS -U

Uploaded files are automatically deleted after 30 days.

Alternatively, create the file only and attach it here manually:

netbird debug for 1m -AS

bd56fee3758d5613e99c1ecdd690445a91f3193a6846ebbe0b701dd3abdee061/4249c396-139d-4837-8199-a3354b11ca07

Additional context

Here is part of the error log

netbird-proxy  | 2026-03-05T22:03:08.336Z INFO [account_id: d6f5xxxxxx, domain: subsite.site.tld] proxy/internal/roundtrip/netbird.go:175: created new client for account
netbird-proxy  | 2026-03-05T22:03:08.336Z DEBG proxy/server.go:607: Processing mapping update completed
netbird-proxy  | 2026-03-05T22:03:08.336Z INFO proxy/internal/acme/manager.go:120: acquiring cert lock for domain "subsite.site.tld"
netbird-proxy  | 2026-03-05T22:03:08.504Z WARN client/internal/profilemanager/service.go:360: failed to get active profile state: failed to set default active profile state: failed to set active profile to default: failed to write active profile state: create temp: open /var/lib/netbird/.2594936026active_profile.json: permission denied
netbird-proxy  | 2026-03-05T22:03:08.781Z WARN client/firewall/create_linux.go:49: failed to create native firewall: create firewall: no firewall manager found. Proceeding with userspace
netbird-proxy  | 2026-03-05T22:03:08.812Z INFO [domain: subsite.site.tld, account_id: d6f5i6ru624c73e7sti0] proxy/internal/roundtrip/netbird.go:317: notified management about tunnel connection

Have you tried these troubleshooting steps?

  • Reviewed client troubleshooting (if applicable)
  • Checked for newer NetBird versions
  • Searched for similar issues on GitHub (including closed ones)
  • Restarted the NetBird client
  • Disabled other VPN software
  • Checked firewall settings
Originally created by @LordJuice1 on GitHub (Mar 5, 2026). Original GitHub issue: https://github.com/netbirdio/netbird/issues/5517 **Describe the problem** After finally getting the reverse proxy container working ( #5473) I tried setting up a proxy to one of my services. It seems to be stuck on "issuing certificate". I'm trying to use a custom domain, and not the proxy.site.tld method since my services have been subdomain.domain.tld for years. However, using proxy.site.tld yields the same results. My service also hasn't been reachable <img width="1529" height="106" alt="Image" src="https://github.com/user-attachments/assets/0e88b5d1-e17b-4d36-b2d7-f4b75392f871" /> **To Reproduce** Steps to reproduce the behavior: 1. start proxy cluster 2. make reverse proxy 3. wait 4. See error **Expected behavior** For the service to get its cert and be reachable **Are you using NetBird Cloud?** Self hosted. **NetBird version** `0.66.1` **Is any other VPN software installed?** no **Debug output** To help us resolve the problem, please attach the following anonymized status output netbird status -dA Create and upload a debug bundle, and share the returned file key: netbird debug for 1m -AS -U *Uploaded files are automatically deleted after 30 days.* Alternatively, create the file only and attach it here manually: netbird debug for 1m -AS `bd56fee3758d5613e99c1ecdd690445a91f3193a6846ebbe0b701dd3abdee061/4249c396-139d-4837-8199-a3354b11ca07` **Additional context** Here is part of the error log ``` netbird-proxy | 2026-03-05T22:03:08.336Z INFO [account_id: d6f5xxxxxx, domain: subsite.site.tld] proxy/internal/roundtrip/netbird.go:175: created new client for account netbird-proxy | 2026-03-05T22:03:08.336Z DEBG proxy/server.go:607: Processing mapping update completed netbird-proxy | 2026-03-05T22:03:08.336Z INFO proxy/internal/acme/manager.go:120: acquiring cert lock for domain "subsite.site.tld" netbird-proxy | 2026-03-05T22:03:08.504Z WARN client/internal/profilemanager/service.go:360: failed to get active profile state: failed to set default active profile state: failed to set active profile to default: failed to write active profile state: create temp: open /var/lib/netbird/.2594936026active_profile.json: permission denied netbird-proxy | 2026-03-05T22:03:08.781Z WARN client/firewall/create_linux.go:49: failed to create native firewall: create firewall: no firewall manager found. Proceeding with userspace netbird-proxy | 2026-03-05T22:03:08.812Z INFO [domain: subsite.site.tld, account_id: d6f5i6ru624c73e7sti0] proxy/internal/roundtrip/netbird.go:317: notified management about tunnel connection ``` **Have you tried these troubleshooting steps?** - [ ] Reviewed [client troubleshooting](https://docs.netbird.io/how-to/troubleshooting-client) (if applicable) - [ ] Checked for newer NetBird versions - [ ] Searched for similar issues on GitHub (including closed ones) - [ ] Restarted the NetBird client - [ ] Disabled other VPN software - [ ] Checked firewall settings
saavagebueno added the triage-needed label 2026-08-05 01:29:22 -04:00
saavagebueno commented 2026-08-05 01:29:22 -04:00
Author
Owner
Copy Link

@nivaddo commented on GitHub (Mar 7, 2026):

I also get this the the certificate is actually issued, seems to be cosmetic?

<!-- gh-comment-id:4017483462 --> @nivaddo commented on GitHub (Mar 7, 2026): I also get this the the certificate is actually issued, seems to be cosmetic?
saavagebueno commented 2026-08-05 01:29:22 -04:00
Author
Owner
Copy Link

@LordJuice1 commented on GitHub (Mar 7, 2026):

Mine doesn't seem to be cosmetic unless I'm setting it up incorrectly since I can't even browse to the site

<!-- gh-comment-id:4017660693 --> @LordJuice1 commented on GitHub (Mar 7, 2026): Mine doesn't seem to be cosmetic unless I'm setting it up incorrectly since I can't even browse to the site
saavagebueno commented 2026-08-05 01:29:22 -04:00
Author
Owner
Copy Link

@Sergey842248 commented on GitHub (Mar 8, 2026):

Same problem here, for me it's just cosmetic

<!-- gh-comment-id:4018720125 --> @Sergey842248 commented on GitHub (Mar 8, 2026): Same problem here, for me it's just cosmetic
saavagebueno commented 2026-08-05 01:29:22 -04:00
Author
Owner
Copy Link

@donnieD999 commented on GitHub (Mar 9, 2026):

I have the same issue as @LordJuice1 , it is not cosmetic, gets stuck on "issuing certificate", and certificate is not issued or written to "/certs" for netbird-proxy.

I am using *.expo.<mydomain.com>, it is resolvable externally

Image

Here is my log from netbrd-proxy from the restart with DEBUG enabled:

