DYNR/netbird
2
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-08-05 00:15:26 -04:00
Code Issues 23.5k Packages Projects Releases 10 Wiki Activity

[GH-ISSUE #5461] Reverse Proxy: Support for Upstream TLS configuration (SNI override and InsecureSkipVerify) #11506

New Issue
Open
opened 2026-08-05 01:29:52 -04:00 by saavagebueno · 8 comments
saavagebueno commented 2026-08-05 01:29:52 -04:00
Owner
Copy Link

Originally created by @Deniom3 on GitHub (Feb 26, 2026).
Original GitHub issue: https://github.com/netbirdio/netbird/issues/5461

Description:
The Reverse Proxy feature consistently returns a 502 Bad Gateway error when the target service is configured via HTTPS (port 443). This occurs even when the internal service (e.g., a Traefik or Caddy instance) uses valid SSL certificates.

Current Constraints:

  • Proxying via port 80 (HTTP) to the internal server works correctly.
  • Proxying via port 443 (HTTPS) results in a 502 error.
  • Enabling "Pass Host Header" and "Rewrite Redirects" in the current NetBird UI does not resolve the underlying TLS handshake failure.

Comparison with Cloudflare Tunnel:
To support complex scenarios with internal proxies, similar tools like Cloudflare Tunnel provide specific TLS/HTTP settings that are currently missing in NetBird:

  1. Origin Server Name: Allows defining the hostname expected from the origin server certificate
  2. No TLS Verify: A toggle to disable TLS verification for the upstream connection.
  3. HTTP Host Header: An option to explicitly set the Host header sent to the local service

Previous Implementation Example (Caddy):
This scenario was previously handled using Caddy with the following configuration. The transport http block with tls_insecure_skip_verify and proper header forwarding is essential for the setup to work:

(reverse_home) {
    reverse_proxy https://100.92.108.240 {
        header_up Host {host}
        header_up X-Real-IP {remote_host}
        header_up X-Forwarded-For {remote_host}
        header_up X-Forwarded-Proto {scheme}

        transport http {
            tls_insecure_skip_verify
        }
    }
}

https://test.domain.com{
    import reverse_home
}

Requested Improvements:
Add advanced TLS configuration options (equivalent to noTLSVerify and SNI overriding) to the NetBird Service Settings to ensure compatibility with secure internal proxies.

Originally created by @Deniom3 on GitHub (Feb 26, 2026). Original GitHub issue: https://github.com/netbirdio/netbird/issues/5461 Description: The Reverse Proxy feature consistently returns a 502 Bad Gateway error when the target service is configured via HTTPS (port 443). This occurs even when the internal service (e.g., a Traefik or Caddy instance) uses valid SSL certificates. Current Constraints: - Proxying via port 80 (HTTP) to the internal server works correctly. - Proxying via port 443 (HTTPS) results in a 502 error. - Enabling "Pass Host Header" and "Rewrite Redirects" in the current NetBird UI does not resolve the underlying TLS handshake failure. Comparison with Cloudflare Tunnel: To support complex scenarios with internal proxies, similar tools like Cloudflare Tunnel provide specific TLS/HTTP settings that are currently missing in NetBird: 1. Origin Server Name: Allows defining the hostname expected from the origin server certificate 2. No TLS Verify: A toggle to disable TLS verification for the upstream connection. 3. HTTP Host Header: An option to explicitly set the Host header sent to the local service Previous Implementation Example (Caddy): This scenario was previously handled using Caddy with the following configuration. The transport http block with tls_insecure_skip_verify and proper header forwarding is essential for the setup to work: ``` (reverse_home) { reverse_proxy https://100.92.108.240 { header_up Host {host} header_up X-Real-IP {remote_host} header_up X-Forwarded-For {remote_host} header_up X-Forwarded-Proto {scheme} transport http { tls_insecure_skip_verify } } } https://test.domain.com{ import reverse_home } ``` Requested Improvements: Add advanced TLS configuration options (equivalent to noTLSVerify and SNI overriding) to the NetBird Service Settings to ensure compatibility with secure internal proxies.
saavagebueno added the feature-request label 2026-08-05 01:29:52 -04:00
saavagebueno commented 2026-08-05 01:29:52 -04:00
Author
Owner
Copy Link

@dasunsrule32 commented on GitHub (Apr 30, 2026):

This would be great. Pangolin works to my Caddy backends because it supports setting the TLS SNI Server Name. I run Uncloud on the backend and multiple apps that run from there with their different hosts. I get the same 502 errors and when attempting to use TLS passthrough, I only get 404 errors.

<!-- gh-comment-id:4353477679 --> @dasunsrule32 commented on GitHub (Apr 30, 2026): This would be great. Pangolin works to my Caddy backends because it supports setting the TLS SNI Server Name. I run Uncloud on the backend and multiple apps that run from there with their different hosts. I get the same 502 errors