[netbird-proxy] 2026-03-09T08:55:11.296917176Z 2026-03-09T08:55:11.293Z INFO proxy/cmd/proxy/cmd/root.go:126: configured log level: debug
[netbird-proxy] 2026-03-09T08:55:11.296992970Z 2026-03-09T08:55:11.294Z DEBG [TLS_enabled: false, gRPC_address: netbird-server:80] proxy/server.go:387: starting management gRPC client
[netbird-proxy] 2026-03-09T08:55:11.297004001Z 2026-03-09T08:55:11.294Z DEBG [expect_continue_timeout: 1s, read_buffer_size: 0, response_header_timeout: 0s, max_idle_conns_per_host: 100, max_inflight: 0, max_idle_conns: 100, disable_compression: false, idle_conn_timeout: 1m30s, tls_handshake_timeout: 10s, write_buffer_size: 0, max_conns_per_host: 0] proxy/internal/roundtrip/transport.go:102: backend transport configuration
[netbird-proxy] 2026-03-09T08:55:11.297013638Z 2026-03-09T08:55:11.294Z DEBG [challenge_type: tls-alpn-01, acme_server: https://acme-v02.api.letsencrypt.org/directory] proxy/server.go:425: ACME certificates enabled, configuring certificate manager
[netbird-proxy] 2026-03-09T08:55:11.297020588Z 2026-03-09T08:55:11.294Z INFO proxy/internal/acme/locker.go:47: auto-detected cert lock method: flock
[netbird-proxy] 2026-03-09T08:55:11.297026639Z 2026-03-09T08:55:11.294Z INFO proxy/internal/acme/locker.go:60: using flock cert locker in /certs
[netbird-proxy] 2026-03-09T08:55:11.297032894Z 2026-03-09T08:55:11.295Z DEBG [challenge_type: tls-alpn-01, ServerName: expo.anonymised.domain] proxy/server.go:449: ACME certificate manager configured
[netbird-proxy] 2026-03-09T08:55:11.297039203Z 2026-03-09T08:55:11.296Z INFO proxy/server.go:318: PROXY protocol enabled on listener
[netbird-proxy] 2026-03-09T08:55:11.297045211Z 2026-03-09T08:55:11.296Z DEBG proxy/server.go:227: starting reverse proxy server on :8443
[netbird-proxy] 2026-03-09T08:55:11.297051228Z 2026-03-09T08:55:11.296Z INFO proxy/internal/health/health.go:293: starting health probe server on 127.0.0.1:8080
[netbird-proxy] 2026-03-09T08:55:11.301292952Z 2026-03-09T08:55:11.296Z DEBG proxy/server.go:546: connecting to management mapping stream
[netbird-proxy] 2026-03-09T08:55:11.376464905Z 2026-03-09T08:55:11.376Z INFO ./caller_not_available:0: 2026/03/09 08:55:11 WARNING: [core] [Channel #1 SubChannel #2] grpc: addrConn.createTransport failed to connect to {Addr: "172.30.0.3:80", ServerName: "netbird-server:80", }. Err: connection error: desc = "transport: Error while dialing: dial tcp 172.30.0.3:80: connect: connection refused"
[netbird-proxy] 2026-03-09T08:55:11.376692337Z 2026-03-09T08:55:11.376Z WARN proxy/server.go:584: management connection failed, retrying in 755ms: create mapping stream: rpc error: code = Unavailable desc = connection error: desc = "transport: Error while dialing: dial tcp 172.30.0.3:80: connect: connection refused"
[netbird-proxy] 2026-03-09T08:55:12.132439979Z 2026-03-09T08:55:12.132Z DEBG proxy/server.go:546: connecting to management mapping stream
[netbird-proxy] 2026-03-09T08:55:12.132632603Z 2026-03-09T08:55:12.132Z WARN proxy/server.go:584: management connection failed, retrying in 1.028s: create mapping stream: rpc error: code = Unavailable desc = connection error: desc = "transport: Error while dialing: dial tcp 172.30.0.3:80: connect: connection refused"
[netbird-proxy] 2026-03-09T08:55:13.165359060Z 2026-03-09T08:55:13.162Z DEBG proxy/server.go:546: connecting to management mapping stream
[netbird-proxy] 2026-03-09T08:55:13.165419441Z 2026-03-09T08:55:13.162Z DEBG proxy/server.go:565: management mapping stream established
[netbird-proxy] 2026-03-09T08:55:13.186038074Z 2026-03-09T08:55:13.185Z DEBG proxy/server.go:609: Received mapping update, starting processing
[netbird-proxy] 2026-03-09T08:55:13.186092597Z 2026-03-09T08:55:13.185Z DEBG proxy/server.go:611: Processing mapping update completed
[netbird-proxy] 2026-03-09T08:55:13.186328723Z 2026-03-09T08:55:13.185Z INFO proxy/server.go:618: Initial mapping sync complete
[netbird-proxy] 2026-03-09T08:57:27.898880605Z 2026-03-09T08:57:27.898Z DEBG proxy/server.go:609: Received mapping update, starting processing
[netbird-proxy] 2026-03-09T08:57:27.898933369Z 2026-03-09T08:57:27.898Z DEBG [type: UPDATE_TYPE_CREATED, domain: vaultwarden.expo.anonymised.domain, path: [path:"/"  target:"https://10.20.40.200/"], id: d6n8mtpk0sfc73dl3r0g] proxy/server.go:631: Processing mapping update
[netbird-proxy] 2026-03-09T08:57:27.899090659Z 2026-03-09T08:57:27.898Z DEBG [service_id: d6n8mtpk0sfc73dl3r0g, account_id: d6ccp71k0sfc7390l750] proxy/internal/roundtrip/netbird.go:190: generating WireGuard keypair for new peer
[netbird-proxy] 2026-03-09T08:57:27.899367734Z 2026-03-09T08:57:27.899Z DEBG [public_key: daSIYCnNG3gmw6vQ91bPE7mDQhyc8j3XC+Ydhxy/4kk=, account_id: d6ccp71k0sfc7390l750, service_id: d6n8mtpk0sfc73dl3r0g] proxy/internal/roundtrip/netbird.go:202: authenticating new proxy peer with management
[netbird-proxy] 2026-03-09T08:57:28.005760981Z 2026-03-09T08:57:28.005Z INFO [account_id: d6ccp71k0sfc7390l750, service_id: d6n8mtpk0sfc73dl3r0g, public_key: daSIYCnNG3gmw6vQ91bPE7mDQhyc8j3XC+Ydhxy/4kk=] proxy/internal/roundtrip/netbird.go:226: proxy peer authenticated successfully with management
[netbird-proxy] 2026-03-09T08:57:28.011628431Z 2026-03-09T08:57:28.011Z INFO [domain: vaultwarden.expo.anonymised.domain, account_id: d6ccp71k0sfc7390l750] proxy/internal/roundtrip/netbird.go:175: created new client for account
[netbird-proxy] 2026-03-09T08:57:28.011765886Z 2026-03-09T08:57:28.011Z DEBG proxy/server.go:611: Processing mapping update completed
[netbird-proxy] 2026-03-09T08:57:28.011818199Z 2026-03-09T08:57:28.011Z INFO proxy/internal/acme/manager.go:140: acquiring cert lock for domain "vaultwarden.expo.anonymised.domain"
[netbird-proxy] 2026-03-09T08:57:28.011837764Z 2026-03-09T08:57:28.011Z WARN proxy/internal/acme/manager.go:144: acquire cert lock for domain "vaultwarden.expo.anonymised.domain", proceeding without lock: open lock file /certs/vaultwarden.expo.anonymised.domain.lock: open /certs/vaultwarden.expo.anonymised.domain.lock: permission denied
[netbird-proxy] 2026-03-09T08:57:28.451481439Z 2026-03-09T08:57:28.451Z WARN client/internal/profilemanager/service.go:368: failed to get active profile state: failed to set default active profile state: failed to set active profile to default: failed to write active profile state: create temp: open /var/lib/netbird/.2454754093active_profile.json: permission denied
[netbird-proxy] 2026-03-09T08:57:28.555156764Z 2026-03-09T08:57:28.554Z WARN proxy/internal/acme/manager.go:159: prefetch certificate for domain "vaultwarden.expo.anonymised.domain" in 543.099535ms: open /certs/acme_account+key2826026017: permission denied
[netbird-proxy] 2026-03-09T08:57:28.635285192Z 2026/03/09 08:57:28 failed to sufficiently increase receive buffer size (was: 208 kiB, wanted: 7168 kiB, got: 416 kiB). See https://github.com/quic-go/quic-go/wiki/UDP-Buffer-Sizes for details.
[netbird-proxy] 2026-03-09T08:57:28.691372333Z 2026-03-09T08:57:28.691Z WARN client/firewall/create_linux.go:49: failed to create native firewall: create firewall: no firewall manager found. Proceeding with userspace
[netbird-proxy] 2026-03-09T08:57:28.717533416Z 2026-03-09T08:57:28.716Z INFO [account_id: d6ccp71k0sfc7390l750, domain: vaultwarden.expo.anonymised.domain] proxy/internal/roundtrip/netbird.go:317: notified management about tunnel connection
[netbird-proxy] 2026-03-09T08:58:18.046951018Z 2026-03-09T08:58:18.046Z WARN [http-server: https] ./caller_not_available:0: http: TLS handshake error from 119.28.89.249:60204: unknown domain "anonymised.domain"
[netbird-proxy] 2026-03-09T08:55:11.296917176Z 2026-03-09T08:55:11.293Z INFO proxy/cmd/proxy/cmd/root.go:126: configured log level: debug
[netbird-proxy] 2026-03-09T08:55:11.296992970Z 2026-03-09T08:55:11.294Z DEBG [TLS_enabled: false, gRPC_address: netbird-server:80] proxy/server.go:387: starting management gRPC client
[netbird-proxy] 2026-03-09T08:55:11.297004001Z 2026-03-09T08:55:11.294Z DEBG [expect_continue_timeout: 1s, read_buffer_size: 0, response_header_timeout: 0s, max_idle_conns_per_host: 100, max_inflight: 0, max_idle_conns: 100, disable_compression: false, idle_conn_timeout: 1m30s, tls_handshake_timeout: 10s, write_buffer_size: 0, max_conns_per_host: 0] proxy/internal/roundtrip/transport.go:102: backend transport configuration
[netbird-proxy] 2026-03-09T08:55:11.297013638Z 2026-03-09T08:55:11.294Z DEBG [challenge_type: tls-alpn-01, acme_server: https://acme-v02.api.letsencrypt.org/directory] proxy/server.go:425: ACME certificates enabled, configuring certificate manager
[netbird-proxy] 2026-03-09T08:55:11.297020588Z 2026-03-09T08:55:11.294Z INFO proxy/internal/acme/locker.go:47: auto-detected cert lock method: flock
[netbird-proxy] 2026-03-09T08:55:11.297026639Z 2026-03-09T08:55:11.294Z INFO proxy/internal/acme/locker.go:60: using flock cert locker in /certs
[netbird-proxy] 2026-03-09T08:55:11.297032894Z 2026-03-09T08:55:11.295Z DEBG [challenge_type: tls-alpn-01, ServerName: expo.anonymised.domain] proxy/server.go:449: ACME certificate manager configured
[netbird-proxy] 2026-03-09T08:55:11.297039203Z 2026-03-09T08:55:11.296Z INFO proxy/server.go:318: PROXY protocol enabled on listener
[netbird-proxy] 2026-03-09T08:55:11.297045211Z 2026-03-09T08:55:11.296Z DEBG proxy/server.go:227: starting reverse proxy server on :8443
[netbird-proxy] 2026-03-09T08:55:11.297051228Z 2026-03-09T08:55:11.296Z INFO proxy/internal/health/health.go:293: starting health probe server on 127.0.0.1:8080
[netbird-proxy] 2026-03-09T08:55:11.301292952Z 2026-03-09T08:55:11.296Z DEBG proxy/server.go:546: connecting to management mapping stream
[netbird-proxy] 2026-03-09T08:55:11.376464905Z 2026-03-09T08:55:11.376Z INFO ./caller_not_available:0: 2026/03/09 08:55:11 WARNING: [core] [Channel #1 SubChannel #2] grpc: addrConn.createTransport failed to connect to {Addr: "172.30.0.3:80", ServerName: "netbird-server:80", }. Err: connection error: desc = "transport: Error while dialing: dial tcp 172.30.0.3:80: connect: connection refused"
[netbird-proxy] 2026-03-09T08:55:11.376692337Z 2026-03-09T08:55:11.376Z WARN proxy/server.go:584: management connection failed, retrying in 755ms: create mapping stream: rpc error: code = Unavailable desc = connection error: desc = "transport: Error while dialing: dial tcp 172.30.0.3:80: connect: connection refused"
[netbird-proxy] 2026-03-09T08:55:12.132439979Z 2026-03-09T08:55:12.132Z DEBG proxy/server.go:546: connecting to management mapping stream
[netbird-proxy] 2026-03-09T08:55:12.132632603Z 2026-03-09T08:55:12.132Z WARN proxy/server.go:584: management connection failed, retrying in 1.028s: create mapping stream: rpc error: code = Unavailable desc = connection error: desc = "transport: Error while dialing: dial tcp 172.30.0.3:80: connect: connection refused"
[netbird-proxy] 2026-03-09T08:55:13.165359060Z 2026-03-09T08:55:13.162Z DEBG proxy/server.go:546: connecting to management mapping stream
[netbird-proxy] 2026-03-09T08:55:13.165419441Z 2026-03-09T08:55:13.162Z DEBG proxy/server.go:565: management mapping stream established
[netbird-proxy] 2026-03-09T08:55:13.186038074Z 2026-03-09T08:55:13.185Z DEBG proxy/server.go:609: Received mapping update, starting processing
[netbird-proxy] 2026-03-09T08:55:13.186092597Z 2026-03-09T08:55:13.185Z DEBG proxy/server.go:611: Processing mapping update completed
[netbird-proxy] 2026-03-09T08:55:13.186328723Z 2026-03-09T08:55:13.185Z INFO proxy/server.go:618: Initial mapping sync complete
[netbird-proxy] 2026-03-09T08:57:27.898880605Z 2026-03-09T08:57:27.898Z DEBG proxy/server.go:609: Received mapping update, starting processing
[netbird-proxy] 2026-03-09T08:57:27.898933369Z 2026-03-09T08:57:27.898Z DEBG [type: UPDATE_TYPE_CREATED, domain: vaultwarden.expo.anonymised.domain, path: [path:"/"  target:"https://10.20.40.200/"], id: d6n8mtpk0sfc73dl3r0g] proxy/server.go:631: Processing mapping update
[netbird-proxy] 2026-03-09T08:57:27.899090659Z 2026-03-09T08:57:27.898Z DEBG [service_id: d6n8mtpk0sfc73dl3r0g, account_id: d6ccp71k0sfc7390l750] proxy/internal/roundtrip/netbird.go:190: generating WireGuard keypair for new peer
[netbird-proxy] 2026-03-09T08:57:27.899367734Z 2026-03-09T08:57:27.899Z DEBG [public_key: daSIYCnNG3gmw6vQ91bPE7mDQhyc8j3XC+Ydhxy/4kk=, account_id: d6ccp71k0sfc7390l750, service_id: d6n8mtpk0sfc73dl3r0g] proxy/internal/roundtrip/netbird.go:202: authenticating new proxy peer with management
[netbird-proxy] 2026-03-09T08:57:28.005760981Z 2026-03-09T08:57:28.005Z INFO [account_id: d6ccp71k0sfc7390l750, service_id: d6n8mtpk0sfc73dl3r0g, public_key: daSIYCnNG3gmw6vQ91bPE7mDQhyc8j3XC+Ydhxy/4kk=] proxy/internal/roundtrip/netbird.go:226: proxy peer authenticated successfully with management
[netbird-proxy] 2026-03-09T08:57:28.011628431Z 2026-03-09T08:57:28.011Z INFO [domain: vaultwarden.expo.anonymised.domain, account_id: d6ccp71k0sfc7390l750] proxy/internal/roundtrip/netbird.go:175: created new client for account
[netbird-proxy] 2026-03-09T08:57:28.011765886Z 2026-03-09T08:57:28.011Z DEBG proxy/server.go:611: Processing mapping update completed
[netbird-proxy] 2026-03-09T08:57:28.011818199Z 2026-03-09T08:57:28.011Z INFO proxy/internal/acme/manager.go:140: acquiring cert lock for domain "vaultwarden.expo.anonymised.domain"
[netbird-proxy] 2026-03-09T08:57:28.011837764Z 2026-03-09T08:57:28.011Z WARN proxy/internal/acme/manager.go:144: acquire cert lock for domain "vaultwarden.expo.anonymised.domain", proceeding without lock: open lock file /certs/vaultwarden.expo.anonymised.domain.lock: open /certs/vaultwarden.expo.anonymised.domain.lock: permission denied
[netbird-proxy] 2026-03-09T08:57:28.451481439Z 2026-03-09T08:57:28.451Z WARN client/internal/profilemanager/service.go:368: failed to get active profile state: failed to set default active profile state: failed to set active profile to default: failed to write active profile state: create temp: open /var/lib/netbird/.2454754093active_profile.json: permission denied
[netbird-proxy] 2026-03-09T08:57:28.555156764Z 2026-03-09T08:57:28.554Z WARN proxy/internal/acme/manager.go:159: prefetch certificate for domain "vaultwarden.expo.anonymised.domain" in 543.099535ms: open /certs/acme_account+key2826026017: permission denied
[netbird-proxy] 2026-03-09T08:57:28.635285192Z 2026/03/09 08:57:28 failed to sufficiently increase receive buffer size (was: 208 kiB, wanted: 7168 kiB, got: 416 kiB). See https://github.com/quic-go/quic-go/wiki/UDP-Buffer-Sizes for details.
[netbird-proxy] 2026-03-09T08:57:28.691372333Z 2026-03-09T08:57:28.691Z WARN client/firewall/create_linux.go:49: failed to create native firewall: create firewall: no firewall manager found. Proceeding with userspace
[netbird-proxy] 2026-03-09T08:57:28.717533416Z 2026-03-09T08:57:28.716Z INFO [account_id: d6ccp71k0sfc7390l750, domain: vaultwarden.expo.anonymised.domain] proxy/internal/roundtrip/netbird.go:317: notified management about tunnel connection
[netbird-proxy] 2026-03-09T08:58:18.046951018Z 2026-03-09T08:58:18.046Z WARN [http-server: https] ./caller_not_available:0: http: TLS handshake error from 119.28.89.249:60204: unknown domain "anonymised.domain"
[netbird-proxy] 2026-03-09T09:04:52.801568090Z 2026-03-09T09:04:52.800Z WARN [peer: sWITQCdchuGDD9+2kgIshxxs+laJJ6lpC8R4fAHJ41o=] client/internal/peer/worker_ice.go:160: ICE Agent is not initialized yet
[netbird-proxy] 2026-03-09T08:55:11.296917176Z 2026-03-09T08:55:11.293Z INFO proxy/cmd/proxy/cmd/root.go:126: configured log level: debug
[netbird-proxy] 2026-03-09T08:55:11.296992970Z 2026-03-09T08:55:11.294Z DEBG [TLS_enabled: false, gRPC_address: netbird-server:80] proxy/server.go:387: starting management gRPC client
[netbird-proxy] 2026-03-09T08:55:11.297004001Z 2026-03-09T08:55:11.294Z DEBG [expect_continue_timeout: 1s, read_buffer_size: 0, response_header_timeout: 0s, max_idle_conns_per_host: 100, max_inflight: 0, max_idle_conns: 100, disable_compression: false, idle_conn_timeout: 1m30s, tls_handshake_timeout: 10s, write_buffer_size: 0, max_conns_per_host: 0] proxy/internal/roundtrip/transport.go:102: backend transport configuration
[netbird-proxy] 2026-03-09T08:55:11.297013638Z 2026-03-09T08:55:11.294Z DEBG [challenge_type: tls-alpn-01, acme_server: https://acme-v02.api.letsencrypt.org/directory] proxy/server.go:425: ACME certificates enabled, configuring certificate manager
[netbird-proxy] 2026-03-09T08:55:11.297020588Z 2026-03-09T08:55:11.294Z INFO proxy/internal/acme/locker.go:47: auto-detected cert lock method: flock
[netbird-proxy] 2026-03-09T08:55:11.297026639Z 2026-03-09T08:55:11.294Z INFO proxy/internal/acme/locker.go:60: using flock cert locker in /certs
[netbird-proxy] 2026-03-09T08:55:11.297032894Z 2026-03-09T08:55:11.295Z DEBG [challenge_type: tls-alpn-01, ServerName: expo.anonymised.domain] proxy/server.go:449: ACME certificate manager configured
[netbird-proxy] 2026-03-09T08:55:11.297039203Z 2026-03-09T08:55:11.296Z INFO proxy/server.go:318: PROXY protocol enabled on listener
[netbird-proxy] 2026-03-09T08:55:11.297045211Z 2026-03-09T08:55:11.296Z DEBG proxy/server.go:227: starting reverse proxy server on :8443
[netbird-proxy] 2026-03-09T08:55:11.297051228Z 2026-03-09T08:55:11.296Z INFO proxy/internal/health/health.go:293: starting health probe server on 127.0.0.1:8080
[netbird-proxy] 2026-03-09T08:55:11.301292952Z 2026-03-09T08:55:11.296Z DEBG proxy/server.go:546: connecting to management mapping stream
[netbird-proxy] 2026-03-09T08:55:11.376464905Z 2026-03-09T08:55:11.376Z INFO ./caller_not_available:0: 2026/03/09 08:55:11 WARNING: [core] [Channel #1 SubChannel #2] grpc: addrConn.createTransport failed to connect to {Addr: "172.30.0.3:80", ServerName: "netbird-server:80", }. Err: connection error: desc = "transport: Error while dialing: dial tcp 172.30.0.3:80: connect: connection refused"
[netbird-proxy] 2026-03-09T08:55:11.376692337Z 2026-03-09T08:55:11.376Z WARN proxy/server.go:584: management connection failed, retrying in 755ms: create mapping stream: rpc error: code = Unavailable desc = connection error: desc = "transport: Error while dialing: dial tcp 172.30.0.3:80: connect: connection refused"
[netbird-proxy] 2026-03-09T08:55:12.132439979Z 2026-03-09T08:55:12.132Z DEBG proxy/server.go:546: connecting to management mapping stream
[netbird-proxy] 2026-03-09T08:55:12.132632603Z 2026-03-09T08:55:12.132Z WARN proxy/server.go:584: management connection failed, retrying in 1.028s: create mapping stream: rpc error: code = Unavailable desc = connection error: desc = "transport: Error while dialing: dial tcp 172.30.0.3:80: connect: connection refused"
[netbird-proxy] 2026-03-09T08:55:13.165359060Z 2026-03-09T08:55:13.162Z DEBG proxy/server.go:546: connecting to management mapping stream
[netbird-proxy] 2026-03-09T08:55:13.165419441Z 2026-03-09T08:55:13.162Z DEBG proxy/server.go:565: management mapping stream established
[netbird-proxy] 2026-03-09T08:55:13.186038074Z 2026-03-09T08:55:13.185Z DEBG proxy/server.go:609: Received mapping update, starting processing
[netbird-proxy] 2026-03-09T08:55:13.186092597Z 2026-03-09T08:55:13.185Z DEBG proxy/server.go:611: Processing mapping update completed
[netbird-proxy] 2026-03-09T08:55:13.186328723Z 2026-03-09T08:55:13.185Z INFO proxy/server.go:618: Initial mapping sync complete
[netbird-proxy] 2026-03-09T08:57:27.898880605Z 2026-03-09T08:57:27.898Z DEBG proxy/server.go:609: Received mapping update, starting processing
[netbird-proxy] 2026-03-09T08:57:27.898933369Z 2026-03-09T08:57:27.898Z DEBG [type: UPDATE_TYPE_CREATED, domain: vaultwarden.expo.anonymised.domain, path: [path:"/"  target:"https://10.20.40.200/"], id: d6n8mtpk0sfc73dl3r0g] proxy/server.go:631: Processing mapping update
[netbird-proxy] 2026-03-09T08:57:27.899090659Z 2026-03-09T08:57:27.898Z DEBG [service_id: d6n8mtpk0sfc73dl3r0g, account_id: d6ccp71k0sfc7390l750] proxy/internal/roundtrip/netbird.go:190: generating WireGuard keypair for new peer
[netbird-proxy] 2026-03-09T08:57:27.899367734Z 2026-03-09T08:57:27.899Z DEBG [public_key: daSIYCnNG3gmw6vQ91bPE7mDQhyc8j3XC+Ydhxy/4kk=, account_id: d6ccp71k0sfc7390l750, service_id: d6n8mtpk0sfc73dl3r0g] proxy/internal/roundtrip/netbird.go:202: authenticating new proxy peer with management
[netbird-proxy] 2026-03-09T08:57:28.005760981Z 2026-03-09T08:57:28.005Z INFO [account_id: d6ccp71k0sfc7390l750, service_id: d6n8mtpk0sfc73dl3r0g, public_key: daSIYCnNG3gmw6vQ91bPE7mDQhyc8j3XC+Ydhxy/4kk=] proxy/internal/roundtrip/netbird.go:226: proxy peer authenticated successfully with management
[netbird-proxy] 2026-03-09T08:57:28.011628431Z 2026-03-09T08:57:28.011Z INFO [domain: vaultwarden.expo.anonymised.domain, account_id: d6ccp71k0sfc7390l750] proxy/internal/roundtrip/netbird.go:175: created new client for account
[netbird-proxy] 2026-03-09T08:57:28.011765886Z 2026-03-09T08:57:28.011Z DEBG proxy/server.go:611: Processing mapping update completed
[netbird-proxy] 2026-03-09T08:57:28.011818199Z 2026-03-09T08:57:28.011Z INFO proxy/internal/acme/manager.go:140: acquiring cert lock for domain "vaultwarden.expo.anonymised.domain"
[netbird-proxy] 2026-03-09T08:57:28.011837764Z 2026-03-09T08:57:28.011Z WARN proxy/internal/acme/manager.go:144: acquire cert lock for domain "vaultwarden.expo.anonymised.domain", proceeding without lock: open lock file /certs/vaultwarden.expo.anonymised.domain.lock: open /certs/vaultwarden.expo.anonymised.domain.lock: permission denied
[netbird-proxy] 2026-03-09T08:57:28.451481439Z 2026-03-09T08:57:28.451Z WARN client/internal/profilemanager/service.go:368: failed to get active profile state: failed to set default active profile state: failed to set active profile to default: failed to write active profile state: create temp: open /var/lib/netbird/.2454754093active_profile.json: permission denied
[netbird-proxy] 2026-03-09T08:57:28.555156764Z 2026-03-09T08:57:28.554Z WARN proxy/internal/acme/manager.go:159: prefetch certificate for domain "vaultwarden.expo.anonymised.domain" in 543.099535ms: open /certs/acme_account+key2826026017: permission denied
[netbird-proxy] 2026-03-09T08:57:28.635285192Z 2026/03/09 08:57:28 failed to sufficiently increase receive buffer size (was: 208 kiB, wanted: 7168 kiB, got: 416 kiB). See https://github.com/quic-go/quic-go/wiki/UDP-Buffer-Sizes for details.
[netbird-proxy] 2026-03-09T08:57:28.691372333Z 2026-03-09T08:57:28.691Z WARN client/firewall/create_linux.go:49: failed to create native firewall: create firewall: no firewall manager found. Proceeding with userspace
[netbird-proxy] 2026-03-09T08:57:28.717533416Z 2026-03-09T08:57:28.716Z INFO [account_id: d6ccp71k0sfc7390l750, domain: vaultwarden.expo.anonymised.domain] proxy/internal/roundtrip/netbird.go:317: notified management about tunnel connection
[netbird-proxy] 2026-03-09T08:58:18.046951018Z 2026-03-09T08:58:18.046Z WARN [http-server: https] ./caller_not_available:0: http: TLS handshake error from 119.28.89.249:60204: unknown domain "anonymised.domain"
[netbird-proxy] 2026-03-09T09:04:52.801568090Z 2026-03-09T09:04:52.800Z WARN [peer: sWITQCdchuGDD9+2kgIshxxs+laJJ6lpC8R4fAHJ41o=] client/internal/peer/worker_ice.go:160: ICE Agent is not initialized yet
[netbird-proxy] 2026-03-09T09:10:02.421260161Z 2026-03-09T09:10:02.421Z WARN [peer: sWITQCdchuGDD9+2kgIshxxs+laJJ6lpC8R4fAHJ41o=] client/internal/peer/worker_ice.go:160: ICE Agent is not initialized yet
[netbird-proxy] 2026-03-09T08:55:11.296917176Z 2026-03-09T08:55:11.293Z INFO proxy/cmd/proxy/cmd/root.go:126: configured log level: debug
[netbird-proxy] 2026-03-09T08:55:11.296992970Z 2026-03-09T08:55:11.294Z DEBG [TLS_enabled: false, gRPC_address: netbird-server:80] proxy/server.go:387: starting management gRPC client
[netbird-proxy] 2026-03-09T08:55:11.297004001Z 2026-03-09T08:55:11.294Z DEBG [expect_continue_timeout: 1s, read_buffer_size: 0, response_header_timeout: 0s, max_idle_conns_per_host: 100, max_inflight: 0, max_idle_conns: 100, disable_compression: false, idle_conn_timeout: 1m30s, tls_handshake_timeout: 10s, write_buffer_size: 0, max_conns_per_host: 0] proxy/internal/roundtrip/transport.go:102: backend transport configuration
[netbird-proxy] 2026-03-09T08:55:11.297013638Z 2026-03-09T08:55:11.294Z DEBG [challenge_type: tls-alpn-01, acme_server: https://acme-v02.api.letsencrypt.org/directory] proxy/server.go:425: ACME certificates enabled, configuring certificate manager
[netbird-proxy] 2026-03-09T08:55:11.297020588Z 2026-03-09T08:55:11.294Z INFO proxy/internal/acme/locker.go:47: auto-detected cert lock method: flock
[netbird-proxy] 2026-03-09T08:55:11.297026639Z 2026-03-09T08:55:11.294Z INFO proxy/internal/acme/locker.go:60: using flock cert locker in /certs
[netbird-proxy] 2026-03-09T08:55:11.297032894Z 2026-03-09T08:55:11.295Z DEBG [challenge_type: tls-alpn-01, ServerName: expo.anonymised.domain] proxy/server.go:449: ACME certificate manager configured
[netbird-proxy] 2026-03-09T08:55:11.297039203Z 2026-03-09T08:55:11.296Z INFO proxy/server.go:318: PROXY protocol enabled on listener
[netbird-proxy] 2026-03-09T08:55:11.297045211Z 2026-03-09T08:55:11.296Z DEBG proxy/server.go:227: starting reverse proxy server on :8443
[netbird-proxy] 2026-03-09T08:55:11.297051228Z 2026-03-09T08:55:11.296Z INFO proxy/internal/health/health.go:293: starting health probe server on 127.0.0.1:8080
[netbird-proxy] 2026-03-09T08:55:11.301292952Z 2026-03-09T08:55:11.296Z DEBG proxy/server.go:546: connecting to management mapping stream
[netbird-proxy] 2026-03-09T08:55:11.376464905Z 2026-03-09T08:55:11.376Z INFO ./caller_not_available:0: 2026/03/09 08:55:11 WARNING: [core] [Channel #1 SubChannel #2] grpc: addrConn.createTransport failed to connect to {Addr: "172.30.0.3:80", ServerName: "netbird-server:80", }. Err: connection error: desc = "transport: Error while dialing: dial tcp 172.30.0.3:80: connect: connection refused"
[netbird-proxy] 2026-03-09T08:55:11.376692337Z 2026-03-09T08:55:11.376Z WARN proxy/server.go:584: management connection failed, retrying in 755ms: create mapping stream: rpc error: code = Unavailable desc = connection error: desc = "transport: Error while dialing: dial tcp 172.30.0.3:80: connect: connection refused"
[netbird-proxy] 2026-03-09T08:55:12.132439979Z 2026-03-09T08:55:12.132Z DEBG proxy/server.go:546: connecting to management mapping stream
[netbird-proxy] 2026-03-09T08:55:12.132632603Z 2026-03-09T08:55:12.132Z WARN proxy/server.go:584: management connection failed, retrying in 1.028s: create mapping stream: rpc error: code = Unavailable desc = connection error: desc = "transport: Error while dialing: dial tcp 172.30.0.3:80: connect: connection refused"
[netbird-proxy] 2026-03-09T08:55:13.165359060Z 2026-03-09T08:55:13.162Z DEBG proxy/server.go:546: connecting to management mapping stream
[netbird-proxy] 2026-03-09T08:55:13.165419441Z 2026-03-09T08:55:13.162Z DEBG proxy/server.go:565: management mapping stream established
[netbird-proxy] 2026-03-09T08:55:13.186038074Z 2026-03-09T08:55:13.185Z DEBG proxy/server.go:609: Received mapping update, starting processing
[netbird-proxy] 2026-03-09T08:55:13.186092597Z 2026-03-09T08:55:13.185Z DEBG proxy/server.go:611: Processing mapping update completed
[netbird-proxy] 2026-03-09T08:55:13.186328723Z 2026-03-09T08:55:13.185Z INFO proxy/server.go:618: Initial mapping sync complete
[netbird-proxy] 2026-03-09T08:57:27.898880605Z 2026-03-09T08:57:27.898Z DEBG proxy/server.go:609: Received mapping update, starting processing
[netbird-proxy] 2026-03-09T08:57:27.898933369Z 2026-03-09T08:57:27.898Z DEBG [type: UPDATE_TYPE_CREATED, domain: vaultwarden.expo.anonymised.domain, path: [path:"/"  target:"https://10.20.40.200/"], id: d6n8mtpk0sfc73dl3r0g] proxy/server.go:631: Processing mapping update
[netbird-proxy] 2026-03-09T08:57:27.899090659Z 2026-03-09T08:57:27.898Z DEBG [service_id: d6n8mtpk0sfc73dl3r0g, account_id: d6ccp71k0sfc7390l750] proxy/internal/roundtrip/netbird.go:190: generating WireGuard keypair for new peer
[netbird-proxy] 2026-03-09T08:57:27.899367734Z 2026-03-09T08:57:27.899Z DEBG [public_key: daSIYCnNG3gmw6vQ91bPE7mDQhyc8j3XC+Ydhxy/4kk=, account_id: d6ccp71k0sfc7390l750, service_id: d6n8mtpk0sfc73dl3r0g] proxy/internal/roundtrip/netbird.go:202: authenticating new proxy peer with management
[netbird-proxy] 2026-03-09T08:57:28.005760981Z 2026-03-09T08:57:28.005Z INFO [account_id: d6ccp71k0sfc7390l750, service_id: d6n8mtpk0sfc73dl3r0g, public_key: daSIYCnNG3gmw6vQ91bPE7mDQhyc8j3XC+Ydhxy/4kk=] proxy/internal/roundtrip/netbird.go:226: proxy peer authenticated successfully with management
[netbird-proxy] 2026-03-09T08:57:28.011628431Z 2026-03-09T08:57:28.011Z INFO [domain: vaultwarden.expo.anonymised.domain, account_id: d6ccp71k0sfc7390l750] proxy/internal/roundtrip/netbird.go:175: created new client for account
[netbird-proxy] 2026-03-09T08:57:28.011765886Z 2026-03-09T08:57:28.011Z DEBG proxy/server.go:611: Processing mapping update completed
[netbird-proxy] 2026-03-09T08:57:28.011818199Z 2026-03-09T08:57:28.011Z INFO proxy/internal/acme/manager.go:140: acquiring cert lock for domain "vaultwarden.expo.anonymised.domain"
[netbird-proxy] 2026-03-09T08:57:28.011837764Z 2026-03-09T08:57:28.011Z WARN proxy/internal/acme/manager.go:144: acquire cert lock for domain "vaultwarden.expo.anonymised.domain", proceeding without lock: open lock file /certs/vaultwarden.expo.anonymised.domain.lock: open /certs/vaultwarden.expo.anonymised.domain.lock: permission denied
[netbird-proxy] 2026-03-09T08:57:28.451481439Z 2026-03-09T08:57:28.451Z WARN client/internal/profilemanager/service.go:368: failed to get active profile state: failed to set default active profile state: failed to set active profile to default: failed to write active profile state: create temp: open /var/lib/netbird/.2454754093active_profile.json: permission denied
[netbird-proxy] 2026-03-09T08:57:28.555156764Z 2026-03-09T08:57:28.554Z WARN proxy/internal/acme/manager.go:159: prefetch certificate for domain "vaultwarden.expo.anonymised.domain" in 543.099535ms: open /certs/acme_account+key2826026017: permission denied
[netbird-proxy] 2026-03-09T08:57:28.635285192Z 2026/03/09 08:57:28 failed to sufficiently increase receive buffer size (was: 208 kiB, wanted: 7168 kiB, got: 416 kiB). See https://github.com/quic-go/quic-go/wiki/UDP-Buffer-Sizes for details.
[netbird-proxy] 2026-03-09T08:57:28.691372333Z 2026-03-09T08:57:28.691Z WARN client/firewall/create_linux.go:49: failed to create native firewall: create firewall: no firewall manager found. Proceeding with userspace
[netbird-proxy] 2026-03-09T08:57:28.717533416Z 2026-03-09T08:57:28.716Z INFO [account_id: d6ccp71k0sfc7390l750, domain: vaultwarden.expo.anonymised.domain] proxy/internal/roundtrip/netbird.go:317: notified management about tunnel connection
[netbird-proxy] 2026-03-09T08:58:18.046951018Z 2026-03-09T08:58:18.046Z WARN [http-server: https] ./caller_not_available:0: http: TLS handshake error from 119.28.89.249:60204: unknown domain "anonymised.domain"
[netbird-proxy] 2026-03-09T09:04:52.801568090Z 2026-03-09T09:04:52.800Z WARN [peer: sWITQCdchuGDD9+2kgIshxxs+laJJ6lpC8R4fAHJ41o=] client/internal/peer/worker_ice.go:160: ICE Agent is not initialized yet
[netbird-proxy] 2026-03-09T09:10:02.421260161Z 2026-03-09T09:10:02.421Z WARN [peer: sWITQCdchuGDD9+2kgIshxxs+laJJ6lpC8R4fAHJ41o=] client/internal/peer/worker_ice.go:160: ICE Agent is not initialized yet
[netbird-proxy] 2026-03-09T09:18:12.340708367Z 2026-03-09T09:18:12.340Z WARN [peer: sWITQCdchuGDD9+2kgIshxxs+laJJ6lpC8R4fAHJ41o=] client/internal/peer/worker_ice.go:160: ICE Agent is not initialized yet
[netbird-proxy] 2026-03-09T09:18:28.587579081Z 2026-03-09T09:18:28.587Z WARN [http-server: https] ./caller_not_available:0: http: TLS handshake error from 74.7.230.10:48996: unknown domain "crowdsec.anonymised.domain"
[netbird-proxy] 2026-03-09T09:18:28.852785245Z 2026-03-09T09:18:28.852Z WARN [http-server: https] ./caller_not_available:0: http: TLS handshake error from 74.7.230.10:49008: unknown domain "crowdsec.anonymised.domain"
[netbird-proxy] 2026-03-09T09:18:29.105190983Z 2026-03-09T09:18:29.104Z WARN [http-server: https] ./caller_not_available:0: http: TLS handshake error from 74.7.230.10:49012: unknown domain "crowdsec.anonymised.domain"
[netbird-proxy] 2026-03-09T09:23:12.018392323Z 2026-03-09T09:23:12.018Z WARN [http-server: https] ./caller_not_available:0: http: TLS handshake error from 146.88.240.72:26619: acme/autocert: missing server name
[netbird-proxy] 2026-03-09T08:55:11.296917176Z 2026-03-09T08:55:11.293Z INFO proxy/cmd/proxy/cmd/root.go:126: configured log level: debug
[netbird-proxy] 2026-03-09T08:55:11.296992970Z 2026-03-09T08:55:11.294Z DEBG [TLS_enabled: false, gRPC_address: netbird-server:80] proxy/server.go:387: starting management gRPC client
[netbird-proxy] 2026-03-09T08:55:11.297004001Z 2026-03-09T08:55:11.294Z DEBG [expect_continue_timeout: 1s, read_buffer_size: 0, response_header_timeout: 0s, max_idle_conns_per_host: 100, max_inflight: 0, max_idle_conns: 100, disable_compression: false, idle_conn_timeout: 1m30s, tls_handshake_timeout: 10s, write_buffer_size: 0, max_conns_per_host: 0] proxy/internal/roundtrip/transport.go:102: backend transport configuration
[netbird-proxy] 2026-03-09T08:55:11.297013638Z 2026-03-09T08:55:11.294Z DEBG [challenge_type: tls-alpn-01, acme_server: https://acme-v02.api.letsencrypt.org/directory] proxy/server.go:425: ACME certificates enabled, configuring certificate manager
[netbird-proxy] 2026-03-09T08:55:11.297020588Z 2026-03-09T08:55:11.294Z INFO proxy/internal/acme/locker.go:47: auto-detected cert lock method: flock
[netbird-proxy] 2026-03-09T08:55:11.297026639Z 2026-03-09T08:55:11.294Z INFO proxy/internal/acme/locker.go:60: using flock cert locker in /certs
[netbird-proxy] 2026-03-09T08:55:11.297032894Z 2026-03-09T08:55:11.295Z DEBG [challenge_type: tls-alpn-01, ServerName: expo.anonymised.domain] proxy/server.go:449: ACME certificate manager configured
[netbird-proxy] 2026-03-09T08:55:11.297039203Z 2026-03-09T08:55:11.296Z INFO proxy/server.go:318: PROXY protocol enabled on listener
[netbird-proxy] 2026-03-09T08:55:11.297045211Z 2026-03-09T08:55:11.296Z DEBG proxy/server.go:227: starting reverse proxy server on :8443
[netbird-proxy] 2026-03-09T08:55:11.297051228Z 2026-03-09T08:55:11.296Z INFO proxy/internal/health/health.go:293: starting health probe server on 127.0.0.1:8080
[netbird-proxy] 2026-03-09T08:55:11.301292952Z 2026-03-09T08:55:11.296Z DEBG proxy/server.go:546: connecting to management mapping stream
[netbird-proxy] 2026-03-09T08:55:11.376464905Z 2026-03-09T08:55:11.376Z INFO ./caller_not_available:0: 2026/03/09 08:55:11 WARNING: [core] [Channel #1 SubChannel #2] grpc: addrConn.createTransport failed to connect to {Addr: "172.30.0.3:80", ServerName: "netbird-server:80", }. Err: connection error: desc = "transport: Error while dialing: dial tcp 172.30.0.3:80: connect: connection refused"
[netbird-proxy] 2026-03-09T08:55:11.376692337Z 2026-03-09T08:55:11.376Z WARN proxy/server.go:584: management connection failed, retrying in 755ms: create mapping stream: rpc error: code = Unavailable desc = connection error: desc = "transport: Error while dialing: dial tcp 172.30.0.3:80: connect: connection refused"
[netbird-proxy] 2026-03-09T08:55:12.132439979Z 2026-03-09T08:55:12.132Z DEBG proxy/server.go:546: connecting to management mapping stream
[netbird-proxy] 2026-03-09T08:55:12.132632603Z 2026-03-09T08:55:12.132Z WARN proxy/server.go:584: management connection failed, retrying in 1.028s: create mapping stream: rpc error: code = Unavailable desc = connection error: desc = "transport: Error while dialing: dial tcp 172.30.0.3:80: connect: connection refused"
[netbird-proxy] 2026-03-09T08:55:13.165359060Z 2026-03-09T08:55:13.162Z DEBG proxy/server.go:546: connecting to management mapping stream
[netbird-proxy] 2026-03-09T08:55:13.165419441Z 2026-03-09T08:55:13.162Z DEBG proxy/server.go:565: management mapping stream established
[netbird-proxy] 2026-03-09T08:55:13.186038074Z 2026-03-09T08:55:13.185Z DEBG proxy/server.go:609: Received mapping update, starting processing
[netbird-proxy] 2026-03-09T08:55:13.186092597Z 2026-03-09T08:55:13.185Z DEBG proxy/server.go:611: Processing mapping update completed
[netbird-proxy] 2026-03-09T08:55:13.186328723Z 2026-03-09T08:55:13.185Z INFO proxy/server.go:618: Initial mapping sync complete
[netbird-proxy] 2026-03-09T08:57:27.898880605Z 2026-03-09T08:57:27.898Z DEBG proxy/server.go:609: Received mapping update, starting processing
[netbird-proxy] 2026-03-09T08:57:27.898933369Z 2026-03-09T08:57:27.898Z DEBG [type: UPDATE_TYPE_CREATED, domain: vaultwarden.expo.anonymised.domain, path: [path:"/"  target:"https://10.20.40.200/"], id: d6n8mtpk0sfc73dl3r0g] proxy/server.go:631: Processing mapping update
[netbird-proxy] 2026-03-09T08:57:27.899090659Z 2026-03-09T08:57:27.898Z DEBG [service_id: d6n8mtpk0sfc73dl3r0g, account_id: d6ccp71k0sfc7390l750] proxy/internal/roundtrip/netbird.go:190: generating WireGuard keypair for new peer
[netbird-proxy] 2026-03-09T08:57:27.899367734Z 2026-03-09T08:57:27.899Z DEBG [public_key: daSIYCnNG3gmw6vQ91bPE7mDQhyc8j3XC+Ydhxy/4kk=, account_id: d6ccp71k0sfc7390l750, service_id: d6n8mtpk0sfc73dl3r0g] proxy/internal/roundtrip/netbird.go:202: authenticating new proxy peer with management
[netbird-proxy] 2026-03-09T08:57:28.005760981Z 2026-03-09T08:57:28.005Z INFO [account_id: d6ccp71k0sfc7390l750, service_id: d6n8mtpk0sfc73dl3r0g, public_key: daSIYCnNG3gmw6vQ91bPE7mDQhyc8j3XC+Ydhxy/4kk=] proxy/internal/roundtrip/netbird.go:226: proxy peer authenticated successfully with management
[netbird-proxy] 2026-03-09T08:57:28.011628431Z 2026-03-09T08:57:28.011Z INFO [domain: vaultwarden.expo.anonymised.domain, account_id: d6ccp71k0sfc7390l750] proxy/internal/roundtrip/netbird.go:175: created new client for account
[netbird-proxy] 2026-03-09T08:57:28.011765886Z 2026-03-09T08:57:28.011Z DEBG proxy/server.go:611: Processing mapping update completed
[netbird-proxy] 2026-03-09T08:57:28.011818199Z 2026-03-09T08:57:28.011Z INFO proxy/internal/acme/manager.go:140: acquiring cert lock for domain "vaultwarden.expo.anonymised.domain"
[netbird-proxy] 2026-03-09T08:57:28.011837764Z 2026-03-09T08:57:28.011Z WARN proxy/internal/acme/manager.go:144: acquire cert lock for domain "vaultwarden.expo.anonymised.domain", proceeding without lock: open lock file /certs/vaultwarden.expo.anonymised.domain.lock: open /certs/vaultwarden.expo.anonymised.domain.lock: permission denied
[netbird-proxy] 2026-03-09T08:57:28.451481439Z 2026-03-09T08:57:28.451Z WARN client/internal/profilemanager/service.go:368: failed to get active profile state: failed to set default active profile state: failed to set active profile to default: failed to write active profile state: create temp: open /var/lib/netbird/.2454754093active_profile.json: permission denied
[netbird-proxy] 2026-03-09T08:57:28.555156764Z 2026-03-09T08:57:28.554Z WARN proxy/internal/acme/manager.go:159: prefetch certificate for domain "vaultwarden.expo.anonymised.domain" in 543.099535ms: open /certs/acme_account+key2826026017: permission denied
[netbird-proxy] 2026-03-09T08:57:28.635285192Z 2026/03/09 08:57:28 failed to sufficiently increase receive buffer size (was: 208 kiB, wanted: 7168 kiB, got: 416 kiB). See https://github.com/quic-go/quic-go/wiki/UDP-Buffer-Sizes for details.
[netbird-proxy] 2026-03-09T08:57:28.691372333Z 2026-03-09T08:57:28.691Z WARN client/firewall/create_linux.go:49: failed to create native firewall: create firewall: no firewall manager found. Proceeding with userspace
[netbird-proxy] 2026-03-09T08:57:28.717533416Z 2026-03-09T08:57:28.716Z INFO [account_id: d6ccp71k0sfc7390l750, domain: vaultwarden.expo.anonymised.domain] proxy/internal/roundtrip/netbird.go:317: notified management about tunnel connection
[netbird-proxy] 2026-03-09T08:58:18.046951018Z 2026-03-09T08:58:18.046Z WARN [http-server: https] ./caller_not_available:0: http: TLS handshake error from 119.28.89.249:60204: unknown domain "anonymised.domain"
[netbird-proxy] 2026-03-09T09:04:52.801568090Z 2026-03-09T09:04:52.800Z WARN [peer: sWITQCdchuGDD9+2kgIshxxs+laJJ6lpC8R4fAHJ41o=] client/internal/peer/worker_ice.go:160: ICE Agent is not initialized yet
[netbird-proxy] 2026-03-09T09:10:02.421260161Z 2026-03-09T09:10:02.421Z WARN [peer: sWITQCdchuGDD9+2kgIshxxs+laJJ6lpC8R4fAHJ41o=] client/internal/peer/worker_ice.go:160: ICE Agent is not initialized yet
[netbird-proxy] 2026-03-09T09:18:12.340708367Z 2026-03-09T09:18:12.340Z WARN [peer: sWITQCdchuGDD9+2kgIshxxs+laJJ6lpC8R4fAHJ41o=] client/internal/peer/worker_ice.go:160: ICE Agent is not initialized yet
[netbird-proxy] 2026-03-09T09:18:28.587579081Z 2026-03-09T09:18:28.587Z WARN [http-server: https] ./caller_not_available:0: http: TLS handshake error from 74.7.230.10:48996: unknown domain "crowdsec.anonymised.domain"
[netbird-proxy] 2026-03-09T09:18:28.852785245Z 2026-03-09T09:18:28.852Z WARN [http-server: https] ./caller_not_available:0: http: TLS handshake error from 74.7.230.10:49008: unknown domain "crowdsec.anonymised.domain"
[netbird-proxy] 2026-03-09T09:18:29.105190983Z 2026-03-09T09:18:29.104Z WARN [http-server: https] ./caller_not_available:0: http: TLS handshake error from 74.7.230.10:49012: unknown domain "crowdsec.anonymised.domain"
[netbird-proxy] 2026-03-09T09:23:12.018392323Z 2026-03-09T09:23:12.018Z WARN [http-server: https] ./caller_not_available:0: http: TLS handshake error from 146.88.240.72:26619: acme/autocert: missing server name
[netbird-proxy] 2026-03-09T08:55:11.296917176Z 2026-03-09T08:55:11.293Z INFO proxy/cmd/proxy/cmd/root.go:126: configured log level: debug
[netbird-proxy] 2026-03-09T08:55:11.296992970Z 2026-03-09T08:55:11.294Z DEBG [TLS_enabled: false, gRPC_address: netbird-server:80] proxy/server.go:387: starting management gRPC client
[netbird-proxy] 2026-03-09T08:55:11.297004001Z 2026-03-09T08:55:11.294Z DEBG [expect_continue_timeout: 1s, read_buffer_size: 0, response_header_timeout: 0s, max_idle_conns_per_host: 100, max_inflight: 0, max_idle_conns: 100, disable_compression: false, idle_conn_timeout: 1m30s, tls_handshake_timeout: 10s, write_buffer_size: 0, max_conns_per_host: 0] proxy/internal/roundtrip/transport.go:102: backend transport configuration
[netbird-proxy] 2026-03-09T08:55:11.297013638Z 2026-03-09T08:55:11.294Z DEBG [challenge_type: tls-alpn-01, acme_server: https://acme-v02.api.letsencrypt.org/directory] proxy/server.go:425: ACME certificates enabled, configuring certificate manager
[netbird-proxy] 2026-03-09T08:55:11.297020588Z 2026-03-09T08:55:11.294Z INFO proxy/internal/acme/locker.go:47: auto-detected cert lock method: flock
[netbird-proxy] 2026-03-09T08:55:11.297026639Z 2026-03-09T08:55:11.294Z INFO proxy/internal/acme/locker.go:60: using flock cert locker in /certs
[netbird-proxy] 2026-03-09T08:55:11.297032894Z 2026-03-09T08:55:11.295Z DEBG [challenge_type: tls-alpn-01, ServerName: expo.anonymised.domain] proxy/server.go:449: ACME certificate manager configured
[netbird-proxy] 2026-03-09T08:55:11.297039203Z 2026-03-09T08:55:11.296Z INFO proxy/server.go:318: PROXY protocol enabled on listener
[netbird-proxy] 2026-03-09T08:55:11.297045211Z 2026-03-09T08:55:11.296Z DEBG proxy/server.go:227: starting reverse proxy server on :8443
[netbird-proxy] 2026-03-09T08:55:11.297051228Z 2026-03-09T08:55:11.296Z INFO proxy/internal/health/health.go:293: starting health probe server on 127.0.0.1:8080
[netbird-proxy] 2026-03-09T08:55:11.301292952Z 2026-03-09T08:55:11.296Z DEBG proxy/server.go:546: connecting to management mapping stream
[netbird-proxy] 2026-03-09T08:55:11.376464905Z 2026-03-09T08:55:11.376Z INFO ./caller_not_available:0: 2026/03/09 08:55:11 WARNING: [core] [Channel #1 SubChannel #2] grpc: addrConn.createTransport failed to connect to {Addr: "172.30.0.3:80", ServerName: "netbird-server:80", }. Err: connection error: desc = "transport: Error while dialing: dial tcp 172.30.0.3:80: connect: connection refused"
[netbird-proxy] 2026-03-09T08:55:11.376692337Z 2026-03-09T08:55:11.376Z WARN proxy/server.go:584: management connection failed, retrying in 755ms: create mapping stream: rpc error: code = Unavailable desc = connection error: desc = "transport: Error while dialing: dial tcp 172.30.0.3:80: connect: connection refused"
[netbird-proxy] 2026-03-09T08:55:12.132439979Z 2026-03-09T08:55:12.132Z DEBG proxy/server.go:546: connecting to management mapping stream
[netbird-proxy] 2026-03-09T08:55:12.132632603Z 2026-03-09T08:55:12.132Z WARN proxy/server.go:584: management connection failed, retrying in 1.028s: create mapping stream: rpc error: code = Unavailable desc = connection error: desc = "transport: Error while dialing: dial tcp 172.30.0.3:80: connect: connection refused"
[netbird-proxy] 2026-03-09T08:55:13.165359060Z 2026-03-09T08:55:13.162Z DEBG proxy/server.go:546: connecting to management mapping stream
[netbird-proxy] 2026-03-09T08:55:13.165419441Z 2026-03-09T08:55:13.162Z DEBG proxy/server.go:565: management mapping stream established
[netbird-proxy] 2026-03-09T08:55:13.186038074Z 2026-03-09T08:55:13.185Z DEBG proxy/server.go:609: Received mapping update, starting processing
[netbird-proxy] 2026-03-09T08:55:13.186092597Z 2026-03-09T08:55:13.185Z DEBG proxy/server.go:611: Processing mapping update completed
[netbird-proxy] 2026-03-09T08:55:13.186328723Z 2026-03-09T08:55:13.185Z INFO proxy/server.go:618: Initial mapping sync complete
[netbird-proxy] 2026-03-09T08:57:27.898880605Z 2026-03-09T08:57:27.898Z DEBG proxy/server.go:609: Received mapping update, starting processing
[netbird-proxy] 2026-03-09T08:57:27.898933369Z 2026-03-09T08:57:27.898Z DEBG [type: UPDATE_TYPE_CREATED, domain: vaultwarden.expo.anonymised.domain, path: [path:"/"  target:"https://10.20.40.200/"], id: d6n8mtpk0sfc73dl3r0g] proxy/server.go:631: Processing mapping update
[netbird-proxy] 2026-03-09T08:57:27.899090659Z 2026-03-09T08:57:27.898Z DEBG [service_id: d6n8mtpk0sfc73dl3r0g, account_id: d6ccp71k0sfc7390l750] proxy/internal/roundtrip/netbird.go:190: generating WireGuard keypair for new peer
[netbird-proxy] 2026-03-09T08:57:27.899367734Z 2026-03-09T08:57:27.899Z DEBG [public_key: daSIYCnNG3gmw6vQ91bPE7mDQhyc8j3XC+Ydhxy/4kk=, account_id: d6ccp71k0sfc7390l750, service_id: d6n8mtpk0sfc73dl3r0g] proxy/internal/roundtrip/netbird.go:202: authenticating new proxy peer with management
[netbird-proxy] 2026-03-09T08:57:28.005760981Z 2026-03-09T08:57:28.005Z INFO [account_id: d6ccp71k0sfc7390l750, service_id: d6n8mtpk0sfc73dl3r0g, public_key: daSIYCnNG3gmw6vQ91bPE7mDQhyc8j3XC+Ydhxy/4kk=] proxy/internal/roundtrip/netbird.go:226: proxy peer authenticated successfully with management
[netbird-proxy] 2026-03-09T08:57:28.011628431Z 2026-03-09T08:57:28.011Z INFO [domain: vaultwarden.expo.anonymised.domain, account_id: d6ccp71k0sfc7390l750] proxy/internal/roundtrip/netbird.go:175: created new client for account
[netbird-proxy] 2026-03-09T08:57:28.011765886Z 2026-03-09T08:57:28.011Z DEBG proxy/server.go:611: Processing mapping update completed
[netbird-proxy] 2026-03-09T08:57:28.011818199Z 2026-03-09T08:57:28.011Z INFO proxy/internal/acme/manager.go:140: acquiring cert lock for domain "vaultwarden.expo.anonymised.domain"
[netbird-proxy] 2026-03-09T08:57:28.011837764Z 2026-03-09T08:57:28.011Z WARN proxy/internal/acme/manager.go:144: acquire cert lock for domain "vaultwarden.expo.anonymised.domain", proceeding without lock: open lock file /certs/vaultwarden.expo.anonymised.domain.lock: open /certs/vaultwarden.expo.anonymised.domain.lock: permission denied
[netbird-proxy] 2026-03-09T08:57:28.451481439Z 2026-03-09T08:57:28.451Z WARN client/internal/profilemanager/service.go:368: failed to get active profile state: failed to set default active profile state: failed to set active profile to default: failed to write active profile state: create temp: open /var/lib/netbird/.2454754093active_profile.json: permission denied
[netbird-proxy] 2026-03-09T08:57:28.555156764Z 2026-03-09T08:57:28.554Z WARN proxy/internal/acme/manager.go:159: prefetch certificate for domain "vaultwarden.expo.anonymised.domain" in 543.099535ms: open /certs/acme_account+key2826026017: permission denied
[netbird-proxy] 2026-03-09T08:57:28.635285192Z 2026/03/09 08:57:28 failed to sufficiently increase receive buffer size (was: 208 kiB, wanted: 7168 kiB, got: 416 kiB). See https://github.com/quic-go/quic-go/wiki/UDP-Buffer-Sizes for details.
[netbird-proxy] 2026-03-09T08:57:28.691372333Z 2026-03-09T08:57:28.691Z WARN client/firewall/create_linux.go:49: failed to create native firewall: create firewall: no firewall manager found. Proceeding with userspace
[netbird-proxy] 2026-03-09T08:57:28.717533416Z 2026-03-09T08:57:28.716Z INFO [account_id: d6ccp71k0sfc7390l750, domain: vaultwarden.expo.anonymised.domain] proxy/internal/roundtrip/netbird.go:317: notified management about tunnel connection
[netbird-proxy] 2026-03-09T08:58:18.046951018Z 2026-03-09T08:58:18.046Z WARN [http-server: https] ./caller_not_available:0: http: TLS handshake error from 119.28.89.249:60204: unknown domain "anonymised.domain"
[netbird-proxy] 2026-03-09T09:04:52.801568090Z 2026-03-09T09:04:52.800Z WARN [peer: sWITQCdchuGDD9+2kgIshxxs+laJJ6lpC8R4fAHJ41o=] client/internal/peer/worker_ice.go:160: ICE Agent is not initialized yet
[netbird-proxy] 2026-03-09T09:10:02.421260161Z 2026-03-09T09:10:02.421Z WARN [peer: sWITQCdchuGDD9+2kgIshxxs+laJJ6lpC8R4fAHJ41o=] client/internal/peer/worker_ice.go:160: ICE Agent is not initialized yet
[netbird-proxy] 2026-03-09T09:18:12.340708367Z 2026-03-09T09:18:12.340Z WARN [peer: sWITQCdchuGDD9+2kgIshxxs+laJJ6lpC8R4fAHJ41o=] client/internal/peer/worker_ice.go:160: ICE Agent is not initialized yet
[netbird-proxy] 2026-03-09T09:18:28.587579081Z 2026-03-09T09:18:28.587Z WARN [http-server: https] ./caller_not_available:0: http: TLS handshake error from 74.7.230.10:48996: unknown domain "crowdsec.anonymised.domain"
[netbird-proxy] 2026-03-09T09:18:28.852785245Z 2026-03-09T09:18:28.852Z WARN [http-server: https] ./caller_not_available:0: http: TLS handshake error from 74.7.230.10:49008: unknown domain "crowdsec.anonymised.domain"
[netbird-proxy] 2026-03-09T09:18:29.105190983Z 2026-03-09T09:18:29.104Z WARN [http-server: https] ./caller_not_available:0: http: TLS handshake error from 74.7.230.10:49012: unknown domain "crowdsec.anonymised.domain"
[netbird-proxy] 2026-03-09T09:23:12.018392323Z 2026-03-09T09:23:12.018Z WARN [http-server: https] ./caller_not_available:0: http: TLS handshake error from 146.88.240.72:26619: acme/autocert: missing server name
[netbird-proxy] 2026-03-09T08:55:11.296917176Z 2026-03-09T08:55:11.293Z INFO proxy/cmd/proxy/cmd/root.go:126: configured log level: debug
[netbird-proxy] 2026-03-09T08:55:11.296992970Z 2026-03-09T08:55:11.294Z DEBG [TLS_enabled: false, gRPC_address: netbird-server:80] proxy/server.go:387: starting management gRPC client
[netbird-proxy] 2026-03-09T08:55:11.297004001Z 2026-03-09T08:55:11.294Z DEBG [expect_continue_timeout: 1s, read_buffer_size: 0, response_header_timeout: 0s, max_idle_conns_per_host: 100, max_inflight: 0, max_idle_conns: 100, disable_compression: false, idle_conn_timeout: 1m30s, tls_handshake_timeout: 10s, write_buffer_size: 0, max_conns_per_host: 0] proxy/internal/roundtrip/transport.go:102: backend transport configuration
[netbird-proxy] 2026-03-09T08:55:11.297013638Z 2026-03-09T08:55:11.294Z DEBG [challenge_type: tls-alpn-01, acme_server: https://acme-v02.api.letsencrypt.org/directory] proxy/server.go:425: ACME certificates enabled, configuring certificate manager
[netbird-proxy] 2026-03-09T08:55:11.297020588Z 2026-03-09T08:55:11.294Z INFO proxy/internal/acme/locker.go:47: auto-detected cert lock method: flock
[netbird-proxy] 2026-03-09T08:55:11.297026639Z 2026-03-09T08:55:11.294Z INFO proxy/internal/acme/locker.go:60: using flock cert locker in /certs
[netbird-proxy] 2026-03-09T08:55:11.297032894Z 2026-03-09T08:55:11.295Z DEBG [challenge_type: tls-alpn-01, ServerName: expo.anonymised.domain] proxy/server.go:449: ACME certificate manager configured
[netbird-proxy] 2026-03-09T08:55:11.297039203Z 2026-03-09T08:55:11.296Z INFO proxy/server.go:318: PROXY protocol enabled on listener
[netbird-proxy] 2026-03-09T08:55:11.297045211Z 2026-03-09T08:55:11.296Z DEBG proxy/server.go:227: starting reverse proxy server on :8443
[netbird-proxy] 2026-03-09T08:55:11.297051228Z 2026-03-09T08:55:11.296Z INFO proxy/internal/health/health.go:293: starting health probe server on 127.0.0.1:8080
[netbird-proxy] 2026-03-09T08:55:11.301292952Z 2026-03-09T08:55:11.296Z DEBG proxy/server.go:546: connecting to management mapping stream
[netbird-proxy] 2026-03-09T08:55:11.376464905Z 2026-03-09T08:55:11.376Z INFO ./caller_not_available:0: 2026/03/09 08:55:11 WARNING: [core] [Channel #1 SubChannel #2] grpc: addrConn.createTransport failed to connect to {Addr: "172.30.0.3:80", ServerName: "netbird-server:80", }. Err: connection error: desc = "transport: Error while dialing: dial tcp 172.30.0.3:80: connect: connection refused"
[netbird-proxy] 2026-03-09T08:55:11.376692337Z 2026-03-09T08:55:11.376Z WARN proxy/server.go:584: management connection failed, retrying in 755ms: create mapping stream: rpc error: code = Unavailable desc = connection error: desc = "transport: Error while dialing: dial tcp 172.30.0.3:80: connect: connection refused"
[netbird-proxy] 2026-03-09T08:55:12.132439979Z 2026-03-09T08:55:12.132Z DEBG proxy/server.go:546: connecting to management mapping stream
[netbird-proxy] 2026-03-09T08:55:12.132632603Z 2026-03-09T08:55:12.132Z WARN proxy/server.go:584: management connection failed, retrying in 1.028s: create mapping stream: rpc error: code = Unavailable desc = connection error: desc = "transport: Error while dialing: dial tcp 172.30.0.3:80: connect: connection refused"
[netbird-proxy] 2026-03-09T08:55:13.165359060Z 2026-03-09T08:55:13.162Z DEBG proxy/server.go:546: connecting to management mapping stream
[netbird-proxy] 2026-03-09T08:55:13.165419441Z 2026-03-09T08:55:13.162Z DEBG proxy/server.go:565: management mapping stream established
[netbird-proxy] 2026-03-09T08:55:13.186038074Z 2026-03-09T08:55:13.185Z DEBG proxy/server.go:609: Received mapping update, starting processing
[netbird-proxy] 2026-03-09T08:55:13.186092597Z 2026-03-09T08:55:13.185Z DEBG proxy/server.go:611: Processing mapping update completed
[netbird-proxy] 2026-03-09T08:55:13.186328723Z 2026-03-09T08:55:13.185Z INFO proxy/server.go:618: Initial mapping sync complete
[netbird-proxy] 2026-03-09T08:57:27.898880605Z 2026-03-09T08:57:27.898Z DEBG proxy/server.go:609: Received mapping update, starting processing
[netbird-proxy] 2026-03-09T08:57:27.898933369Z 2026-03-09T08:57:27.898Z DEBG [type: UPDATE_TYPE_CREATED, domain: vaultwarden.expo.anonymised.domain, path: [path:"/"  target:"https://10.20.40.200/"], id: d6n8mtpk0sfc73dl3r0g] proxy/server.go:631: Processing mapping update
[netbird-proxy] 2026-03-09T08:57:27.899090659Z 2026-03-09T08:57:27.898Z DEBG [service_id: d6n8mtpk0sfc73dl3r0g, account_id: d6ccp71k0sfc7390l750] proxy/internal/roundtrip/netbird.go:190: generating WireGuard keypair for new peer
[netbird-proxy] 2026-03-09T08:57:27.899367734Z 2026-03-09T08:57:27.899Z DEBG [public_key: daSIYCnNG3gmw6vQ91bPE7mDQhyc8j3XC+Ydhxy/4kk=, account_id: d6ccp71k0sfc7390l750, service_id: d6n8mtpk0sfc73dl3r0g] proxy/internal/roundtrip/netbird.go:202: authenticating new proxy peer with management
[netbird-proxy] 2026-03-09T08:57:28.005760981Z 2026-03-09T08:57:28.005Z INFO [account_id: d6ccp71k0sfc7390l750, service_id: d6n8mtpk0sfc73dl3r0g, public_key: daSIYCnNG3gmw6vQ91bPE7mDQhyc8j3XC+Ydhxy/4kk=] proxy/internal/roundtrip/netbird.go:226: proxy peer authenticated successfully with management
[netbird-proxy] 2026-03-09T08:57:28.011628431Z 2026-03-09T08:57:28.011Z INFO [domain: vaultwarden.expo.anonymised.domain, account_id: d6ccp71k0sfc7390l750] proxy/internal/roundtrip/netbird.go:175: created new client for account
[netbird-proxy] 2026-03-09T08:57:28.011765886Z 2026-03-09T08:57:28.011Z DEBG proxy/server.go:611: Processing mapping update completed
[netbird-proxy] 2026-03-09T08:57:28.011818199Z 2026-03-09T08:57:28.011Z INFO proxy/internal/acme/manager.go:140: acquiring cert lock for domain "vaultwarden.expo.anonymised.domain"
[netbird-proxy] 2026-03-09T08:57:28.011837764Z 2026-03-09T08:57:28.011Z WARN proxy/internal/acme/manager.go:144: acquire cert lock for domain "vaultwarden.expo.anonymised.domain", proceeding without lock: open lock file /certs/vaultwarden.expo.anonymised.domain.lock: open /certs/vaultwarden.expo.anonymised.domain.lock: permission denied
[netbird-proxy] 2026-03-09T08:57:28.451481439Z 2026-03-09T08:57:28.451Z WARN client/internal/profilemanager/service.go:368: failed to get active profile state: failed to set default active profile state: failed to set active profile to default: failed to write active profile state: create temp: open /var/lib/netbird/.2454754093active_profile.json: permission denied
[netbird-proxy] 2026-03-09T08:57:28.555156764Z 2026-03-09T08:57:28.554Z WARN proxy/internal/acme/manager.go:159: prefetch certificate for domain "vaultwarden.expo.anonymised.domain" in 543.099535ms: open /certs/acme_account+key2826026017: permission denied
[netbird-proxy] 2026-03-09T08:57:28.635285192Z 2026/03/09 08:57:28 failed to sufficiently increase receive buffer size (was: 208 kiB, wanted: 7168 kiB, got: 416 kiB). See https://github.com/quic-go/quic-go/wiki/UDP-Buffer-Sizes for details.
[netbird-proxy] 2026-03-09T08:57:28.691372333Z 2026-03-09T08:57:28.691Z WARN client/firewall/create_linux.go:49: failed to create native firewall: create firewall: no firewall manager found. Proceeding with userspace
[netbird-proxy] 2026-03-09T08:57:28.717533416Z 2026-03-09T08:57:28.716Z INFO [account_id: d6ccp71k0sfc7390l750, domain: vaultwarden.expo.anonymised.domain] proxy/internal/roundtrip/netbird.go:317: notified management about tunnel connection
[netbird-proxy] 2026-03-09T08:58:18.046951018Z 2026-03-09T08:58:18.046Z WARN [http-server: https] ./caller_not_available:0: http: TLS handshake error from 119.28.89.249:60204: unknown domain "anonymised.domain"
[netbird-proxy] 2026-03-09T09:04:52.801568090Z 2026-03-09T09:04:52.800Z WARN [peer: sWITQCdchuGDD9+2kgIshxxs+laJJ6lpC8R4fAHJ41o=] client/internal/peer/worker_ice.go:160: ICE Agent is not initialized yet
[netbird-proxy] 2026-03-09T09:10:02.421260161Z 2026-03-09T09:10:02.421Z WARN [peer: sWITQCdchuGDD9+2kgIshxxs+laJJ6lpC8R4fAHJ41o=] client/internal/peer/worker_ice.go:160: ICE Agent is not initialized yet
[netbird-proxy] 2026-03-09T09:18:12.340708367Z 2026-03-09T09:18:12.340Z WARN [peer: sWITQCdchuGDD9+2kgIshxxs+laJJ6lpC8R4fAHJ41o=] client/internal/peer/worker_ice.go:160: ICE Agent is not initialized yet
[netbird-proxy] 2026-03-09T09:18:28.587579081Z 2026-03-09T09:18:28.587Z WARN [http-server: https] ./caller_not_available:0: http: TLS handshake error from 74.7.230.10:48996: unknown domain "crowdsec.anonymised.domain"
[netbird-proxy] 2026-03-09T09:18:28.852785245Z 2026-03-09T09:18:28.852Z WARN [http-server: https] ./caller_not_available:0: http: TLS handshake error from 74.7.230.10:49008: unknown domain "crowdsec.anonymised.domain"
[netbird-proxy] 2026-03-09T09:18:29.105190983Z 2026-03-09T09:18:29.104Z WARN [http-server: https] ./caller_not_available:0: http: TLS handshake error from 74.7.230.10:49012: unknown domain "crowdsec.anonymised.domain"
[netbird-proxy] 2026-03-09T09:23:12.018392323Z 2026-03-09T09:23:12.018Z WARN [http-server: https] ./caller_not_available:0: http: TLS handshake error from 146.88.240.72:26619: acme/autocert: missing server name
[netbird-proxy] 2026-03-09T09:40:46.033739075Z 2026-03-09T09:40:46.033Z WARN [http-server: https] ./caller_not_available:0: http: TLS handshake error from 20.118.217.73:40560: acme/autocert: missing server name
<!-- gh-comment-id:4022332511 --> @donnieD999 commented on GitHub (Mar 9, 2026): I have the same issue as @LordJuice1 , it is not cosmetic, gets stuck on "issuing certificate", and certificate is not issued or written to "/certs" for netbird-proxy. I am using *.expo.<mydomain.com>, it is resolvable externally <img width="2636" height="1510" alt="Image" src="https://github.com/user-attachments/assets/6a0dfd8e-6dd1-4958-9332-8b6fb50d93cc" /> Here is my log from netbrd-proxy from the restart with DEBUG enabled: ``` [netbird-proxy] 2026-03-09T08:55:11.296917176Z 2026-03-09T08:55:11.293Z INFO proxy/cmd/proxy/cmd/root.go:126: configured log level: debug [netbird-proxy] 2026-03-09T08:55:11.296992970Z 2026-03-09T08:55:11.294Z DEBG [TLS_enabled: false, gRPC_address: netbird-server:80] proxy/server.go:387: starting management gRPC client [netbird-proxy] 2026-03-09T08:55:11.297004001Z 2026-03-09T08:55:11.294Z DEBG [expect_continue_timeout: 1s, read_buffer_size: 0, response_header_timeout: 0s, max_idle_conns_per_host: 100, max_inflight: 0, max_idle_conns: 100, disable_compression: false, idle_conn_timeout: 1m30s, tls_handshake_timeout: 10s, write_buffer_size: 0, max_conns_per_host: 0] proxy/internal/roundtrip/transport.go:102: backend transport configuration [netbird-proxy] 2026-03-09T08:55:11.297013638Z 2026-03-09T08:55:11.294Z DEBG [challenge_type: tls-alpn-01, acme_server: https://acme-v02.api.letsencrypt.org/directory] proxy/server.go:425: ACME certificates enabled, configuring certificate manager [netbird-proxy] 2026-03-09T08:55:11.297020588Z 2026-03-09T08:55:11.294Z INFO proxy/internal/acme/locker.go:47: auto-detected cert lock method: flock [netbird-proxy] 2026-03-09T08:55:11.297026639Z 2026-03-09T08:55:11.294Z INFO proxy/internal/acme/locker.go:60: using flock cert locker in /certs [netbird-proxy] 2026-03-09T08:55:11.297032894Z 2026-03-09T08:55:11.295Z DEBG [challenge_type: tls-alpn-01, ServerName: expo.anonymised.domain] proxy/server.go:449: ACME certificate manager configured [netbird-proxy] 2026-03-09T08:55:11.297039203Z 2026-03-09T08:55:11.296Z INFO proxy/server.go:318: PROXY protocol enabled on listener [netbird-proxy] 2026-03-09T08:55:11.297045211Z 2026-03-09T08:55:11.296Z DEBG proxy/server.go:227: starting reverse proxy server on :8443 [netbird-proxy] 2026-03-09T08:55:11.297051228Z 2026-03-09T08:55:11.296Z INFO proxy/internal/health/health.go:293: starting health probe server on 127.0.0.1:8080 [netbird-proxy] 2026-03-09T08:55:11.301292952Z 2026-03-09T08:55:11.296Z DEBG proxy/server.go:546: connecting to management mapping stream [netbird-proxy] 2026-03-09T08:55:11.376464905Z 2026-03-09T08:55:11.376Z INFO ./caller_not_available:0: 2026/03/09 08:55:11 WARNING: [core] [Channel #1 SubChannel #2] grpc: addrConn.createTransport failed to connect to {Addr: "172.30.0.3:80", ServerName: "netbird-server:80", }. Err: connection error: desc = "transport: Error while dialing: dial tcp 172.30.0.3:80: connect: connection refused" [netbird-proxy] 2026-03-09T08:55:11.376692337Z 2026-03-09T08:55:11.376Z WARN proxy/server.go:584: management connection failed, retrying in 755ms: create mapping stream: rpc error: code = Unavailable desc = connection error: desc = "transport: Error while dialing: dial tcp 172.30.0.3:80: connect: connection refused" [netbird-proxy] 2026-03-09T08:55:12.132439979Z 2026-03-09T08:55:12.132Z DEBG proxy/server.go:546: connecting to management mapping stream [netbird-proxy] 2026-03-09T08:55:12.132632603Z 2026-03-09T08:55:12.132Z WARN proxy/server.go:584: management connection failed, retrying in 1.028s: create mapping stream: rpc error: code = Unavailable desc = connection error: desc = "transport: Error while dialing: dial tcp 172.30.0.3:80: connect: connection refused" [netbird-proxy] 2026-03-09T08:55:13.165359060Z 2026-03-09T08:55:13.162Z DEBG proxy/server.go:546: connecting to management mapping stream [netbird-proxy] 2026-03-09T08:55:13.165419441Z 2026-03-09T08:55:13.162Z DEBG proxy/server.go:565: management mapping stream established [netbird-proxy] 2026-03-09T08:55:13.186038074Z 2026-03-09T08:55:13.185Z DEBG proxy/server.go:609: Received mapping update, starting processing [netbird-proxy] 2026-03-09T08:55:13.186092597Z 2026-03-09T08:55:13.185Z DEBG proxy/server.go:611: Processing mapping update completed [netbird-proxy] 2026-03-09T08:55:13.186328723Z 2026-03-09T08:55:13.185Z INFO proxy/server.go:618: Initial mapping sync complete [netbird-proxy] 2026-03-09T08:57:27.898880605Z 2026-03-09T08:57:27.898Z DEBG proxy/server.go:609: Received mapping update, starting processing [netbird-proxy] 2026-03-09T08:57:27.898933369Z 2026-03-09T08:57:27.898Z DEBG [type: UPDATE_TYPE_CREATED, domain: vaultwarden.expo.anonymised.domain, path: [path:"/" target:"https://10.20.40.200/"], id: d6n8mtpk0sfc73dl3r0g] proxy/server.go:631: Processing mapping update [netbird-proxy] 2026-03-09T08:57:27.899090659Z 2026-03-09T08:57:27.898Z DEBG [service_id: d6n8mtpk0sfc73dl3r0g, account_id: d6ccp71k0sfc7390l750] proxy/internal/roundtrip/netbird.go:190: generating WireGuard keypair for new peer [netbird-proxy] 2026-03-09T08:57:27.899367734Z 2026-03-09T08:57:27.899Z DEBG [public_key: daSIYCnNG3gmw6vQ91bPE7mDQhyc8j3XC+Ydhxy/4kk=, account_id: d6ccp71k0sfc7390l750, service_id: d6n8mtpk0sfc73dl3r0g] proxy/internal/roundtrip/netbird.go:202: authenticating new proxy peer with management [netbird-proxy] 2026-03-09T08:57:28.005760981Z 2026-03-09T08:57:28.005Z INFO [account_id: d6ccp71k0sfc7390l750, service_id: d6n8mtpk0sfc73dl3r0g, public_key: daSIYCnNG3gmw6vQ91bPE7mDQhyc8j3XC+Ydhxy/4kk=] proxy/internal/roundtrip/netbird.go:226: proxy peer authenticated successfully with management [netbird-proxy] 2026-03-09T08:57:28.011628431Z 2026-03-09T08:57:28.011Z INFO [domain: vaultwarden.expo.anonymised.domain, account_id: d6ccp71k0sfc7390l750] proxy/internal/roundtrip/netbird.go:175: created new client for account [netbird-proxy] 2026-03-09T08:57:28.011765886Z 2026-03-09T08:57:28.011Z DEBG proxy/server.go:611: Processing mapping update completed [netbird-proxy] 2026-03-09T08:57:28.011818199Z 2026-03-09T08:57:28.011Z INFO proxy/internal/acme/manager.go:140: acquiring cert lock for domain "vaultwarden.expo.anonymised.domain" [netbird-proxy] 2026-03-09T08:57:28.011837764Z 2026-03-09T08:57:28.011Z WARN proxy/internal/acme/manager.go:144: acquire cert lock for domain "vaultwarden.expo.anonymised.domain", proceeding without lock: open lock file /certs/vaultwarden.expo.anonymised.domain.lock: open /certs/vaultwarden.expo.anonymised.domain.lock: permission denied [netbird-proxy] 2026-03-09T08:57:28.451481439Z 2026-03-09T08:57:28.451Z WARN client/internal/profilemanager/service.go:368: failed to get active profile state: failed to set default active profile state: failed to set active profile to default: failed to write active profile state: create temp: open /var/lib/netbird/.2454754093active_profile.json: permission denied [netbird-proxy] 2026-03-09T08:57:28.555156764Z 2026-03-09T08:57:28.554Z WARN proxy/internal/acme/manager.go:159: prefetch certificate for domain "vaultwarden.expo.anonymised.domain" in 543.099535ms: open /certs/acme_account+key2826026017: permission denied [netbird-proxy] 2026-03-09T08:57:28.635285192Z 2026/03/09 08:57:28 failed to sufficiently increase receive buffer size (was: 208 kiB, wanted: 7168 kiB, got: 416 kiB). See https://github.com/quic-go/quic-go/wiki/UDP-Buffer-Sizes for details. [netbird-proxy] 2026-03-09T08:57:28.691372333Z 2026-03-09T08:57:28.691Z WARN client/firewall/create_linux.go:49: failed to create native firewall: create firewall: no firewall manager found. Proceeding with userspace [netbird-proxy] 2026-03-09T08:57:28.717533416Z 2026-03-09T08:57:28.716Z INFO [account_id: d6ccp71k0sfc7390l750, domain: vaultwarden.expo.anonymised.domain] proxy/internal/roundtrip/netbird.go:317: notified management about tunnel connection [netbird-proxy] 2026-03-09T08:58:18.046951018Z 2026-03-09T08:58:18.046Z WARN [http-server: https] ./caller_not_available:0: http: TLS handshake error from 119.28.89.249:60204: unknown domain "anonymised.domain" [netbird-proxy] 2026-03-09T08:55:11.296917176Z 2026-03-09T08:55:11.293Z INFO proxy/cmd/proxy/cmd/root.go:126: configured log level: debug [netbird-proxy] 2026-03-09T08:55:11.296992970Z 2026-03-09T08:55:11.294Z DEBG [TLS_enabled: false, gRPC_address: netbird-server:80] proxy/server.go:387: starting management gRPC client [netbird-proxy] 2026-03-09T08:55:11.297004001Z 2026-03-09T08:55:11.294Z DEBG [expect_continue_timeout: 1s, read_buffer_size: 0, response_header_timeout: 0s, max_idle_conns_per_host: 100, max_inflight: 0, max_idle_conns: 100, disable_compression: false, idle_conn_timeout: 1m30s, tls_handshake_timeout: 10s, write_buffer_size: 0, max_conns_per_host: 0] proxy/internal/roundtrip/transport.go:102: backend transport configuration [netbird-proxy] 2026-03-09T08:55:11.297013638Z 2026-03-09T08:55:11.294Z DEBG [challenge_type: tls-alpn-01, acme_server: https://acme-v02.api.letsencrypt.org/directory] proxy/server.go:425: ACME certificates enabled, configuring certificate manager [netbird-proxy] 2026-03-09T08:55:11.297020588Z 2026-03-09T08:55:11.294Z INFO proxy/internal/acme/locker.go:47: auto-detected cert lock method: flock [netbird-proxy] 2026-03-09T08:55:11.297026639Z 2026-03-09T08:55:11.294Z INFO proxy/internal/acme/locker.go:60: using flock cert locker in /certs [netbird-proxy] 2026-03-09T08:55:11.297032894Z 2026-03-09T08:55:11.295Z DEBG [challenge_type: tls-alpn-01, ServerName: expo.anonymised.domain] proxy/server.go:449: ACME certificate manager configured [netbird-proxy] 2026-03-09T08:55:11.297039203Z 2026-03-09T08:55:11.296Z INFO proxy/server.go:318: PROXY protocol enabled on listener [netbird-proxy] 2026-03-09T08:55:11.297045211Z 2026-03-09T08:55:11.296Z DEBG proxy/server.go:227: starting reverse proxy server on :8443 [netbird-proxy] 2026-03-09T08:55:11.297051228Z 2026-03-09T08:55:11.296Z INFO proxy/internal/health/health.go:293: starting health probe server on 127.0.0.1:8080 [netbird-proxy] 2026-03-09T08:55:11.301292952Z 2026-03-09T08:55:11.296Z DEBG proxy/server.go:546: connecting to management mapping stream [netbird-proxy] 2026-03-09T08:55:11.376464905Z 2026-03-09T08:55:11.376Z INFO ./caller_not_available:0: 2026/03/09 08:55:11 WARNING: [core] [Channel #1 SubChannel #2] grpc: addrConn.createTransport failed to connect to {Addr: "172.30.0.3:80", ServerName: "netbird-server:80", }. Err: connection error: desc = "transport: Error while dialing: dial tcp 172.30.0.3:80: connect: connection refused" [netbird-proxy] 2026-03-09T08:55:11.376692337Z 2026-03-09T08:55:11.376Z WARN proxy/server.go:584: management connection failed, retrying in 755ms: create mapping stream: rpc error: code = Unavailable desc = connection error: desc = "transport: Error while dialing: dial tcp 172.30.0.3:80: connect: connection refused" [netbird-proxy] 2026-03-09T08:55:12.132439979Z 2026-03-09T08:55:12.132Z DEBG proxy/server.go:546: connecting to management mapping stream [netbird-proxy] 2026-03-09T08:55:12.132632603Z 2026-03-09T08:55:12.132Z WARN proxy/server.go:584: management connection failed, retrying in 1.028s: create mapping stream: rpc error: code = Unavailable desc = connection error: desc = "transport: Error while dialing: dial tcp 172.30.0.3:80: connect: connection refused" [netbird-proxy] 2026-03-09T08:55:13.165359060Z 2026-03-09T08:55:13.162Z DEBG proxy/server.go:546: connecting to management mapping stream [netbird-proxy] 2026-03-09T08:55:13.165419441Z 2026-03-09T08:55:13.162Z DEBG proxy/server.go:565: management mapping stream established [netbird-proxy] 2026-03-09T08:55:13.186038074Z 2026-03-09T08:55:13.185Z DEBG proxy/server.go:609: Received mapping update, starting processing [netbird-proxy] 2026-03-09T08:55:13.186092597Z 2026-03-09T08:55:13.185Z DEBG proxy/server.go:611: Processing mapping update completed [netbird-proxy] 2026-03-09T08:55:13.186328723Z 2026-03-09T08:55:13.185Z INFO proxy/server.go:618: Initial mapping sync complete [netbird-proxy] 2026-03-09T08:57:27.898880605Z 2026-03-09T08:57:27.898Z DEBG proxy/server.go:609: Received mapping update, starting processing [netbird-proxy] 2026-03-09T08:57:27.898933369Z 2026-03-09T08:57:27.898Z DEBG [type: UPDATE_TYPE_CREATED, domain: vaultwarden.expo.anonymised.domain, path: [path:"/" target:"https://10.20.40.200/"], id: d6n8mtpk0sfc73dl3r0g] proxy/server.go:631: Processing mapping update [netbird-proxy] 2026-03-09T08:57:27.899090659Z 2026-03-09T08:57:27.898Z DEBG [service_id: d6n8mtpk0sfc73dl3r0g, account_id: d6ccp71k0sfc7390l750] proxy/internal/roundtrip/netbird.go:190: generating WireGuard keypair for new peer [netbird-proxy] 2026-03-09T08:57:27.899367734Z 2026-03-09T08:57:27.899Z DEBG [public_key: daSIYCnNG3gmw6vQ91bPE7mDQhyc8j3XC+Ydhxy/4kk=, account_id: d6ccp71k0sfc7390l750, service_id: d6n8mtpk0sfc73dl3r0g] proxy/internal/roundtrip/netbird.go:202: authenticating new proxy peer with management [netbird-proxy] 2026-03-09T08:57:28.005760981Z 2026-03-09T08:57:28.005Z INFO [account_id: d6ccp71k0sfc7390l750, service_id: d6n8mtpk0sfc73dl3r0g, public_key: daSIYCnNG3gmw6vQ91bPE7mDQhyc8j3XC+Ydhxy/4kk=] proxy/internal/roundtrip/netbird.go:226: proxy peer authenticated successfully with management [netbird-proxy] 2026-03-09T08:57:28.011628431Z 2026-03-09T08:57:28.011Z INFO [domain: vaultwarden.expo.anonymised.domain, account_id: d6ccp71k0sfc7390l750] proxy/internal/roundtrip/netbird.go:175: created new client for account [netbird-proxy] 2026-03-09T08:57:28.011765886Z 2026-03-09T08:57:28.011Z DEBG proxy/server.go:611: Processing mapping update completed [netbird-proxy] 2026-03-09T08:57:28.011818199Z 2026-03-09T08:57:28.011Z INFO proxy/internal/acme/manager.go:140: acquiring cert lock for domain "vaultwarden.expo.anonymised.domain" [netbird-proxy] 2026-03-09T08:57:28.011837764Z 2026-03-09T08:57:28.011Z WARN proxy/internal/acme/manager.go:144: acquire cert lock for domain "vaultwarden.expo.anonymised.domain", proceeding without lock: open lock file /certs/vaultwarden.expo.anonymised.domain.lock: open /certs/vaultwarden.expo.anonymised.domain.lock: permission denied [netbird-proxy] 2026-03-09T08:57:28.451481439Z 2026-03-09T08:57:28.451Z WARN client/internal/profilemanager/service.go:368: failed to get active profile state: failed to set default active profile state: failed to set active profile to default: failed to write active profile state: create temp: open /var/lib/netbird/.2454754093active_profile.json: permission denied [netbird-proxy] 2026-03-09T08:57:28.555156764Z 2026-03-09T08:57:28.554Z WARN proxy/internal/acme/manager.go:159: prefetch certificate for domain "vaultwarden.expo.anonymised.domain" in 543.099535ms: open /certs/acme_account+key2826026017: permission denied [netbird-proxy] 2026-03-09T08:57:28.635285192Z 2026/03/09 08:57:28 failed to sufficiently increase receive buffer size (was: 208 kiB, wanted: 7168 kiB, got: 416 kiB). See https://github.com/quic-go/quic-go/wiki/UDP-Buffer-Sizes for details. [netbird-proxy] 2026-03-09T08:57:28.691372333Z 2026-03-09T08:57:28.691Z WARN client/firewall/create_linux.go:49: failed to create native firewall: create firewall: no firewall manager found. Proceeding with userspace [netbird-proxy] 2026-03-09T08:57:28.717533416Z 2026-03-09T08:57:28.716Z INFO [account_id: d6ccp71k0sfc7390l750, domain: vaultwarden.expo.anonymised.domain] proxy/internal/roundtrip/netbird.go:317: notified management about tunnel connection [netbird-proxy] 2026-03-09T08:58:18.046951018Z 2026-03-09T08:58:18.046Z WARN [http-server: https] ./caller_not_available:0: http: TLS handshake error from 119.28.89.249:60204: unknown domain "anonymised.domain" [netbird-proxy] 2026-03-09T09:04:52.801568090Z 2026-03-09T09:04:52.800Z WARN [peer: sWITQCdchuGDD9+2kgIshxxs+laJJ6lpC8R4fAHJ41o=] client/internal/peer/worker_ice.go:160: ICE Agent is not initialized yet [netbird-proxy] 2026-03-09T08:55:11.296917176Z 2026-03-09T08:55:11.293Z INFO proxy/cmd/proxy/cmd/root.go:126: configured log level: debug [netbird-proxy] 2026-03-09T08:55:11.296992970Z 2026-03-09T08:55:11.294Z DEBG [TLS_enabled: false, gRPC_address: netbird-server:80] proxy/server.go:387: starting management gRPC client [netbird-proxy] 2026-03-09T08:55:11.297004001Z 2026-03-09T08:55:11.294Z DEBG [expect_continue_timeout: 1s, read_buffer_size: 0, response_header_timeout: 0s, max_idle_conns_per_host: 100, max_inflight: 0, max_idle_conns: 100, disable_compression: false, idle_conn_timeout: 1m30s, tls_handshake_timeout: 10s, write_buffer_size: 0, max_conns_per_host: 0] proxy/internal/roundtrip/transport.go:102: backend transport configuration [netbird-proxy] 2026-03-09T08:55:11.297013638Z 2026-03-09T08:55:11.294Z DEBG [challenge_type: tls-alpn-01, acme_server: https://acme-v02.api.letsencrypt.org/directory] proxy/server.go:425: ACME certificates enabled, configuring certificate manager [netbird-proxy] 2026-03-09T08:55:11.297020588Z 2026-03-09T08:55:11.294Z INFO proxy/internal/acme/locker.go:47: auto-detected cert lock method: flock [netbird-proxy] 2026-03-09T08:55:11.297026639Z 2026-03-09T08:55:11.294Z INFO proxy/internal/acme/locker.go:60: using flock cert locker in /certs [netbird-proxy] 2026-03-09T08:55:11.297032894Z 2026-03-09T08:55:11.295Z DEBG [challenge_type: tls-alpn-01, ServerName: expo.anonymised.domain] proxy/server.go:449: ACME certificate manager configured [netbird-proxy] 2026-03-09T08:55:11.297039203Z 2026-03-09T08:55:11.296Z INFO proxy/server.go:318: PROXY protocol enabled on listener [netbird-proxy] 2026-03-09T08:55:11.297045211Z 2026-03-09T08:55:11.296Z DEBG proxy/server.go:227: starting reverse proxy server on :8443 [netbird-proxy] 2026-03-09T08:55:11.297051228Z 2026-03-09T08:55:11.296Z INFO proxy/internal/health/health.go:293: starting health probe server on 127.0.0.1:8080 [netbird-proxy] 2026-03-09T08:55:11.301292952Z 2026-03-09T08:55:11.296Z DEBG proxy/server.go:546: connecting to management mapping stream [netbird-proxy] 2026-03-09T08:55:11.376464905Z 2026-03-09T08:55:11.376Z INFO ./caller_not_available:0: 2026/03/09 08:55:11 WARNING: [core] [Channel #1 SubChannel #2] grpc: addrConn.createTransport failed to connect to {Addr: "172.30.0.3:80", ServerName: "netbird-server:80", }. Err: connection error: desc = "transport: Error while dialing: dial tcp 172.30.0.3:80: connect: connection refused" [netbird-proxy] 2026-03-09T08:55:11.376692337Z 2026-03-09T08:55:11.376Z WARN proxy/server.go:584: management connection failed, retrying in 755ms: create mapping stream: rpc error: code = Unavailable desc = connection error: desc = "transport: Error while dialing: dial tcp 172.30.0.3:80: connect: connection refused" [netbird-proxy] 2026-03-09T08:55:12.132439979Z 2026-03-09T08:55:12.132Z DEBG proxy/server.go:546: connecting to management mapping stream [netbird-proxy] 2026-03-09T08:55:12.132632603Z 2026-03-09T08:55:12.132Z WARN proxy/server.go:584: management connection failed, retrying in 1.028s: create mapping stream: rpc error: code = Unavailable desc = connection error: desc = "transport: Error while dialing: dial tcp 172.30.0.3:80: connect: connection refused" [netbird-proxy] 2026-03-09T08:55:13.165359060Z 2026-03-09T08:55:13.162Z DEBG proxy/server.go:546: connecting to management mapping stream [netbird-proxy] 2026-03-09T08:55:13.165419441Z 2026-03-09T08:55:13.162Z DEBG proxy/server.go:565: management mapping stream established [netbird-proxy] 2026-03-09T08:55:13.186038074Z 2026-03-09T08:55:13.185Z DEBG proxy/server.go:609: Received mapping update, starting processing [netbird-proxy] 2026-03-09T08:55:13.186092597Z 2026-03-09T08:55:13.185Z DEBG proxy/server.go:611: Processing mapping update completed [netbird-proxy] 2026-03-09T08:55:13.186328723Z 2026-03-09T08:55:13.185Z INFO proxy/server.go:618: Initial mapping sync complete [netbird-proxy] 2026-03-09T08:57:27.898880605Z 2026-03-09T08:57:27.898Z DEBG proxy/server.go:609: Received mapping update, starting processing [netbird-proxy] 2026-03-09T08:57:27.898933369Z 2026-03-09T08:57:27.898Z DEBG [type: UPDATE_TYPE_CREATED, domain: vaultwarden.expo.anonymised.domain, path: [path:"/" target:"https://10.20.40.200/"], id: d6n8mtpk0sfc73dl3r0g] proxy/server.go:631: Processing mapping update [netbird-proxy] 2026-03-09T08:57:27.899090659Z 2026-03-09T08:57:27.898Z DEBG [service_id: d6n8mtpk0sfc73dl3r0g, account_id: d6ccp71k0sfc7390l750] proxy/internal/roundtrip/netbird.go:190: generating WireGuard keypair for new peer [netbird-proxy] 2026-03-09T08:57:27.899367734Z 2026-03-09T08:57:27.899Z DEBG [public_key: daSIYCnNG3gmw6vQ91bPE7mDQhyc8j3XC+Ydhxy/4kk=, account_id: d6ccp71k0sfc7390l750, service_id: d6n8mtpk0sfc73dl3r0g] proxy/internal/roundtrip/netbird.go:202: authenticating new proxy peer with management [netbird-proxy] 2026-03-09T08:57:28.005760981Z 2026-03-09T08:57:28.005Z INFO [account_id: d6ccp71k0sfc7390l750, service_id: d6n8mtpk0sfc73dl3r0g, public_key: daSIYCnNG3gmw6vQ91bPE7mDQhyc8j3XC+Ydhxy/4kk=] proxy/internal/roundtrip/netbird.go:226: proxy peer authenticated successfully with management [netbird-proxy] 2026-03-09T08:57:28.011628431Z 2026-03-09T08:57:28.011Z INFO [domain: vaultwarden.expo.anonymised.domain, account_id: d6ccp71k0sfc7390l750] proxy/internal/roundtrip/netbird.go:175: created new client for account [netbird-proxy] 2026-03-09T08:57:28.011765886Z 2026-03-09T08:57:28.011Z DEBG proxy/server.go:611: Processing mapping update completed [netbird-proxy] 2026-03-09T08:57:28.011818199Z 2026-03-09T08:57:28.011Z INFO proxy/internal/acme/manager.go:140: acquiring cert lock for domain "vaultwarden.expo.anonymised.domain" [netbird-proxy] 2026-03-09T08:57:28.011837764Z 2026-03-09T08:57:28.011Z WARN proxy/internal/acme/manager.go:144: acquire cert lock for domain "vaultwarden.expo.anonymised.domain", proceeding without lock: open lock file /certs/vaultwarden.expo.anonymised.domain.lock: open /certs/vaultwarden.expo.anonymised.domain.lock: permission denied [netbird-proxy] 2026-03-09T08:57:28.451481439Z 2026-03-09T08:57:28.451Z WARN client/internal/profilemanager/service.go:368: failed to get active profile state: failed to set default active profile state: failed to set active profile to default: failed to write active profile state: create temp: open /var/lib/netbird/.2454754093active_profile.json: permission denied [netbird-proxy] 2026-03-09T08:57:28.555156764Z 2026-03-09T08:57:28.554Z WARN proxy/internal/acme/manager.go:159: prefetch certificate for domain "vaultwarden.expo.anonymised.domain" in 543.099535ms: open /certs/acme_account+key2826026017: permission denied [netbird-proxy] 2026-03-09T08:57:28.635285192Z 2026/03/09 08:57:28 failed to sufficiently increase receive buffer size (was: 208 kiB, wanted: 7168 kiB, got: 416 kiB). See https://github.com/quic-go/quic-go/wiki/UDP-Buffer-Sizes for details. [netbird-proxy] 2026-03-09T08:57:28.691372333Z 2026-03-09T08:57:28.691Z WARN client/firewall/create_linux.go:49: failed to create native firewall: create firewall: no firewall manager found. Proceeding with userspace [netbird-proxy] 2026-03-09T08:57:28.717533416Z 2026-03-09T08:57:28.716Z INFO [account_id: d6ccp71k0sfc7390l750, domain: vaultwarden.expo.anonymised.domain] proxy/internal/roundtrip/netbird.go:317: notified management about tunnel connection [netbird-proxy] 2026-03-09T08:58:18.046951018Z 2026-03-09T08:58:18.046Z WARN [http-server: https] ./caller_not_available:0: http: TLS handshake error from 119.28.89.249:60204: unknown domain "anonymised.domain" [netbird-proxy] 2026-03-09T09:04:52.801568090Z 2026-03-09T09:04:52.800Z WARN [peer: sWITQCdchuGDD9+2kgIshxxs+laJJ6lpC8R4fAHJ41o=] client/internal/peer/worker_ice.go:160: ICE Agent is not initialized yet [netbird-proxy] 2026-03-09T09:10:02.421260161Z 2026-03-09T09:10:02.421Z WARN [peer: sWITQCdchuGDD9+2kgIshxxs+laJJ6lpC8R4fAHJ41o=] client/internal/peer/worker_ice.go:160: ICE Agent is not initialized yet [netbird-proxy] 2026-03-09T08:55:11.296917176Z 2026-03-09T08:55:11.293Z INFO proxy/cmd/proxy/cmd/root.go:126: configured log level: debug [netbird-proxy] 2026-03-09T08:55:11.296992970Z 2026-03-09T08:55:11.294Z DEBG [TLS_enabled: false, gRPC_address: netbird-server:80] proxy/server.go:387: starting management gRPC client [netbird-proxy] 2026-03-09T08:55:11.297004001Z 2026-03-09T08:55:11.294Z DEBG [expect_continue_timeout: 1s, read_buffer_size: 0, response_header_timeout: 0s, max_idle_conns_per_host: 100, max_inflight: 0, max_idle_conns: 100, disable_compression: false, idle_conn_timeout: 1m30s, tls_handshake_timeout: 10s, write_buffer_size: 0, max_conns_per_host: 0] proxy/internal/roundtrip/transport.go:102: backend transport configuration [netbird-proxy] 2026-03-09T08:55:11.297013638Z 2026-03-09T08:55:11.294Z DEBG [challenge_type: tls-alpn-01, acme_server: https://acme-v02.api.letsencrypt.org/directory] proxy/server.go:425: ACME certificates enabled, configuring certificate manager [netbird-proxy] 2026-03-09T08:55:11.297020588Z 2026-03-09T08:55:11.294Z INFO proxy/internal/acme/locker.go:47: auto-detected cert lock method: flock [netbird-proxy] 2026-03-09T08:55:11.297026639Z 2026-03-09T08:55:11.294Z INFO proxy/internal/acme/locker.go:60: using flock cert locker in /certs [netbird-proxy] 2026-03-09T08:55:11.297032894Z 2026-03-09T08:55:11.295Z DEBG [challenge_type: tls-alpn-01, ServerName: expo.anonymised.domain] proxy/server.go:449: ACME certificate manager configured [netbird-proxy] 2026-03-09T08:55:11.297039203Z 2026-03-09T08:55:11.296Z INFO proxy/server.go:318: PROXY protocol enabled on listener [netbird-proxy] 2026-03-09T08:55:11.297045211Z 2026-03-09T08:55:11.296Z DEBG proxy/server.go:227: starting reverse proxy server on :8443 [netbird-proxy] 2026-03-09T08:55:11.297051228Z 2026-03-09T08:55:11.296Z INFO proxy/internal/health/health.go:293: starting health probe server on 127.0.0.1:8080 [netbird-proxy] 2026-03-09T08:55:11.301292952Z 2026-03-09T08:55:11.296Z DEBG proxy/server.go:546: connecting to management mapping stream [netbird-proxy] 2026-03-09T08:55:11.376464905Z 2026-03-09T08:55:11.376Z INFO ./caller_not_available:0: 2026/03/09 08:55:11 WARNING: [core] [Channel #1 SubChannel #2] grpc: addrConn.createTransport failed to connect to {Addr: "172.30.0.3:80", ServerName: "netbird-server:80", }. Err: connection error: desc = "transport: Error while dialing: dial tcp 172.30.0.3:80: connect: connection refused" [netbird-proxy] 2026-03-09T08:55:11.376692337Z 2026-03-09T08:55:11.376Z WARN proxy/server.go:584: management connection failed, retrying in 755ms: create mapping stream: rpc error: code = Unavailable desc = connection error: desc = "transport: Error while dialing: dial tcp 172.30.0.3:80: connect: connection refused" [netbird-proxy] 2026-03-09T08:55:12.132439979Z 2026-03-09T08:55:12.132Z DEBG proxy/server.go:546: connecting to management mapping stream [netbird-proxy] 2026-03-09T08:55:12.132632603Z 2026-03-09T08:55:12.132Z WARN proxy/server.go:584: management connection failed, retrying in 1.028s: create mapping stream: rpc error: code = Unavailable desc = connection error: desc = "transport: Error while dialing: dial tcp 172.30.0.3:80: connect: connection refused" [netbird-proxy] 2026-03-09T08:55:13.165359060Z 2026-03-09T08:55:13.162Z DEBG proxy/server.go:546: connecting to management mapping stream [netbird-proxy] 2026-03-09T08:55:13.165419441Z 2026-03-09T08:55:13.162Z DEBG proxy/server.go:565: management mapping stream established [netbird-proxy] 2026-03-09T08:55:13.186038074Z 2026-03-09T08:55:13.185Z DEBG proxy/server.go:609: Received mapping update, starting processing [netbird-proxy] 2026-03-09T08:55:13.186092597Z 2026-03-09T08:55:13.185Z DEBG proxy/server.go:611: Processing mapping update completed [netbird-proxy] 2026-03-09T08:55:13.186328723Z 2026-03-09T08:55:13.185Z INFO proxy/server.go:618: Initial mapping sync complete [netbird-proxy] 2026-03-09T08:57:27.898880605Z 2026-03-09T08:57:27.898Z DEBG proxy/server.go:609: Received mapping update, starting processing [netbird-proxy] 2026-03-09T08:57:27.898933369Z 2026-03-09T08:57:27.898Z DEBG [type: UPDATE_TYPE_CREATED, domain: vaultwarden.expo.anonymised.domain, path: [path:"/" target:"https://10.20.40.200/"], id: d6n8mtpk0sfc73dl3r0g] proxy/server.go:631: Processing mapping update [netbird-proxy] 2026-03-09T08:57:27.899090659Z 2026-03-09T08:57:27.898Z DEBG [service_id: d6n8mtpk0sfc73dl3r0g, account_id: d6ccp71k0sfc7390l750] proxy/internal/roundtrip/netbird.go:190: generating WireGuard keypair for new peer [netbird-proxy] 2026-03-09T08:57:27.899367734Z 2026-03-09T08:57:27.899Z DEBG [public_key: daSIYCnNG3gmw6vQ91bPE7mDQhyc8j3XC+Ydhxy/4kk=, account_id: d6ccp71k0sfc7390l750, service_id: d6n8mtpk0sfc73dl3r0g] proxy/internal/roundtrip/netbird.go:202: authenticating new proxy peer with management [netbird-proxy] 2026-03-09T08:57:28.005760981Z 2026-03-09T08:57:28.005Z INFO [account_id: d6ccp71k0sfc7390l750, service_id: d6n8mtpk0sfc73dl3r0g, public_key: daSIYCnNG3gmw6vQ91bPE7mDQhyc8j3XC+Ydhxy/4kk=] proxy/internal/roundtrip/netbird.go:226: proxy peer authenticated successfully with management [netbird-proxy] 2026-03-09T08:57:28.011628431Z 2026-03-09T08:57:28.011Z INFO [domain: vaultwarden.expo.anonymised.domain, account_id: d6ccp71k0sfc7390l750] proxy/internal/roundtrip/netbird.go:175: created new client for account [netbird-proxy] 2026-03-09T08:57:28.011765886Z 2026-03-09T08:57:28.011Z DEBG proxy/server.go:611: Processing mapping update completed [netbird-proxy] 2026-03-09T08:57:28.011818199Z 2026-03-09T08:57:28.011Z INFO proxy/internal/acme/manager.go:140: acquiring cert lock for domain "vaultwarden.expo.anonymised.domain" [netbird-proxy] 2026-03-09T08:57:28.011837764Z 2026-03-09T08:57:28.011Z WARN proxy/internal/acme/manager.go:144: acquire cert lock for domain "vaultwarden.expo.anonymised.domain", proceeding without lock: open lock file /certs/vaultwarden.expo.anonymised.domain.lock: open /certs/vaultwarden.expo.anonymised.domain.lock: permission denied [netbird-proxy] 2026-03-09T08:57:28.451481439Z 2026-03-09T08:57:28.451Z WARN client/internal/profilemanager/service.go:368: failed to get active profile state: failed to set default active profile state: failed to set active profile to default: failed to write active profile state: create temp: open /var/lib/netbird/.2454754093active_profile.json: permission denied [netbird-proxy] 2026-03-09T08:57:28.555156764Z 2026-03-09T08:57:28.554Z WARN proxy/internal/acme/manager.go:159: prefetch certificate for domain "vaultwarden.expo.anonymised.domain" in 543.099535ms: open /certs/acme_account+key2826026017: permission denied [netbird-proxy] 2026-03-09T08:57:28.635285192Z 2026/03/09 08:57:28 failed to sufficiently increase receive buffer size (was: 208 kiB, wanted: 7168 kiB, got: 416 kiB). See https://github.com/quic-go/quic-go/wiki/UDP-Buffer-Sizes for details. [netbird-proxy] 2026-03-09T08:57:28.691372333Z 2026-03-09T08:57:28.691Z WARN client/firewall/create_linux.go:49: failed to create native firewall: create firewall: no firewall manager found. Proceeding with userspace [netbird-proxy] 2026-03-09T08:57:28.717533416Z 2026-03-09T08:57:28.716Z INFO [account_id: d6ccp71k0sfc7390l750, domain: vaultwarden.expo.anonymised.domain] proxy/internal/roundtrip/netbird.go:317: notified management about tunnel connection [netbird-proxy] 2026-03-09T08:58:18.046951018Z 2026-03-09T08:58:18.046Z WARN [http-server: https] ./caller_not_available:0: http: TLS handshake error from 119.28.89.249:60204: unknown domain "anonymised.domain" [netbird-proxy] 2026-03-09T09:04:52.801568090Z 2026-03-09T09:04:52.800Z WARN [peer: sWITQCdchuGDD9+2kgIshxxs+laJJ6lpC8R4fAHJ41o=] client/internal/peer/worker_ice.go:160: ICE Agent is not initialized yet [netbird-proxy] 2026-03-09T09:10:02.421260161Z 2026-03-09T09:10:02.421Z WARN [peer: sWITQCdchuGDD9+2kgIshxxs+laJJ6lpC8R4fAHJ41o=] client/internal/peer/worker_ice.go:160: ICE Agent is not initialized yet [netbird-proxy] 2026-03-09T09:18:12.340708367Z 2026-03-09T09:18:12.340Z WARN [peer: sWITQCdchuGDD9+2kgIshxxs+laJJ6lpC8R4fAHJ41o=] client/internal/peer/worker_ice.go:160: ICE Agent is not initialized yet [netbird-proxy] 2026-03-09T09:18:28.587579081Z 2026-03-09T09:18:28.587Z WARN [http-server: https] ./caller_not_available:0: http: TLS handshake error from 74.7.230.10:48996: unknown domain "crowdsec.anonymised.domain" [netbird-proxy] 2026-03-09T09:18:28.852785245Z 2026-03-09T09:18:28.852Z WARN [http-server: https] ./caller_not_available:0: http: TLS handshake error from 74.7.230.10:49008: unknown domain "crowdsec.anonymised.domain" [netbird-proxy] 2026-03-09T09:18:29.105190983Z 2026-03-09T09:18:29.104Z WARN [http-server: https] ./caller_not_available:0: http: TLS handshake error from 74.7.230.10:49012: unknown domain "crowdsec.anonymised.domain" [netbird-proxy] 2026-03-09T09:23:12.018392323Z 2026-03-09T09:23:12.018Z WARN [http-server: https] ./caller_not_available:0: http: TLS handshake error from 146.88.240.72:26619: acme/autocert: missing server name [netbird-proxy] 2026-03-09T08:55:11.296917176Z 2026-03-09T08:55:11.293Z INFO proxy/cmd/proxy/cmd/root.go:126: configured log level: debug [netbird-proxy] 2026-03-09T08:55:11.296992970Z 2026-03-09T08:55:11.294Z DEBG [TLS_enabled: false, gRPC_address: netbird-server:80] proxy/server.go:387: starting management gRPC client [netbird-proxy] 2026-03-09T08:55:11.297004001Z 2026-03-09T08:55:11.294Z DEBG [expect_continue_timeout: 1s, read_buffer_size: 0, response_header_timeout: 0s, max_idle_conns_per_host: 100, max_inflight: 0, max_idle_conns: 100, disable_compression: false, idle_conn_timeout: 1m30s, tls_handshake_timeout: 10s, write_buffer_size: 0, max_conns_per_host: 0] proxy/internal/roundtrip/transport.go:102: backend transport configuration [netbird-proxy] 2026-03-09T08:55:11.297013638Z 2026-03-09T08:55:11.294Z DEBG [challenge_type: tls-alpn-01, acme_server: https://acme-v02.api.letsencrypt.org/directory] proxy/server.go:425: ACME certificates enabled, configuring certificate manager [netbird-proxy] 2026-03-09T08:55:11.297020588Z 2026-03-09T08:55:11.294Z INFO proxy/internal/acme/locker.go:47: auto-detected cert lock method: flock [netbird-proxy] 2026-03-09T08:55:11.297026639Z 2026-03-09T08:55:11.294Z INFO proxy/internal/acme/locker.go:60: using flock cert locker in /certs [netbird-proxy] 2026-03-09T08:55:11.297032894Z 2026-03-09T08:55:11.295Z DEBG [challenge_type: tls-alpn-01, ServerName: expo.anonymised.domain] proxy/server.go:449: ACME certificate manager configured [netbird-proxy] 2026-03-09T08:55:11.297039203Z 2026-03-09T08:55:11.296Z INFO proxy/server.go:318: PROXY protocol enabled on listener [netbird-proxy] 2026-03-09T08:55:11.297045211Z 2026-03-09T08:55:11.296Z DEBG proxy/server.go:227: starting reverse proxy server on :8443 [netbird-proxy] 2026-03-09T08:55:11.297051228Z 2026-03-09T08:55:11.296Z INFO proxy/internal/health/health.go:293: starting health probe server on 127.0.0.1:8080 [netbird-proxy] 2026-03-09T08:55:11.301292952Z 2026-03-09T08:55:11.296Z DEBG proxy/server.go:546: connecting to management mapping stream [netbird-proxy] 2026-03-09T08:55:11.376464905Z 2026-03-09T08:55:11.376Z INFO ./caller_not_available:0: 2026/03/09 08:55:11 WARNING: [core] [Channel #1 SubChannel #2] grpc: addrConn.createTransport failed to connect to {Addr: "172.30.0.3:80", ServerName: "netbird-server:80", }. Err: connection error: desc = "transport: Error while dialing: dial tcp 172.30.0.3:80: connect: connection refused" [netbird-proxy] 2026-03-09T08:55:11.376692337Z 2026-03-09T08:55:11.376Z WARN proxy/server.go:584: management connection failed, retrying in 755ms: create mapping stream: rpc error: code = Unavailable desc = connection error: desc = "transport: Error while dialing: dial tcp 172.30.0.3:80: connect: connection refused" [netbird-proxy] 2026-03-09T08:55:12.132439979Z 2026-03-09T08:55:12.132Z DEBG proxy/server.go:546: connecting to management mapping stream [netbird-proxy] 2026-03-09T08:55:12.132632603Z 2026-03-09T08:55:12.132Z WARN proxy/server.go:584: management connection failed, retrying in 1.028s: create mapping stream: rpc error: code = Unavailable desc = connection error: desc = "transport: Error while dialing: dial tcp 172.30.0.3:80: connect: connection refused" [netbird-proxy] 2026-03-09T08:55:13.165359060Z 2026-03-09T08:55:13.162Z DEBG proxy/server.go:546: connecting to management mapping stream [netbird-proxy] 2026-03-09T08:55:13.165419441Z 2026-03-09T08:55:13.162Z DEBG proxy/server.go:565: management mapping stream established [netbird-proxy] 2026-03-09T08:55:13.186038074Z 2026-03-09T08:55:13.185Z DEBG proxy/server.go:609: Received mapping update, starting processing [netbird-proxy] 2026-03-09T08:55:13.186092597Z 2026-03-09T08:55:13.185Z DEBG proxy/server.go:611: Processing mapping update completed [netbird-proxy] 2026-03-09T08:55:13.186328723Z 2026-03-09T08:55:13.185Z INFO proxy/server.go:618: Initial mapping sync complete [netbird-proxy] 2026-03-09T08:57:27.898880605Z 2026-03-09T08:57:27.898Z DEBG proxy/server.go:609: Received mapping update, starting processing [netbird-proxy] 2026-03-09T08:57:27.898933369Z 2026-03-09T08:57:27.898Z DEBG [type: UPDATE_TYPE_CREATED, domain: vaultwarden.expo.anonymised.domain, path: [path:"/" target:"https://10.20.40.200/"], id: d6n8mtpk0sfc73dl3r0g] proxy/server.go:631: Processing mapping update [netbird-proxy] 2026-03-09T08:57:27.899090659Z 2026-03-09T08:57:27.898Z DEBG [service_id: d6n8mtpk0sfc73dl3r0g, account_id: d6ccp71k0sfc7390l750] proxy/internal/roundtrip/netbird.go:190: generating WireGuard keypair for new peer [netbird-proxy] 2026-03-09T08:57:27.899367734Z 2026-03-09T08:57:27.899Z DEBG [public_key: daSIYCnNG3gmw6vQ91bPE7mDQhyc8j3XC+Ydhxy/4kk=, account_id: d6ccp71k0sfc7390l750, service_id: d6n8mtpk0sfc73dl3r0g] proxy/internal/roundtrip/netbird.go:202: authenticating new proxy peer with management [netbird-proxy] 2026-03-09T08:57:28.005760981Z 2026-03-09T08:57:28.005Z INFO [account_id: d6ccp71k0sfc7390l750, service_id: d6n8mtpk0sfc73dl3r0g, public_key: daSIYCnNG3gmw6vQ91bPE7mDQhyc8j3XC+Ydhxy/4kk=] proxy/internal/roundtrip/netbird.go:226: proxy peer authenticated successfully with management [netbird-proxy] 2026-03-09T08:57:28.011628431Z 2026-03-09T08:57:28.011Z INFO [domain: vaultwarden.expo.anonymised.domain, account_id: d6ccp71k0sfc7390l750] proxy/internal/roundtrip/netbird.go:175: created new client for account [netbird-proxy] 2026-03-09T08:57:28.011765886Z 2026-03-09T08:57:28.011Z DEBG proxy/server.go:611: Processing mapping update completed [netbird-proxy] 2026-03-09T08:57:28.011818199Z 2026-03-09T08:57:28.011Z INFO proxy/internal/acme/manager.go:140: acquiring cert lock for domain "vaultwarden.expo.anonymised.domain" [netbird-proxy] 2026-03-09T08:57:28.011837764Z 2026-03-09T08:57:28.011Z WARN proxy/internal/acme/manager.go:144: acquire cert lock for domain "vaultwarden.expo.anonymised.domain", proceeding without lock: open lock file /certs/vaultwarden.expo.anonymised.domain.lock: open /certs/vaultwarden.expo.anonymised.domain.lock: permission denied [netbird-proxy] 2026-03-09T08:57:28.451481439Z 2026-03-09T08:57:28.451Z WARN client/internal/profilemanager/service.go:368: failed to get active profile state: failed to set default active profile state: failed to set active profile to default: failed to write active profile state: create temp: open /var/lib/netbird/.2454754093active_profile.json: permission denied [netbird-proxy] 2026-03-09T08:57:28.555156764Z 2026-03-09T08:57:28.554Z WARN proxy/internal/acme/manager.go:159: prefetch certificate for domain "vaultwarden.expo.anonymised.domain" in 543.099535ms: open /certs/acme_account+key2826026017: permission denied [netbird-proxy] 2026-03-09T08:57:28.635285192Z 2026/03/09 08:57:28 failed to sufficiently increase receive buffer size (was: 208 kiB, wanted: 7168 kiB, got: 416 kiB). See https://github.com/quic-go/quic-go/wiki/UDP-Buffer-Sizes for details. [netbird-proxy] 2026-03-09T08:57:28.691372333Z 2026-03-09T08:57:28.691Z WARN client/firewall/create_linux.go:49: failed to create native firewall: create firewall: no firewall manager found. Proceeding with userspace [netbird-proxy] 2026-03-09T08:57:28.717533416Z 2026-03-09T08:57:28.716Z INFO [account_id: d6ccp71k0sfc7390l750, domain: vaultwarden.expo.anonymised.domain] proxy/internal/roundtrip/netbird.go:317: notified management about tunnel connection [netbird-proxy] 2026-03-09T08:58:18.046951018Z 2026-03-09T08:58:18.046Z WARN [http-server: https] ./caller_not_available:0: http: TLS handshake error from 119.28.89.249:60204: unknown domain "anonymised.domain" [netbird-proxy] 2026-03-09T09:04:52.801568090Z 2026-03-09T09:04:52.800Z WARN [peer: sWITQCdchuGDD9+2kgIshxxs+laJJ6lpC8R4fAHJ41o=] client/internal/peer/worker_ice.go:160: ICE Agent is not initialized yet [netbird-proxy] 2026-03-09T09:10:02.421260161Z 2026-03-09T09:10:02.421Z WARN [peer: sWITQCdchuGDD9+2kgIshxxs+laJJ6lpC8R4fAHJ41o=] client/internal/peer/worker_ice.go:160: ICE Agent is not initialized yet [netbird-proxy] 2026-03-09T09:18:12.340708367Z 2026-03-09T09:18:12.340Z WARN [peer: sWITQCdchuGDD9+2kgIshxxs+laJJ6lpC8R4fAHJ41o=] client/internal/peer/worker_ice.go:160: ICE Agent is not initialized yet [netbird-proxy] 2026-03-09T09:18:28.587579081Z 2026-03-09T09:18:28.587Z WARN [http-server: https] ./caller_not_available:0: http: TLS handshake error from 74.7.230.10:48996: unknown domain "crowdsec.anonymised.domain" [netbird-proxy] 2026-03-09T09:18:28.852785245Z 2026-03-09T09:18:28.852Z WARN [http-server: https] ./caller_not_available:0: http: TLS handshake error from 74.7.230.10:49008: unknown domain "crowdsec.anonymised.domain" [netbird-proxy] 2026-03-09T09:18:29.105190983Z 2026-03-09T09:18:29.104Z WARN [http-server: https] ./caller_not_available:0: http: TLS handshake error from 74.7.230.10:49012: unknown domain "crowdsec.anonymised.domain" [netbird-proxy] 2026-03-09T09:23:12.018392323Z 2026-03-09T09:23:12.018Z WARN [http-server: https] ./caller_not_available:0: http: TLS handshake error from 146.88.240.72:26619: acme/autocert: missing server name [netbird-proxy] 2026-03-09T08:55:11.296917176Z 2026-03-09T08:55:11.293Z INFO proxy/cmd/proxy/cmd/root.go:126: configured log level: debug [netbird-proxy] 2026-03-09T08:55:11.296992970Z 2026-03-09T08:55:11.294Z DEBG [TLS_enabled: false, gRPC_address: netbird-server:80] proxy/server.go:387: starting management gRPC client [netbird-proxy] 2026-03-09T08:55:11.297004001Z 2026-03-09T08:55:11.294Z DEBG [expect_continue_timeout: 1s, read_buffer_size: 0, response_header_timeout: 0s, max_idle_conns_per_host: 100, max_inflight: 0, max_idle_conns: 100, disable_compression: false, idle_conn_timeout: 1m30s, tls_handshake_timeout: 10s, write_buffer_size: 0, max_conns_per_host: 0] proxy/internal/roundtrip/transport.go:102: backend transport configuration [netbird-proxy] 2026-03-09T08:55:11.297013638Z 2026-03-09T08:55:11.294Z DEBG [challenge_type: tls-alpn-01, acme_server: https://acme-v02.api.letsencrypt.org/directory] proxy/server.go:425: ACME certificates enabled, configuring certificate manager [netbird-proxy] 2026-03-09T08:55:11.297020588Z 2026-03-09T08:55:11.294Z INFO proxy/internal/acme/locker.go:47: auto-detected cert lock method: flock [netbird-proxy] 2026-03-09T08:55:11.297026639Z 2026-03-09T08:55:11.294Z INFO proxy/internal/acme/locker.go:60: using flock cert locker in /certs [netbird-proxy] 2026-03-09T08:55:11.297032894Z 2026-03-09T08:55:11.295Z DEBG [challenge_type: tls-alpn-01, ServerName: expo.anonymised.domain] proxy/server.go:449: ACME certificate manager configured [netbird-proxy] 2026-03-09T08:55:11.297039203Z 2026-03-09T08:55:11.296Z INFO proxy/server.go:318: PROXY protocol enabled on listener [netbird-proxy] 2026-03-09T08:55:11.297045211Z 2026-03-09T08:55:11.296Z DEBG proxy/server.go:227: starting reverse proxy server on :8443 [netbird-proxy] 2026-03-09T08:55:11.297051228Z 2026-03-09T08:55:11.296Z INFO proxy/internal/health/health.go:293: starting health probe server on 127.0.0.1:8080 [netbird-proxy] 2026-03-09T08:55:11.301292952Z 2026-03-09T08:55:11.296Z DEBG proxy/server.go:546: connecting to management mapping stream [netbird-proxy] 2026-03-09T08:55:11.376464905Z 2026-03-09T08:55:11.376Z INFO ./caller_not_available:0: 2026/03/09 08:55:11 WARNING: [core] [Channel #1 SubChannel #2] grpc: addrConn.createTransport failed to connect to {Addr: "172.30.0.3:80", ServerName: "netbird-server:80", }. Err: connection error: desc = "transport: Error while dialing: dial tcp 172.30.0.3:80: connect: connection refused" [netbird-proxy] 2026-03-09T08:55:11.376692337Z 2026-03-09T08:55:11.376Z WARN proxy/server.go:584: management connection failed, retrying in 755ms: create mapping stream: rpc error: code = Unavailable desc = connection error: desc = "transport: Error while dialing: dial tcp 172.30.0.3:80: connect: connection refused" [netbird-proxy] 2026-03-09T08:55:12.132439979Z 2026-03-09T08:55:12.132Z DEBG proxy/server.go:546: connecting to management mapping stream [netbird-proxy] 2026-03-09T08:55:12.132632603Z 2026-03-09T08:55:12.132Z WARN proxy/server.go:584: management connection failed, retrying in 1.028s: create mapping stream: rpc error: code = Unavailable desc = connection error: desc = "transport: Error while dialing: dial tcp 172.30.0.3:80: connect: connection refused" [netbird-proxy] 2026-03-09T08:55:13.165359060Z 2026-03-09T08:55:13.162Z DEBG proxy/server.go:546: connecting to management mapping stream [netbird-proxy] 2026-03-09T08:55:13.165419441Z 2026-03-09T08:55:13.162Z DEBG proxy/server.go:565: management mapping stream established [netbird-proxy] 2026-03-09T08:55:13.186038074Z 2026-03-09T08:55:13.185Z DEBG proxy/server.go:609: Received mapping update, starting processing [netbird-proxy] 2026-03-09T08:55:13.186092597Z 2026-03-09T08:55:13.185Z DEBG proxy/server.go:611: Processing mapping update completed [netbird-proxy] 2026-03-09T08:55:13.186328723Z 2026-03-09T08:55:13.185Z INFO proxy/server.go:618: Initial mapping sync complete [netbird-proxy] 2026-03-09T08:57:27.898880605Z 2026-03-09T08:57:27.898Z DEBG proxy/server.go:609: Received mapping update, starting processing [netbird-proxy] 2026-03-09T08:57:27.898933369Z 2026-03-09T08:57:27.898Z DEBG [type: UPDATE_TYPE_CREATED, domain: vaultwarden.expo.anonymised.domain, path: [path:"/" target:"https://10.20.40.200/"], id: d6n8mtpk0sfc73dl3r0g] proxy/server.go:631: Processing mapping update [netbird-proxy] 2026-03-09T08:57:27.899090659Z 2026-03-09T08:57:27.898Z DEBG [service_id: d6n8mtpk0sfc73dl3r0g, account_id: d6ccp71k0sfc7390l750] proxy/internal/roundtrip/netbird.go:190: generating WireGuard keypair for new peer [netbird-proxy] 2026-03-09T08:57:27.899367734Z 2026-03-09T08:57:27.899Z DEBG [public_key: daSIYCnNG3gmw6vQ91bPE7mDQhyc8j3XC+Ydhxy/4kk=, account_id: d6ccp71k0sfc7390l750, service_id: d6n8mtpk0sfc73dl3r0g] proxy/internal/roundtrip/netbird.go:202: authenticating new proxy peer with management [netbird-proxy] 2026-03-09T08:57:28.005760981Z 2026-03-09T08:57:28.005Z INFO [account_id: d6ccp71k0sfc7390l750, service_id: d6n8mtpk0sfc73dl3r0g, public_key: daSIYCnNG3gmw6vQ91bPE7mDQhyc8j3XC+Ydhxy/4kk=] proxy/internal/roundtrip/netbird.go:226: proxy peer authenticated successfully with management [netbird-proxy] 2026-03-09T08:57:28.011628431Z 2026-03-09T08:57:28.011Z INFO [domain: vaultwarden.expo.anonymised.domain, account_id: d6ccp71k0sfc7390l750] proxy/internal/roundtrip/netbird.go:175: created new client for account [netbird-proxy] 2026-03-09T08:57:28.011765886Z 2026-03-09T08:57:28.011Z DEBG proxy/server.go:611: Processing mapping update completed [netbird-proxy] 2026-03-09T08:57:28.011818199Z 2026-03-09T08:57:28.011Z INFO proxy/internal/acme/manager.go:140: acquiring cert lock for domain "vaultwarden.expo.anonymised.domain" [netbird-proxy] 2026-03-09T08:57:28.011837764Z 2026-03-09T08:57:28.011Z WARN proxy/internal/acme/manager.go:144: acquire cert lock for domain "vaultwarden.expo.anonymised.domain", proceeding without lock: open lock file /certs/vaultwarden.expo.anonymised.domain.lock: open /certs/vaultwarden.expo.anonymised.domain.lock: permission denied [netbird-proxy] 2026-03-09T08:57:28.451481439Z 2026-03-09T08:57:28.451Z WARN client/internal/profilemanager/service.go:368: failed to get active profile state: failed to set default active profile state: failed to set active profile to default: failed to write active profile state: create temp: open /var/lib/netbird/.2454754093active_profile.json: permission denied [netbird-proxy] 2026-03-09T08:57:28.555156764Z 2026-03-09T08:57:28.554Z WARN proxy/internal/acme/manager.go:159: prefetch certificate for domain "vaultwarden.expo.anonymised.domain" in 543.099535ms: open /certs/acme_account+key2826026017: permission denied [netbird-proxy] 2026-03-09T08:57:28.635285192Z 2026/03/09 08:57:28 failed to sufficiently increase receive buffer size (was: 208 kiB, wanted: 7168 kiB, got: 416 kiB). See https://github.com/quic-go/quic-go/wiki/UDP-Buffer-Sizes for details. [netbird-proxy] 2026-03-09T08:57:28.691372333Z 2026-03-09T08:57:28.691Z WARN client/firewall/create_linux.go:49: failed to create native firewall: create firewall: no firewall manager found. Proceeding with userspace [netbird-proxy] 2026-03-09T08:57:28.717533416Z 2026-03-09T08:57:28.716Z INFO [account_id: d6ccp71k0sfc7390l750, domain: vaultwarden.expo.anonymised.domain] proxy/internal/roundtrip/netbird.go:317: notified management about tunnel connection [netbird-proxy] 2026-03-09T08:58:18.046951018Z 2026-03-09T08:58:18.046Z WARN [http-server: https] ./caller_not_available:0: http: TLS handshake error from 119.28.89.249:60204: unknown domain "anonymised.domain" [netbird-proxy] 2026-03-09T09:04:52.801568090Z 2026-03-09T09:04:52.800Z WARN [peer: sWITQCdchuGDD9+2kgIshxxs+laJJ6lpC8R4fAHJ41o=] client/internal/peer/worker_ice.go:160: ICE Agent is not initialized yet [netbird-proxy] 2026-03-09T09:10:02.421260161Z 2026-03-09T09:10:02.421Z WARN [peer: sWITQCdchuGDD9+2kgIshxxs+laJJ6lpC8R4fAHJ41o=] client/internal/peer/worker_ice.go:160: ICE Agent is not initialized yet [netbird-proxy] 2026-03-09T09:18:12.340708367Z 2026-03-09T09:18:12.340Z WARN [peer: sWITQCdchuGDD9+2kgIshxxs+laJJ6lpC8R4fAHJ41o=] client/internal/peer/worker_ice.go:160: ICE Agent is not initialized yet [netbird-proxy] 2026-03-09T09:18:28.587579081Z 2026-03-09T09:18:28.587Z WARN [http-server: https] ./caller_not_available:0: http: TLS handshake error from 74.7.230.10:48996: unknown domain "crowdsec.anonymised.domain" [netbird-proxy] 2026-03-09T09:18:28.852785245Z 2026-03-09T09:18:28.852Z WARN [http-server: https] ./caller_not_available:0: http: TLS handshake error from 74.7.230.10:49008: unknown domain "crowdsec.anonymised.domain" [netbird-proxy] 2026-03-09T09:18:29.105190983Z 2026-03-09T09:18:29.104Z WARN [http-server: https] ./caller_not_available:0: http: TLS handshake error from 74.7.230.10:49012: unknown domain "crowdsec.anonymised.domain" [netbird-proxy] 2026-03-09T09:23:12.018392323Z 2026-03-09T09:23:12.018Z WARN [http-server: https] ./caller_not_available:0: http: TLS handshake error from 146.88.240.72:26619: acme/autocert: missing server name [netbird-proxy] 2026-03-09T08:55:11.296917176Z 2026-03-09T08:55:11.293Z INFO proxy/cmd/proxy/cmd/root.go:126: configured log level: debug [netbird-proxy] 2026-03-09T08:55:11.296992970Z 2026-03-09T08:55:11.294Z DEBG [TLS_enabled: false, gRPC_address: netbird-server:80] proxy/server.go:387: starting management gRPC client [netbird-proxy] 2026-03-09T08:55:11.297004001Z 2026-03-09T08:55:11.294Z DEBG [expect_continue_timeout: 1s, read_buffer_size: 0, response_header_timeout: 0s, max_idle_conns_per_host: 100, max_inflight: 0, max_idle_conns: 100, disable_compression: false, idle_conn_timeout: 1m30s, tls_handshake_timeout: 10s, write_buffer_size: 0, max_conns_per_host: 0] proxy/internal/roundtrip/transport.go:102: backend transport configuration [netbird-proxy] 2026-03-09T08:55:11.297013638Z 2026-03-09T08:55:11.294Z DEBG [challenge_type: tls-alpn-01, acme_server: https://acme-v02.api.letsencrypt.org/directory] proxy/server.go:425: ACME certificates enabled, configuring certificate manager [netbird-proxy] 2026-03-09T08:55:11.297020588Z 2026-03-09T08:55:11.294Z INFO proxy/internal/acme/locker.go:47: auto-detected cert lock method: flock [netbird-proxy] 2026-03-09T08:55:11.297026639Z 2026-03-09T08:55:11.294Z INFO proxy/internal/acme/locker.go:60: using flock cert locker in /certs [netbird-proxy] 2026-03-09T08:55:11.297032894Z 2026-03-09T08:55:11.295Z DEBG [challenge_type: tls-alpn-01, ServerName: expo.anonymised.domain] proxy/server.go:449: ACME certificate manager configured [netbird-proxy] 2026-03-09T08:55:11.297039203Z 2026-03-09T08:55:11.296Z INFO proxy/server.go:318: PROXY protocol enabled on listener [netbird-proxy] 2026-03-09T08:55:11.297045211Z 2026-03-09T08:55:11.296Z DEBG proxy/server.go:227: starting reverse proxy server on :8443 [netbird-proxy] 2026-03-09T08:55:11.297051228Z 2026-03-09T08:55:11.296Z INFO proxy/internal/health/health.go:293: starting health probe server on 127.0.0.1:8080 [netbird-proxy] 2026-03-09T08:55:11.301292952Z 2026-03-09T08:55:11.296Z DEBG proxy/server.go:546: connecting to management mapping stream [netbird-proxy] 2026-03-09T08:55:11.376464905Z 2026-03-09T08:55:11.376Z INFO ./caller_not_available:0: 2026/03/09 08:55:11 WARNING: [core] [Channel #1 SubChannel #2] grpc: addrConn.createTransport failed to connect to {Addr: "172.30.0.3:80", ServerName: "netbird-server:80", }. Err: connection error: desc = "transport: Error while dialing: dial tcp 172.30.0.3:80: connect: connection refused" [netbird-proxy] 2026-03-09T08:55:11.376692337Z 2026-03-09T08:55:11.376Z WARN proxy/server.go:584: management connection failed, retrying in 755ms: create mapping stream: rpc error: code = Unavailable desc = connection error: desc = "transport: Error while dialing: dial tcp 172.30.0.3:80: connect: connection refused" [netbird-proxy] 2026-03-09T08:55:12.132439979Z 2026-03-09T08:55:12.132Z DEBG proxy/server.go:546: connecting to management mapping stream [netbird-proxy] 2026-03-09T08:55:12.132632603Z 2026-03-09T08:55:12.132Z WARN proxy/server.go:584: management connection failed, retrying in 1.028s: create mapping stream: rpc error: code = Unavailable desc = connection error: desc = "transport: Error while dialing: dial tcp 172.30.0.3:80: connect: connection refused" [netbird-proxy] 2026-03-09T08:55:13.165359060Z 2026-03-09T08:55:13.162Z DEBG proxy/server.go:546: connecting to management mapping stream [netbird-proxy] 2026-03-09T08:55:13.165419441Z 2026-03-09T08:55:13.162Z DEBG proxy/server.go:565: management mapping stream established [netbird-proxy] 2026-03-09T08:55:13.186038074Z 2026-03-09T08:55:13.185Z DEBG proxy/server.go:609: Received mapping update, starting processing [netbird-proxy] 2026-03-09T08:55:13.186092597Z 2026-03-09T08:55:13.185Z DEBG proxy/server.go:611: Processing mapping update completed [netbird-proxy] 2026-03-09T08:55:13.186328723Z 2026-03-09T08:55:13.185Z INFO proxy/server.go:618: Initial mapping sync complete [netbird-proxy] 2026-03-09T08:57:27.898880605Z 2026-03-09T08:57:27.898Z DEBG proxy/server.go:609: Received mapping update, starting processing [netbird-proxy] 2026-03-09T08:57:27.898933369Z 2026-03-09T08:57:27.898Z DEBG [type: UPDATE_TYPE_CREATED, domain: vaultwarden.expo.anonymised.domain, path: [path:"/" target:"https://10.20.40.200/"], id: d6n8mtpk0sfc73dl3r0g] proxy/server.go:631: Processing mapping update [netbird-proxy] 2026-03-09T08:57:27.899090659Z 2026-03-09T08:57:27.898Z DEBG [service_id: d6n8mtpk0sfc73dl3r0g, account_id: d6ccp71k0sfc7390l750] proxy/internal/roundtrip/netbird.go:190: generating WireGuard keypair for new peer [netbird-proxy] 2026-03-09T08:57:27.899367734Z 2026-03-09T08:57:27.899Z DEBG [public_key: daSIYCnNG3gmw6vQ91bPE7mDQhyc8j3XC+Ydhxy/4kk=, account_id: d6ccp71k0sfc7390l750, service_id: d6n8mtpk0sfc73dl3r0g] proxy/internal/roundtrip/netbird.go:202: authenticating new proxy peer with management [netbird-proxy] 2026-03-09T08:57:28.005760981Z 2026-03-09T08:57:28.005Z INFO [account_id: d6ccp71k0sfc7390l750, service_id: d6n8mtpk0sfc73dl3r0g, public_key: daSIYCnNG3gmw6vQ91bPE7mDQhyc8j3XC+Ydhxy/4kk=] proxy/internal/roundtrip/netbird.go:226: proxy peer authenticated successfully with management [netbird-proxy] 2026-03-09T08:57:28.011628431Z 2026-03-09T08:57:28.011Z INFO [domain: vaultwarden.expo.anonymised.domain, account_id: d6ccp71k0sfc7390l750] proxy/internal/roundtrip/netbird.go:175: created new client for account [netbird-proxy] 2026-03-09T08:57:28.011765886Z 2026-03-09T08:57:28.011Z DEBG proxy/server.go:611: Processing mapping update completed [netbird-proxy] 2026-03-09T08:57:28.011818199Z 2026-03-09T08:57:28.011Z INFO proxy/internal/acme/manager.go:140: acquiring cert lock for domain "vaultwarden.expo.anonymised.domain" [netbird-proxy] 2026-03-09T08:57:28.011837764Z 2026-03-09T08:57:28.011Z WARN proxy/internal/acme/manager.go:144: acquire cert lock for domain "vaultwarden.expo.anonymised.domain", proceeding without lock: open lock file /certs/vaultwarden.expo.anonymised.domain.lock: open /certs/vaultwarden.expo.anonymised.domain.lock: permission denied [netbird-proxy] 2026-03-09T08:57:28.451481439Z 2026-03-09T08:57:28.451Z WARN client/internal/profilemanager/service.go:368: failed to get active profile state: failed to set default active profile state: failed to set active profile to default: failed to write active profile state: create temp: open /var/lib/netbird/.2454754093active_profile.json: permission denied [netbird-proxy] 2026-03-09T08:57:28.555156764Z 2026-03-09T08:57:28.554Z WARN proxy/internal/acme/manager.go:159: prefetch certificate for domain "vaultwarden.expo.anonymised.domain" in 543.099535ms: open /certs/acme_account+key2826026017: permission denied [netbird-proxy] 2026-03-09T08:57:28.635285192Z 2026/03/09 08:57:28 failed to sufficiently increase receive buffer size (was: 208 kiB, wanted: 7168 kiB, got: 416 kiB). See https://github.com/quic-go/quic-go/wiki/UDP-Buffer-Sizes for details. [netbird-proxy] 2026-03-09T08:57:28.691372333Z 2026-03-09T08:57:28.691Z WARN client/firewall/create_linux.go:49: failed to create native firewall: create firewall: no firewall manager found. Proceeding with userspace [netbird-proxy] 2026-03-09T08:57:28.717533416Z 2026-03-09T08:57:28.716Z INFO [account_id: d6ccp71k0sfc7390l750, domain: vaultwarden.expo.anonymised.domain] proxy/internal/roundtrip/netbird.go:317: notified management about tunnel connection [netbird-proxy] 2026-03-09T08:58:18.046951018Z 2026-03-09T08:58:18.046Z WARN [http-server: https] ./caller_not_available:0: http: TLS handshake error from 119.28.89.249:60204: unknown domain "anonymised.domain" [netbird-proxy] 2026-03-09T09:04:52.801568090Z 2026-03-09T09:04:52.800Z WARN [peer: sWITQCdchuGDD9+2kgIshxxs+laJJ6lpC8R4fAHJ41o=] client/internal/peer/worker_ice.go:160: ICE Agent is not initialized yet [netbird-proxy] 2026-03-09T09:10:02.421260161Z 2026-03-09T09:10:02.421Z WARN [peer: sWITQCdchuGDD9+2kgIshxxs+laJJ6lpC8R4fAHJ41o=] client/internal/peer/worker_ice.go:160: ICE Agent is not initialized yet [netbird-proxy] 2026-03-09T09:18:12.340708367Z 2026-03-09T09:18:12.340Z WARN [peer: sWITQCdchuGDD9+2kgIshxxs+laJJ6lpC8R4fAHJ41o=] client/internal/peer/worker_ice.go:160: ICE Agent is not initialized yet [netbird-proxy] 2026-03-09T09:18:28.587579081Z 2026-03-09T09:18:28.587Z WARN [http-server: https] ./caller_not_available:0: http: TLS handshake error from 74.7.230.10:48996: unknown domain "crowdsec.anonymised.domain" [netbird-proxy] 2026-03-09T09:18:28.852785245Z 2026-03-09T09:18:28.852Z WARN [http-server: https] ./caller_not_available:0: http: TLS handshake error from 74.7.230.10:49008: unknown domain "crowdsec.anonymised.domain" [netbird-proxy] 2026-03-09T09:18:29.105190983Z 2026-03-09T09:18:29.104Z WARN [http-server: https] ./caller_not_available:0: http: TLS handshake error from 74.7.230.10:49012: unknown domain "crowdsec.anonymised.domain" [netbird-proxy] 2026-03-09T09:23:12.018392323Z 2026-03-09T09:23:12.018Z WARN [http-server: https] ./caller_not_available:0: http: TLS handshake error from 146.88.240.72:26619: acme/autocert: missing server name [netbird-proxy] 2026-03-09T09:40:46.033739075Z 2026-03-09T09:40:46.033Z WARN [http-server: https] ./caller_not_available:0: http: TLS handshake error from 20.118.217.73:40560: acme/autocert: missing server name ```
saavagebueno commented 2026-08-05 01:29:22 -04:00
Author
Owner
Copy Link

@LordJuice1 commented on GitHub (Mar 10, 2026):

Even updating to the latest 0.66.3, I have the problem still

<!-- gh-comment-id:4034383398 --> @LordJuice1 commented on GitHub (Mar 10, 2026): Even updating to the latest 0.66.3, I have the problem still
saavagebueno commented 2026-08-05 01:29:22 -04:00
Author
Owner
Copy Link

@donnieD999 commented on GitHub (Mar 10, 2026):

Even updating to the latest 0.66.3, I have the problem still

second that

<!-- gh-comment-id:4034390633 --> @donnieD999 commented on GitHub (Mar 10, 2026): > Even updating to the latest 0.66.3, I have the problem still second that
saavagebueno commented 2026-08-05 01:29:23 -04:00
Author
Owner
Copy Link

@lixmal commented on GitHub (Mar 10, 2026):

@donnieD999

2026-03-09T08:57:28.554Z WARN proxy/internal/acme/manager.go:159: prefetch certificate for domain "vaultwarden.expo.anonymised.domain" in 543.099535ms: open /certs/acme_account+key2826026017: permission denied

No update will fix this. Something is wrong with your permissions

<!-- gh-comment-id:4035916375 --> @lixmal commented on GitHub (Mar 10, 2026): @donnieD999 > 2026-03-09T08:57:28.554Z WARN proxy/internal/acme/manager.go:159: prefetch certificate for domain "vaultwarden.expo.anonymised.domain" in 543.099535ms: open /certs/acme_account+key2826026017: permission denied No update will fix this. Something is wrong with your permissions
saavagebueno commented 2026-08-05 01:29:23 -04:00
Author
Owner
Copy Link

@Andi-bz commented on GitHub (Mar 12, 2026):

I had to chown 1000:1000 certs folder and mount a empty folder to /var/lib/netbird

volumes: - /home/docker/netbird/certs:/certs - /home/docker/netbird/proxy:/var/lib/netbird

<!-- gh-comment-id:4046446021 --> @Andi-bz commented on GitHub (Mar 12, 2026): I had to `chown 1000:1000 certs` folder and mount a empty folder to /var/lib/netbird `volumes: - /home/docker/netbird/certs:/certs - /home/docker/netbird/proxy:/var/lib/netbird`
saavagebueno commented 2026-08-05 01:29:23 -04:00
Author
Owner
Copy Link

@donnieD999 commented on GitHub (Mar 12, 2026):

@lixmal

@donnieD999

2026-03-09T08:57:28.554Z WARN proxy/internal/acme/manager.go:159: prefetch certificate for domain "vaultwarden.expo.anonymised.domain" in 543.099535ms: open /certs/acme_account+key2826026017: permission denied

No update will fix this. Something is wrong with your permissions

I also had to "chown 1000:1000 certs" directory as @Andi-bz, my stack data location for netbird-proxy is /opt/stacksData/netbird/proxy/certs

    volumes:
      - /opt/stacksData/netbird/proxy/certs:/certs
<!-- gh-comment-id:4047009611 --> @donnieD999 commented on GitHub (Mar 12, 2026): @lixmal > [@donnieD999](https://github.com/donnieD999) > > > 2026-03-09T08:57:28.554Z WARN proxy/internal/acme/manager.go:159: prefetch certificate for domain "vaultwarden.expo.anonymised.domain" in 543.099535ms: open /certs/acme_account+key2826026017: permission denied > > No update will fix this. Something is wrong with your permissions I also had to "chown 1000:1000 certs" directory as @Andi-bz, my stack data location for netbird-proxy is /opt/stacksData/netbird/proxy/certs ``` volumes: - /opt/stacksData/netbird/proxy/certs:/certs ```
saavagebueno commented 2026-08-05 01:29:23 -04:00
Author
Owner
Copy Link

@LordJuice1 commented on GitHub (Mar 12, 2026):

I made a cert directory and chown 1000:1000 it. I still see failed to get active profile state: failed to set default active profile state: failed to set active profile to default: failed to write active profile state: create temp: open /var/lib/netbird/.273235896active_profile.json: permission denied. I guess I should chown all of netbird?

<!-- gh-comment-id:4051937987 --> @LordJuice1 commented on GitHub (Mar 12, 2026): I made a `cert` directory and `chown 1000:1000` it. I still see `failed to get active profile state: failed to set default active profile state: failed to set active profile to default: failed to write active profile state: create temp: open /var/lib/netbird/.273235896active_profile.json: permission denied`. I guess I should chown all of `netbird`?
saavagebueno commented 2026-08-05 01:29:23 -04:00
Author
Owner
Copy Link

@LordJuice1 commented on GitHub (Mar 12, 2026):

I ended up trying to chown the whole netbird folder, assuming it wouldn't do much. I still get the permission denied

 WARN client/internal/profilemanager/service.go:368: failed to get active profile state: failed to set default active profile state: failed to set active profile to default: failed to write active profile state: create temp: open /var/lib/netbird/.19242019active_profile.json: permission denied
netbird-proxy  | 2026/03/13 02:33:24 failed to sufficiently increase receive buffer size (was: 208 kiB, wanted: 7168 kiB, got: 416 kiB). See https://github.com/quic-go/quic-go/wiki/UDP-Buffer-Sizes for details.
<!-- gh-comment-id:4051965487 --> @LordJuice1 commented on GitHub (Mar 12, 2026): I ended up trying to chown the whole netbird folder, assuming it wouldn't do much. I still get the permission denied ``` WARN client/internal/profilemanager/service.go:368: failed to get active profile state: failed to set default active profile state: failed to set active profile to default: failed to write active profile state: create temp: open /var/lib/netbird/.19242019active_profile.json: permission denied netbird-proxy | 2026/03/13 02:33:24 failed to sufficiently increase receive buffer size (was: 208 kiB, wanted: 7168 kiB, got: 416 kiB). See https://github.com/quic-go/quic-go/wiki/UDP-Buffer-Sizes for details. ```
saavagebueno commented 2026-08-05 01:29:23 -04:00
Author
Owner
Copy Link

@lixmal commented on GitHub (Mar 12, 2026):

The profile error is unrelated to the proxy (it's from the embedded client) and it's not critical. The message will be fixed in a future release

<!-- gh-comment-id:4051979838 --> @lixmal commented on GitHub (Mar 12, 2026): The profile error is unrelated to the proxy (it's from the embedded client) and it's not critical. The message will be fixed in a future release
saavagebueno commented 2026-08-05 01:29:23 -04:00
Author
Owner
Copy Link

@LordJuice1 commented on GitHub (Mar 12, 2026):

The profile error is unrelated to the proxy (it's from the embedded client) and it's not critical. The message will be fixed in a future release

Thats good to know.

I did try this method as well but with no luck https://github.com/netbirdio/netbird/issues/5349#issuecomment-3983395120

<!-- gh-comment-id:4052228776 --> @LordJuice1 commented on GitHub (Mar 12, 2026): > The profile error is unrelated to the proxy (it's from the embedded client) and it's not critical. The message will be fixed in a future release Thats good to know. I did try this method as well but with no luck https://github.com/netbirdio/netbird/issues/5349#issuecomment-3983395120
saavagebueno commented 2026-08-05 01:29:23 -04:00
Author
Owner
Copy Link

@LordJuice1 commented on GitHub (Mar 13, 2026):

I just updated to 0.66.4 and looked at the logs again. I'm still getting

acme/autocert: unable to satisfy "https://acme-v02.api.letsencrypt.org/acme/authz/3113769992/6727000000" for domain "subdomain.site.tld": no viable challenge type found
netbird-proxy  | 2026-03-13T20:56:18.324Z WARN [http-server: https] ./caller_not_available:0: http: TLS handshake error from 172.30.0.10:48016: proxyproto: proxy protocol signature not present
<!-- gh-comment-id:4057948609 --> @LordJuice1 commented on GitHub (Mar 13, 2026): I just updated to 0.66.4 and looked at the logs again. I'm still getting ``` acme/autocert: unable to satisfy "https://acme-v02.api.letsencrypt.org/acme/authz/3113769992/6727000000" for domain "subdomain.site.tld": no viable challenge type found netbird-proxy | 2026-03-13T20:56:18.324Z WARN [http-server: https] ./caller_not_available:0: http: TLS handshake error from 172.30.0.10:48016: proxyproto: proxy protocol signature not present ```
saavagebueno commented 2026-08-05 01:29:23 -04:00
Author
Owner
Copy Link

@MAGMADIMSUM-RTX commented on GitHub (Mar 13, 2026):

I met same problem on 0.66.4:

netbird-proxy  | 2026-03-14T02:34:18.234Z INFO proxy/internal/acme/manager.go:152: acquired cert lock for domain "app.subdomain.site.tld" in 57.515µs
netbird-proxy  | 2026-03-14T02:34:24.569Z WARN [http-server: https] ./caller_not_available:0: http: TLS handshake error from 23.178.112.104:46085: EOF
netbird-proxy  | 2026-03-14T02:34:26.006Z WARN proxy/internal/acme/manager.go:165: prefetch certificate for domain "app.subdomain.site.tld" in 7.771459118s: acme/autocert: unable to satisfy "https://acme-v02.api.letsencrypt.org/acme/authz/xxx" for domain "app.subdomain.site.tld": no viable challenge type found
<!-- gh-comment-id:4059344542 --> @MAGMADIMSUM-RTX commented on GitHub (Mar 13, 2026): I met same problem on 0.66.4: ``` bash netbird-proxy | 2026-03-14T02:34:18.234Z INFO proxy/internal/acme/manager.go:152: acquired cert lock for domain "app.subdomain.site.tld" in 57.515µs netbird-proxy | 2026-03-14T02:34:24.569Z WARN [http-server: https] ./caller_not_available:0: http: TLS handshake error from 23.178.112.104:46085: EOF netbird-proxy | 2026-03-14T02:34:26.006Z WARN proxy/internal/acme/manager.go:165: prefetch certificate for domain "app.subdomain.site.tld" in 7.771459118s: acme/autocert: unable to satisfy "https://acme-v02.api.letsencrypt.org/acme/authz/xxx" for domain "app.subdomain.site.tld": no viable challenge type found ```
saavagebueno commented 2026-08-05 01:29:23 -04:00
Author
Owner
Copy Link

@Roebe02 commented on GitHub (Mar 15, 2026):

Could yall fix it? Same, cant issue cert

<!-- gh-comment-id:4062873739 --> @Roebe02 commented on GitHub (Mar 15, 2026): Could yall fix it? Same, cant issue cert
saavagebueno commented 2026-08-05 01:29:23 -04:00
Author
Owner
Copy Link

@mculumov commented on GitHub (Mar 16, 2026):

Same problem

<!-- gh-comment-id:4070656510 --> @mculumov commented on GitHub (Mar 16, 2026): Same problem
saavagebueno commented 2026-08-05 01:29:23 -04:00
Author
Owner
Copy Link

@LordJuice1 commented on GitHub (Mar 26, 2026):

I've since wiped and reloaded Netbird from scratch and having the same problem still. This time using the getting started script to set up the proxy

<!-- gh-comment-id:4137201743 --> @LordJuice1 commented on GitHub (Mar 26, 2026): I've since wiped and reloaded Netbird from scratch and having the same problem still. This time using the getting started script to set up the proxy
saavagebueno commented 2026-08-05 01:29:23 -04:00
Author
Owner
Copy Link

@OBXMan commented on GitHub (Apr 15, 2026):

Has anyone figured this out? I have reinstalled several times using the script but can't get past this problem. I was having a problem with network name but I downloaded the script and changed the docker compose file to force the network name to netbird instead of what Docker was doing without the change i.e. netbird_netbird. That fixed some other problems I was having but haven't figured this one out yet. Netbird is working fine and I can add peers but the reverse proxy won't assign a cert to any services as noted above.

Thanks.

<!-- gh-comment-id:4256521435 --> @OBXMan commented on GitHub (Apr 15, 2026): Has anyone figured this out? I have reinstalled several times using the script but can't get past this problem. I was having a problem with network name but I downloaded the script and changed the docker compose file to force the network name to netbird instead of what Docker was doing without the change i.e. netbird_netbird. That fixed some other problems I was having but haven't figured this one out yet. Netbird is working fine and I can add peers but the reverse proxy won't assign a cert to any services as noted above. Thanks.
saavagebueno commented 2026-08-05 01:29:23 -04:00
Author
Owner
Copy Link

@aboutrax commented on GitHub (Apr 17, 2026):

Same problem. In my case, I am using Dokploy that provide an traefik. During the installation, I have selected option 1 for reverse proxy and provide the correct network name. The installation and peer discovery is fine. Port 80, 443, 3478 are open. After this, I have followed, the migration guide for proxy. The dashboard show the proxy cluster. Everything is fine except the reverse proxy. My proxy container log:

2026/04/17 12:48:44 failed to sufficiently increase receive buffer size (was: 208 kiB, wanted: 7168 kiB, got: 416 kiB). See https://github.com/quic-go/quic-go/wiki/UDP-Buffer-Sizes for details.
2026-04-17T12:48:44.011Z ERRO shared/relay/client/dialer/quic/quic.go:66: failed to dial to Relay server via QUIC 'netbird.abnov.com:443': CRYPTO_ERROR 0x178 (remote): tls: no application protocol
2026-04-17T12:48:44.011Z ERRO [relay: rels://netbird.abnov.com:443] shared/relay/client/dialer/race_dialer.go:79: failed to dial via quic: CRYPTO_ERROR 0x178 (remote): tls: no application protocol
2026-04-17T12:48:44.062Z WARN client/firewall/create_linux.go:55: failed to create native firewall: create firewall: no firewall manager found. Proceeding with userspace
2026-04-17T12:48:44.223Z INFO [account_id: d7gia57smmss73dth7mg, service_key: domain:lj1yjiuozafu.proxy.netbird.abnov.com] proxy/internal/roundtrip/netbird.go:349: notified management about tunnel connection
2026-04-17T12:48:47.934Z WARN proxy/internal/acme/manager.go:384: prefetch certificate for domain "lj1yjiuozafu.proxy.netbird.abnov.com" in 4.460243355s: acme/autocert: unable to satisfy "https://acme-v02.api.letsencrypt.org/acme/authz/3248202791/689589402541" for domain "lj1yjiuozafu.proxy.netbird.abnov.com": no viable challenge type found
2026-04-17T12:54:35.108Z WARN [peer: HrIvYllpjsubvpF21Wv2C4mfrbRnOZIcJpxhshGIbSM=] client/internal/peer/worker_ice.go:164: ICE Agent is not initialized yet
<!-- gh-comment-id:4268214797 --> @aboutrax commented on GitHub (Apr 17, 2026): Same problem. In my case, I am using Dokploy that provide an traefik. During the installation, I have selected option 1 for reverse proxy and provide the correct network name. The installation and peer discovery is fine. Port 80, 443, 3478 are open. After this, I have followed, the migration guide for proxy. The dashboard show the proxy cluster. Everything is fine except the reverse proxy. My proxy container log: ``` 2026/04/17 12:48:44 failed to sufficiently increase receive buffer size (was: 208 kiB, wanted: 7168 kiB, got: 416 kiB). See https://github.com/quic-go/quic-go/wiki/UDP-Buffer-Sizes for details. 2026-04-17T12:48:44.011Z ERRO shared/relay/client/dialer/quic/quic.go:66: failed to dial to Relay server via QUIC 'netbird.abnov.com:443': CRYPTO_ERROR 0x178 (remote): tls: no application protocol 2026-04-17T12:48:44.011Z ERRO [relay: rels://netbird.abnov.com:443] shared/relay/client/dialer/race_dialer.go:79: failed to dial via quic: CRYPTO_ERROR 0x178 (remote): tls: no application protocol 2026-04-17T12:48:44.062Z WARN client/firewall/create_linux.go:55: failed to create native firewall: create firewall: no firewall manager found. Proceeding with userspace 2026-04-17T12:48:44.223Z INFO [account_id: d7gia57smmss73dth7mg, service_key: domain:lj1yjiuozafu.proxy.netbird.abnov.com] proxy/internal/roundtrip/netbird.go:349: notified management about tunnel connection 2026-04-17T12:48:47.934Z WARN proxy/internal/acme/manager.go:384: prefetch certificate for domain "lj1yjiuozafu.proxy.netbird.abnov.com" in 4.460243355s: acme/autocert: unable to satisfy "https://acme-v02.api.letsencrypt.org/acme/authz/3248202791/689589402541" for domain "lj1yjiuozafu.proxy.netbird.abnov.com": no viable challenge type found 2026-04-17T12:54:35.108Z WARN [peer: HrIvYllpjsubvpF21Wv2C4mfrbRnOZIcJpxhshGIbSM=] client/internal/peer/worker_ice.go:164: ICE Agent is not initialized yet ```
saavagebueno commented 2026-08-05 01:29:23 -04:00
Author
Owner
Copy Link

@MHolmes91 commented on GitHub (Apr 19, 2026):

I am using Dokploy that provide an traefik. During the installation, I have selected option 1 for reverse proxy and provide the correct network name.

I have also found that option 1 did not work for Netbird in Dokploy. It is possible that we both had the same issue where traefik was not fowarding traffic to the underlying netbird proxy via tcp passthrough. My symptoms were a bit different, perhaps because I am using a static wildcard cert for my reverse-proxied services.

I was able to access Netbird (net.example.com) and my other Dokploy services, but when I created a reverse proxy at (randomstring.net.example.com) or (randomstring.x.example.com) my browser would give the default Traefik 404 page and would not be forwarded to the Netbird proxy in spite of Traefik docs stating "If both HTTP routers and TCP routers listen to the same EntryPoint, the TCP routers will apply before the HTTP routers. If no matching route is found for the TCP routers, then the HTTP routers will take over." This was verified by my dokploy-traefik logs and lack of relevant netbird-proxy logs.

I think the issue was with the HostSNI line

- traefik.tcp.routers.proxy-passthrough.rule=HostSNI(`*`)

I fixed this by switching to:

- traefik.tcp.routers.proxy-passthrough.rule=HostSNIRegexp(`^.*$`)

which for some reason fixed the problem.

For some reason this is not an issue with a raw traefik instance. I verified this by creating a test repo with a entrypoint with an http router and a tcp router and seeing both succeed with HostSNI(*).

Here is a test docker compose file tailored for Dokploy that you can use to verify if traefik is properly forwarding or not

Here is a test docker compose file with a base traefik instance included. Notice that HostSNI(*) works here.

I believe this is an issue with Dokploy, but I am still trying to figure out what the difference is between my Dokploy instance (Version v0.29.0), and the raw traefik example.

<!-- gh-comment-id:4276789905 --> @MHolmes91 commented on GitHub (Apr 19, 2026): > I am using Dokploy that provide an traefik. During the installation, I have selected option 1 for reverse proxy and provide the correct network name. I have also found that option 1 did not work for Netbird in Dokploy. It is possible that we both had the same issue where traefik was not fowarding traffic to the underlying netbird proxy via tcp passthrough. My symptoms were a bit different, perhaps because I am using a static wildcard cert for my reverse-proxied services. I was able to access Netbird (net.example.com) and my other Dokploy services, but when I created a reverse proxy at (randomstring.net.example.com) or (randomstring.x.example.com) my browser would give the default Traefik 404 page and would not be forwarded to the Netbird proxy in spite of [Traefik docs](https://doc.traefik.io/traefik/reference/routing-configuration/tcp/routing/rules-and-priority/#general) stating "If both HTTP routers and TCP routers listen to the same EntryPoint, the TCP routers will apply before the HTTP routers. If no matching route is found for the TCP routers, then the HTTP routers will take over." This was verified by my `dokploy-traefik` logs and lack of relevant `netbird-proxy` logs. I think the issue was with the HostSNI line ``` - traefik.tcp.routers.proxy-passthrough.rule=HostSNI(`*`) ``` I fixed this by switching to: ``` - traefik.tcp.routers.proxy-passthrough.rule=HostSNIRegexp(`^.*$`) ``` which for some reason fixed the problem. For some reason this is not an issue with a raw traefik instance. I verified this by creating a test repo with a entrypoint with an http router and a tcp router and seeing both succeed with HostSNI(`*`). Here is a test [docker compose file](https://gist.github.com/MHolmes91/fbe95afa589d5ce4b77c4296fc196b33) tailored for Dokploy that you can use to verify if traefik is properly forwarding or not Here is a test [docker compose file](https://gist.github.com/MHolmes91/57426e8e23622d2b4aead2e540c139d6) with a base traefik instance included. Notice that HostSNI(`*`) works here. I believe this is an issue with Dokploy, but I am still trying to figure out what the difference is between my Dokploy instance (Version v0.29.0), and the raw traefik example.
saavagebueno commented 2026-08-05 01:29:23 -04:00
Author
Owner
Copy Link

@aboutrax commented on GitHub (Apr 21, 2026):

I think the issue was with the HostSNI line

You are right. After replacing the rule with HostSNIRegexp(^.*$), it work. The proxy is correctly used and able to generate certificate successfully. The services and custom domain work too. The only downside is that few wildcard routes is also proxied and generate error in logs but this is expected.

When using option 0 (built in traefik) in a new vm, we have a few option that is not indicated in the proxy migration doc.

traefik:
    image: traefik:v3.6
    container_name: netbird-traefik
    restart: unless-stopped
    networks:
      netbird:
        ipv4_address: 172.30.0.10
    command:
      # Logging
      - "--log.level=INFO"
      - "--accesslog=true"
      # Docker provider
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--providers.docker.network=netbird"
      # Entrypoints
      - "--entrypoints.web.address=:80"
      - "--entrypoints.websecure.address=:443"
      - "--entrypoints.websecure.allowACMEByPass=true"
      # Disable timeouts for long-lived gRPC streams
      - "--entrypoints.websecure.transport.respondingTimeouts.readTimeout=0"
      - "--entrypoints.websecure.transport.respondingTimeouts.writeTimeout=0"
      - "--entrypoints.websecure.transport.respondingTimeouts.idleTimeout=0"
      # HTTP to HTTPS redirect
      - "--entrypoints.web.http.redirections.entrypoint.to=websecure"
      - "--entrypoints.web.http.redirections.entrypoint.scheme=https"
     # Let's Encrypt ACME
      - "--certificatesresolvers.letsencrypt.acme.email=admin@abnov.com"
      - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
      - "--certificatesresolvers.letsencrypt.acme.tlschallenge=true"
      # gRPC transport settings
      - "--serverstransport.forwardingtimeouts.responseheadertimeout=0s"
      - "--serverstransport.forwardingtimeouts.idleconntimeout=0s"
      - "--providers.file.filename=/etc/traefik/dynamic.yaml"
    ports:
      - '443:443'
      - '80:80'
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - netbird_traefik_letsencrypt:/letsencrypt
      - ./traefik-dynamic.yaml:/etc/traefik/dynamic.yaml:ro
    logging:
      driver: "json-file"
      options:
        max-size: "500m"
        max-file: "2"

traefik-dynamic.yaml

tcp:
  serversTransports:
    pp-v2:
      proxyProtocol:
        version: 2

For the proxy part in compose:

proxy:
    image: netbirdio/reverse-proxy:latest
    container_name: netbird-proxy
    ports:
    - 51820:51820/udp
    restart: unless-stopped
    networks: [netbird]
    depends_on:
      - netbird-server
    env_file:
      - ./proxy.env
    volumes:
      - netbird_proxy_certs:/certs
    labels:
      # TCP passthrough for any unmatched domain (proxy handles its own TLS)
      - traefik.enable=true
      - traefik.tcp.routers.proxy-passthrough.entrypoints=websecure
      - traefik.tcp.routers.proxy-passthrough.rule=HostSNI(`*`)
      - traefik.tcp.routers.proxy-passthrough.tls.passthrough=true
      - traefik.tcp.routers.proxy-passthrough.service=proxy-tls
      - traefik.tcp.routers.proxy-passthrough.priority=1
      - traefik.tcp.services.proxy-tls.loadbalancer.server.port=8443
      - traefik.tcp.services.proxy-tls.loadbalancer.serverstransport=pp-v2@file
    logging:
      driver: "json-file"
      options:
        max-size: "500m"
        max-file: "2"

traefik.tcp.services.proxy-tls.loadbalancer.serverstransport=pp-v2@file is not documented in the migration guide and port 51820.
proxy.env contain additionally these option too:

NB_PROXY_FORWARDED_PROTO=https
NB_PROXY_PROXY_PROTOCOL=true
NB_PROXY_TRUSTED_PROXIES=172.30.0.10

I don't know if these are the problem because it work even if these change are not applied. Also when analysing the dokploy traefik.yml, I don't see any option that might cause HostSNI to not work. Maybe It is related to dokploy traefik version that is pinned to v3.1.2. The built in use v3.6.

<!-- gh-comment-id:4292427191 --> @aboutrax commented on GitHub (Apr 21, 2026): > I think the issue was with the HostSNI line You are right. After replacing the rule with `HostSNIRegexp(`^.*$`)`, it work. The proxy is correctly used and able to generate certificate successfully. The services and custom domain work too. The only downside is that few wildcard routes is also proxied and generate error in logs but this is expected. When using option 0 (built in traefik) in a new vm, we have a few option that is not indicated in the proxy migration doc. ``` traefik: image: traefik:v3.6 container_name: netbird-traefik restart: unless-stopped networks: netbird: ipv4_address: 172.30.0.10 command: # Logging - "--log.level=INFO" - "--accesslog=true" # Docker provider - "--providers.docker=true" - "--providers.docker.exposedbydefault=false" - "--providers.docker.network=netbird" # Entrypoints - "--entrypoints.web.address=:80" - "--entrypoints.websecure.address=:443" - "--entrypoints.websecure.allowACMEByPass=true" # Disable timeouts for long-lived gRPC streams - "--entrypoints.websecure.transport.respondingTimeouts.readTimeout=0" - "--entrypoints.websecure.transport.respondingTimeouts.writeTimeout=0" - "--entrypoints.websecure.transport.respondingTimeouts.idleTimeout=0" # HTTP to HTTPS redirect - "--entrypoints.web.http.redirections.entrypoint.to=websecure" - "--entrypoints.web.http.redirections.entrypoint.scheme=https" # Let's Encrypt ACME - "--certificatesresolvers.letsencrypt.acme.email=admin@abnov.com" - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json" - "--certificatesresolvers.letsencrypt.acme.tlschallenge=true" # gRPC transport settings - "--serverstransport.forwardingtimeouts.responseheadertimeout=0s" - "--serverstransport.forwardingtimeouts.idleconntimeout=0s" - "--providers.file.filename=/etc/traefik/dynamic.yaml" ports: - '443:443' - '80:80' volumes: - /var/run/docker.sock:/var/run/docker.sock:ro - netbird_traefik_letsencrypt:/letsencrypt - ./traefik-dynamic.yaml:/etc/traefik/dynamic.yaml:ro logging: driver: "json-file" options: max-size: "500m" max-file: "2" ``` traefik-dynamic.yaml ``` tcp: serversTransports: pp-v2: proxyProtocol: version: 2 ``` For the proxy part in compose: ``` proxy: image: netbirdio/reverse-proxy:latest container_name: netbird-proxy ports: - 51820:51820/udp restart: unless-stopped networks: [netbird] depends_on: - netbird-server env_file: - ./proxy.env volumes: - netbird_proxy_certs:/certs labels: # TCP passthrough for any unmatched domain (proxy handles its own TLS) - traefik.enable=true - traefik.tcp.routers.proxy-passthrough.entrypoints=websecure - traefik.tcp.routers.proxy-passthrough.rule=HostSNI(`*`) - traefik.tcp.routers.proxy-passthrough.tls.passthrough=true - traefik.tcp.routers.proxy-passthrough.service=proxy-tls - traefik.tcp.routers.proxy-passthrough.priority=1 - traefik.tcp.services.proxy-tls.loadbalancer.server.port=8443 - traefik.tcp.services.proxy-tls.loadbalancer.serverstransport=pp-v2@file logging: driver: "json-file" options: max-size: "500m" max-file: "2" ``` `traefik.tcp.services.proxy-tls.loadbalancer.serverstransport=pp-v2@file` is not documented in the migration guide and port 51820. proxy.env contain additionally these option too: ``` NB_PROXY_FORWARDED_PROTO=https NB_PROXY_PROXY_PROTOCOL=true NB_PROXY_TRUSTED_PROXIES=172.30.0.10 ``` I don't know if these are the problem because it work even if these change are not applied. Also when analysing the dokploy traefik.yml, I don't see any option that might cause `HostSNI` to not work. Maybe It is related to dokploy traefik version that is pinned to `v3.1.2`. The built in use `v3.6`.
saavagebueno commented 2026-08-05 01:29:23 -04:00
Author
Owner
Copy Link

@LordJuice1 commented on GitHub (Apr 28, 2026):

Until I see a fix or acknowledgment from the Netbird team, I'm thinking on leaving this open still

<!-- gh-comment-id:4340489227 --> @LordJuice1 commented on GitHub (Apr 28, 2026): Until I see a fix or acknowledgment from the Netbird team, I'm thinking on leaving this open still
saavagebueno commented 2026-08-05 01:29:23 -04:00
Author
Owner
Copy Link

@iSack97 commented on GitHub (May 5, 2026):

Out of nowhere, I now have the same problem. Changing HostSNI(*) to HostSNIRegexp(^.*$) in the compose didn't help for me.
Edit: my problem was related to issued with the .de Domain itself
https://www.heise.de/news/DNS-Probleme-de-Domains-nicht-erreichbar-11283192.html

<!-- gh-comment-id:4383661177 --> @iSack97 commented on GitHub (May 5, 2026): Out of nowhere, I now have the same problem. Changing HostSNI(`*`) to HostSNIRegexp(^.*$) in the compose didn't help for me. Edit: my problem was related to issued with the .de Domain itself https://www.heise.de/news/DNS-Probleme-de-Domains-nicht-erreichbar-11283192.html
saavagebueno commented 2026-08-05 01:29:24 -04:00
Author
Owner
Copy Link

@braindotai commented on GitHub (May 31, 2026):

Having same issue :( no longer able to add reverse proxy for getting https

<!-- gh-comment-id:4587742130 --> @braindotai commented on GitHub (May 31, 2026): Having same issue :( no longer able to add reverse proxy for getting https
saavagebueno commented 2026-08-05 01:29:24 -04:00
Author
Owner
Copy Link

@itsyuni commented on GitHub (May 31, 2026):

the same problem, unfortunately its stuck at the certificate stage

<!Image

<!-- gh-comment-id:4587862951 --> @itsyuni commented on GitHub (May 31, 2026): the same problem, unfortunately its stuck at the certificate stage <!<img width="860" height="156" alt="Image" src="https://github.com/user-attachments/assets/0d69c107-9e01-4f18-ac01-5f6d45c94f93" />
saavagebueno commented 2026-08-05 01:29:24 -04:00
Author
Owner
Copy Link

@arthurcoudron commented on GitHub (Jun 7, 2026):

Same issue, just in GUI because everything works fine

<!-- gh-comment-id:4642139177 --> @arthurcoudron commented on GitHub (Jun 7, 2026): Same issue, just in GUI because everything works fine
saavagebueno commented 2026-08-05 01:29:24 -04:00
Author
Owner
Copy Link

@sjansen1 commented on GitHub (Jun 8, 2026):

I have this issue on my proxy cluster deployment. Initialy i used the build in proxy on the dashboard server, now i added a new cluster containing two netbird proxy nodes serving my domains. When i create a new service, its stuck in issues certificate. On one of the proxy, i can see an "acme_account+key" and a "myservice.mydomain.com.lock" file. On the second proxy i see nothing.

These proxys are depleyed via the deployment command given by my dashboard, so the cert storage is a docker volume.

I dont know why the enrollment is stuck and i wonder how this letsencrypt stuff is working with a proxy cluster with two machines both serving the domain.

In my container log, i can see the following message:
prefetch certificate for domain "...." in ... acme/autocert: unable to satisfy "https://acme-v02.api.letsencrypt.org/acme/authz/...... for domain "myservice.mydomain.com": no viable challange type found

Update: it looks like its pure luck, deleting and recreating sometimes leads to success. For me this looks like some sort of race condition. I am afraid what happens on a renew, if it fails and leads to an unavailable service.

<!-- gh-comment-id:4648104354 --> @sjansen1 commented on GitHub (Jun 8, 2026): I have this issue on my proxy cluster deployment. Initialy i used the build in proxy on the dashboard server, now i added a new cluster containing two netbird proxy nodes serving my domains. When i create a new service, its stuck in issues certificate. On one of the proxy, i can see an "acme_account+key" and a "myservice.mydomain.com.lock" file. On the second proxy i see nothing. These proxys are depleyed via the deployment command given by my dashboard, so the cert storage is a docker volume. I dont know why the enrollment is stuck and i wonder how this letsencrypt stuff is working with a proxy cluster with two machines both serving the domain. In my container log, i can see the following message: prefetch certificate for domain "...." in ... acme/autocert: unable to satisfy "https://acme-v02.api.letsencrypt.org/acme/authz/...... for domain "myservice.mydomain.com": no viable challange type found Update: it looks like its pure luck, deleting and recreating sometimes leads to success. For me this looks like some sort of race condition. I am afraid what happens on a renew, if it fails and leads to an unavailable service.
saavagebueno commented 2026-08-05 01:29:24 -04:00
Author
Owner
Copy Link

@Doctor140 commented on GitHub (Jun 10, 2026):

I encountered this exact issue on a single-server self-hosted NetBird installation where the built-in Reverse Proxy was perpetually stuck in the "Issuing certificate..." state. After analyzing the logs and debugging, I found that the issue stems from a combination of internal gRPC routing blockages and ACME client IP validation failures.

Below is the complete walkthrough of what I did to resolve my version of the problem.

🔍 Root Causes

  1. gRPC Routing Block (HTTP 404/502):
    By default, Traefik only routes specific gRPC prefixes for clients and signal services. When the netbird-proxy container tries to query the management API using its internal paths (specifically /.proxy and /management.ProxyService/), Traefik drops these requests with 404 Not Found or 502 Bad Gateway errors, preventing the proxy cluster from authenticating with netbird-server.

  2. ACME Client IP Mismatch (tls-alpn-01 connection resets):
    The embedded Certmagic-based ACME client in the proxy expects to see the actual public IP address of the Let's Encrypt validation server. Since Traefik stands in front, the proxy container only saw Traefik's internal Docker network IP (e.g., 172.30.0.10). This triggered protection checks against MitM attacks, causing connection resets and generating no viable challenge type found errors in the logs.

🛠️ Step-by-Step Solution

(Please replace example.com, <your_proxy_token>, and paths with your actual values).

1. Ensure Wildcard DNS

Make sure you have a wildcard DNS A record pointed to your server's public IP:

  • Name: *
  • Type: A
  • Value: <your_server_public_ip>

2. Add gRPC Routing Rules for the Proxy in docker-compose.yml

Under the netbird-server service, update the traefik.http.routers.netbird-grpc.rule label to allow the proxy's specific gRPC prefixes:

services:
  netbird-server:
    # ...
    labels:
      # ... (keep other existing labels, but update the rule below)
      - "traefik.http.routers.netbird-grpc.rule=Host(`netbird.example.com`) && (PathPrefix(`/signalexchange.SignalExchange/`) || PathPrefix(`/management.ManagementService/`) || PathPrefix(`/proxy.`) || PathPrefix(`/management.ProxyService/`))"

3. Configure proxy.env

Modify proxy.env to redirect management traffic straight to the internal gRPC port over http (using h2c to bypass internal TLS overhead) and force PROXY protocol v2 headers:

# Direct to internal gRPC via h2c
NB_PROXY_MANAGEMENT_ADDRESS=http://netbird-server:80
NB_PROXY_ACME_CERTIFICATES=true
NB_PROXY_ALLOW_INSECURE=true
NB_PROXY_DOMAIN=example.com
NB_PROXY_LOG_LEVEL=info
NB_PROXY_TOKEN=<your_proxy_token>

# Standard challenge method over 443
NB_PROXY_ACME_CHALLENGE_TYPE=tls-alpn-01

# Force the proxy to read real IPs forwarded by Traefik
NB_PROXY_PROXY_PROTOCOL=true

4. Verify TLS-Passthrough in docker-compose.yml

Ensure your proxy service labels under docker-compose.yml utilize Traefik's passthrough routing along with the proxy protocol v2 transport (pp-v2@file):

services:
  proxy:
    # ...
    labels:
      - "traefik.enable=true"
      - "traefik.tcp.routers.proxy-passthrough.entrypoints=websecure"
      - "traefik.tcp.routers.proxy-passthrough.rule=HostSNI(`*`)"
      - "traefik.tcp.routers.proxy-passthrough.tls.passthrough=true"
      - "traefik.tcp.routers.proxy-passthrough.service=proxy-tls"
      - "traefik.tcp.routers.proxy-passthrough.priority=1"
      - "traefik.tcp.services.proxy-tls.loadbalancer.server.port=8443"
      - "traefik.tcp.services.proxy-tls.loadbalancer.serverstransport=pp-v2@file"

5. Clear Stale ACME Locks and Restart the Stack

To prevent old validation timeouts or stale lockfiles from blocking the fresh attempt, clear the lockfiles and reload the containers:

# 1. Stop the NetBird stack completely
docker compose -f /path/to/netbird/docker-compose.yml down

# 2. Clear stale ACME certificate locks and keys from the volume
sudo rm -f /var/lib/docker/volumes/<your_proxy_certs_volume>/_data/*.lock
sudo rm -f /var/lib/docker/volumes/<your_proxy_certs_volume>/_data/acme_account+key

# 3. Bring the stack up again in detached mode
docker compose -f /path/to/netbird/docker-compose.yml up -d

🎯 Verifying Success

Once started, you can watch the proxy logs using:

docker logs -f netbird-proxy

You should see proxy_protocol initialize as true and the message proxy peer authenticated successfully. When you check your NetBird Admin Panel, the target domains should switch from "Issuing certificate..." to Active in about 10 seconds.

<!-- gh-comment-id:4666426162 --> @Doctor140 commented on GitHub (Jun 10, 2026): I encountered this exact issue on a single-server self-hosted NetBird installation where the built-in Reverse Proxy was perpetually stuck in the "Issuing certificate..." state. After analyzing the logs and debugging, I found that the issue stems from a combination of internal gRPC routing blockages and ACME client IP validation failures. Below is the complete walkthrough of what I did to resolve my version of the problem. --- ### 🔍 Root Causes 1. **gRPC Routing Block (HTTP 404/502)**: By default, Traefik only routes specific gRPC prefixes for clients and signal services. When the `netbird-proxy` container tries to query the management API using its internal paths (specifically `/.proxy` and `/management.ProxyService/`), Traefik drops these requests with `404 Not Found` or `502 Bad Gateway` errors, preventing the proxy cluster from authenticating with `netbird-server`. 2. **ACME Client IP Mismatch (tls-alpn-01 connection resets)**: The embedded Certmagic-based ACME client in the proxy expects to see the actual public IP address of the Let's Encrypt validation server. Since Traefik stands in front, the proxy container only saw Traefik's internal Docker network IP (e.g., `172.30.0.10`). This triggered protection checks against MitM attacks, causing connection resets and generating `no viable challenge type found` errors in the logs. --- ### 🛠️ Step-by-Step Solution *(Please replace `example.com`, `<your_proxy_token>`, and paths with your actual values).* #### 1. Ensure Wildcard DNS Make sure you have a wildcard DNS A record pointed to your server's public IP: * **Name**: `*` * **Type**: `A` * **Value**: `<your_server_public_ip>` #### 2. Add gRPC Routing Rules for the Proxy in `docker-compose.yml` Under the `netbird-server` service, update the `traefik.http.routers.netbird-grpc.rule` label to allow the proxy's specific gRPC prefixes: ```yaml services: netbird-server: # ... labels: # ... (keep other existing labels, but update the rule below) - "traefik.http.routers.netbird-grpc.rule=Host(`netbird.example.com`) && (PathPrefix(`/signalexchange.SignalExchange/`) || PathPrefix(`/management.ManagementService/`) || PathPrefix(`/proxy.`) || PathPrefix(`/management.ProxyService/`))" ``` #### 3. Configure `proxy.env` Modify `proxy.env` to redirect management traffic straight to the internal gRPC port over `http` (using `h2c` to bypass internal TLS overhead) and force PROXY protocol v2 headers: ```env # Direct to internal gRPC via h2c NB_PROXY_MANAGEMENT_ADDRESS=http://netbird-server:80 NB_PROXY_ACME_CERTIFICATES=true NB_PROXY_ALLOW_INSECURE=true NB_PROXY_DOMAIN=example.com NB_PROXY_LOG_LEVEL=info NB_PROXY_TOKEN=<your_proxy_token> # Standard challenge method over 443 NB_PROXY_ACME_CHALLENGE_TYPE=tls-alpn-01 # Force the proxy to read real IPs forwarded by Traefik NB_PROXY_PROXY_PROTOCOL=true ``` #### 4. Verify TLS-Passthrough in `docker-compose.yml` Ensure your `proxy` service labels under `docker-compose.yml` utilize Traefik's passthrough routing along with the proxy protocol v2 transport (`pp-v2@file`): ```yaml services: proxy: # ... labels: - "traefik.enable=true" - "traefik.tcp.routers.proxy-passthrough.entrypoints=websecure" - "traefik.tcp.routers.proxy-passthrough.rule=HostSNI(`*`)" - "traefik.tcp.routers.proxy-passthrough.tls.passthrough=true" - "traefik.tcp.routers.proxy-passthrough.service=proxy-tls" - "traefik.tcp.routers.proxy-passthrough.priority=1" - "traefik.tcp.services.proxy-tls.loadbalancer.server.port=8443" - "traefik.tcp.services.proxy-tls.loadbalancer.serverstransport=pp-v2@file" ``` #### 5. Clear Stale ACME Locks and Restart the Stack To prevent old validation timeouts or stale lockfiles from blocking the fresh attempt, clear the lockfiles and reload the containers: ```bash # 1. Stop the NetBird stack completely docker compose -f /path/to/netbird/docker-compose.yml down # 2. Clear stale ACME certificate locks and keys from the volume sudo rm -f /var/lib/docker/volumes/<your_proxy_certs_volume>/_data/*.lock sudo rm -f /var/lib/docker/volumes/<your_proxy_certs_volume>/_data/acme_account+key # 3. Bring the stack up again in detached mode docker compose -f /path/to/netbird/docker-compose.yml up -d ``` --- ### 🎯 Verifying Success Once started, you can watch the proxy logs using: ```bash docker logs -f netbird-proxy ``` You should see `proxy_protocol` initialize as `true` and the message `proxy peer authenticated successfully`. When you check your NetBird Admin Panel, the target domains should switch from "Issuing certificate..." to **Active** in about 10 seconds.
saavagebueno commented 2026-08-05 01:29:24 -04:00
Author
Owner
Copy Link

@dark-vex commented on GitHub (Jul 8, 2026):

I did follow the migration instructions and I was having the issue were the UI is stuck on "Issuing Certificate" and on netbird-proxy log I was seeing:

acme/autocert: unable to satisfy "https://acme-v02.api.letsencrypt.org/acme/authz/3113769992/6727000000" for domain "subdomain.site.tld": no viable challenge type found

After reviewing the getting-started.sh script (here) I did notice that the following command was missing for the Traefik container:

- "--entrypoints.<https-port-name>.allowACMEByPass=true"

Adding it have resolved the issue.

  • Full example file for Traefik container
services:
  reverse-proxy:
    container_name: reverse-proxy
    image: traefik:v3.7
    command:
      - "--api.insecure=true"
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entryPoints.http.address=:80"
      - "--entryPoints.https.address=:443"
      # Allow ACMEByPass for https
      - "--entrypoints.https.allowACMEByPass=true"
      # Letsencrypt config
      - "--certificatesresolvers.myresolver.acme.tlschallenge=true"
      #- "--certificatesresolvers.myresolver.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory"
      - "--certificatesresolvers.myresolver.acme.email=<email>"
      - "--certificatesresolvers.myresolver.acme.storage=/letsencrypt/acme.json"
      # Disable timeouts for long-lived gRPC streams and set gRPC transport settings
      - "--entrypoints.websecure.transport.respondingTimeouts.readTimeout=0"
      - "--entrypoints.websecure.transport.respondingTimeouts.writeTimeout=0"
      - "--entrypoints.websecure.transport.respondingTimeouts.idleTimeout=0"
      - "--serverstransport.forwardingtimeouts.responseheadertimeout=0s"
      - "--serverstransport.forwardingtimeouts.idleconntimeout=0s"
    restart: always
    security_opt:
      - no-new-privileges:true
    ports:
    - "80:80"
    - "443:443"
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
      - "./letsencrypt:/letsencrypt"
    networks:
      netbird_net:
  • Netbird Proxy
services:
  proxy:
    image: netbirdio/reverse-proxy:latest
    container_name: netbird-proxy
    restart: unless-stopped
    networks:
      - netbird_net
    depends_on:
      - management
    env_file:
      - ./proxy.env
    volumes:
      - netbird_proxy_certs:/certs
    labels:
      - traefik.enable=true
      - traefik.tcp.routers.proxy-passthrough.entrypoints=https
      - traefik.tcp.routers.proxy-passthrough.rule=HostSNI(`*`)
      - traefik.tcp.routers.proxy-passthrough.tls.passthrough=true
      - traefik.tcp.routers.proxy-passthrough.service=proxy-tls
      - traefik.tcp.routers.proxy-passthrough.priority=1
      - traefik.tcp.services.proxy-tls.loadbalancer.server.port=8443
    logging:
      driver: "json-file"
      options:
        max-size: "500m"
        max-file: "2"
<!-- gh-comment-id:4918694423 --> @dark-vex commented on GitHub (Jul 8, 2026): I did follow the [migration instructions](https://docs.netbird.io/selfhosted/migration/enable-reverse-proxy#migration-steps) and I was having the issue were the UI is stuck on "Issuing Certificate" and on netbird-proxy log I was seeing: ``` acme/autocert: unable to satisfy "https://acme-v02.api.letsencrypt.org/acme/authz/3113769992/6727000000" for domain "subdomain.site.tld": no viable challenge type found ``` After reviewing the `getting-started.sh` script ([here](https://github.com/netbirdio/netbird/blob/main/infrastructure_files/getting-started.sh#L788)) I did notice that the following command was missing for the Traefik container: ``` - "--entrypoints.<https-port-name>.allowACMEByPass=true" ``` Adding it have resolved the issue. - Full example file for Traefik container ``` services: reverse-proxy: container_name: reverse-proxy image: traefik:v3.7 command: - "--api.insecure=true" - "--providers.docker=true" - "--providers.docker.exposedbydefault=false" - "--entryPoints.http.address=:80" - "--entryPoints.https.address=:443" # Allow ACMEByPass for https - "--entrypoints.https.allowACMEByPass=true" # Letsencrypt config - "--certificatesresolvers.myresolver.acme.tlschallenge=true" #- "--certificatesresolvers.myresolver.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory" - "--certificatesresolvers.myresolver.acme.email=<email>" - "--certificatesresolvers.myresolver.acme.storage=/letsencrypt/acme.json" # Disable timeouts for long-lived gRPC streams and set gRPC transport settings - "--entrypoints.websecure.transport.respondingTimeouts.readTimeout=0" - "--entrypoints.websecure.transport.respondingTimeouts.writeTimeout=0" - "--entrypoints.websecure.transport.respondingTimeouts.idleTimeout=0" - "--serverstransport.forwardingtimeouts.responseheadertimeout=0s" - "--serverstransport.forwardingtimeouts.idleconntimeout=0s" restart: always security_opt: - no-new-privileges:true ports: - "80:80" - "443:443" volumes: - "/var/run/docker.sock:/var/run/docker.sock:ro" - "./letsencrypt:/letsencrypt" networks: netbird_net: ``` - Netbird Proxy ``` services: proxy: image: netbirdio/reverse-proxy:latest container_name: netbird-proxy restart: unless-stopped networks: - netbird_net depends_on: - management env_file: - ./proxy.env volumes: - netbird_proxy_certs:/certs labels: - traefik.enable=true - traefik.tcp.routers.proxy-passthrough.entrypoints=https - traefik.tcp.routers.proxy-passthrough.rule=HostSNI(`*`) - traefik.tcp.routers.proxy-passthrough.tls.passthrough=true - traefik.tcp.routers.proxy-passthrough.service=proxy-tls - traefik.tcp.routers.proxy-passthrough.priority=1 - traefik.tcp.services.proxy-tls.loadbalancer.server.port=8443 logging: driver: "json-file" options: max-size: "500m" max-file: "2" ```
saavagebueno commented 2026-08-05 01:29:24 -04:00
Author
Owner
Copy Link

@sonalys commented on GitHub (Jul 14, 2026):

Same problem here on proxy 0.74.4

After a while, the certs were regenerated, as I accessed the URLs one by one.

<!-- gh-comment-id:4971092369 --> @sonalys commented on GitHub (Jul 14, 2026): Same problem here on proxy [0.74.4](https://hub.docker.com/layers/netbirdio/reverse-proxy/0.74.4/images/sha256-132a569b0f90c886597c52c65f5a855cf80c5ae5b77d828cb2438d7421df0b97) After a while, the certs were regenerated, as I accessed the URLs one by one.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
2021 Q4
2021 Q4
2021 Q4
2022 Q1
2022 Q1
2022 Q1
2022 Q1
2022 Q1
2022 Q1
accessibility
accessibility
accessibility
acl
acl
acl
agent
agent
agent
agent
agent
agent
Android
Android
Android
Android
Android
Android
api
api
api
authentik
authentik
authentik
automation
automation
automation
azure
azure
azure
battery-usage
battery-usage
battery-usage
bug
cache
cache
cache
client
client
client
client-ui
client-ui
client-ui
cloud
cloud
cloud
cloud-only
cloud-only
cloud-only
cloudflare
cloudflare
cloudflare
community
community
community
compatibility
compatibility
compatibility
config-idp
config-idp
config-idp
config-issue
config-issue
config-issue
connection
connection
connection
contribution
contribution
contribution
coturn
coturn
coturn
cross-vpn
cross-vpn
cross-vpn
dashboard
dashboard
dashboard
data-usage
data-usage
data-usage
distribution
distribution
distribution
dns
dns
dns
docker
docker
docker
documentation
documentation
documentation
duplicate
duplicate
duplicate
enhancement
enhancement
event-stream
event-stream
event-stream
feature-request
feature-request
feature-request
freebsd
freebsd
freebsd
getting-started
getting-started
getting-started
go
go
go
good first issue
good first issue
good first issue
gui
gui
gui
help wanted
help wanted
help wanted
home-assistant
home-assistant
home-assistant
idp
idp
idp
inconsistency
inconsistency
inconsistency
integration
integration
integration
integrations
integrations
integrations
ios
ios
ios
ipv6
ipv6
ipv6
jwt
jwt
jwt
k8s
k8s
k8s
keycloak
keycloak
keycloak
linux
linux
linux
login
login
login
macos
macos
macos
management-service
management-service
management-service
Medium
Medium
Medium
missing-docs
missing-docs
missing-docs
mobile
mobile
mobile
moved-internal
moved-internal
moved-internal
needs-review
needs-review
needs-review
netbird-ui
netbird-ui
netbird-ui
networking
networking
networking
new-platform
new-platform
new-platform
nginx
nginx
nginx
notification
notification
notification
okta
okta
okta
openwrt
openwrt
openwrt
P2
P2
P2
packaging
packaging
packaging
peer-management
peer-management
peer-management
peer-management
peer-management
peer-management
peer-management
peer-management
peer-management
performance
performance
performance
postgres
postgres
postgres
posture-checks
posture-checks
posture-checks
psk
psk
psk
pull-request
Mirrored from GitHub Pull Request
 question
question
question
refactor
refactor
refactor
relay
relay
relay
release
release
release
rfc
rfc
rfc
routes
routes
routes
security
security
security
security-improvement
security-improvement
security-improvement
security-related
security-related
security-related
self-hosting
self-hosting
self-hosting
server
server
server
signal
signal
signal
sleep-issue
sleep-issue
sleep-issue
ssh
ssh
ssh
ssl
ssl
ssl
status
status
status
store
store
store
synology
synology
synology
system-compatibility-issue
system-compatibility-issue
system-compatibility-issue
test-suite
test-suite
test-suite
third-party-integration
third-party-integration
third-party-integration
triage
triage
triage
triage
triage
triage
triage-needed
triage-needed
triage-needed
troubleshooting
troubleshooting
troubleshooting
UX
UX
UX
waiting-feedback
waiting-feedback
waiting-feedback
windows
windows
windows
wontfix
wontfix
wontfix
zitadel
zitadel
zitadel
No Label triage-needed
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
dynr-servers saavagebueno
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: DYNR/netbird#11339
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?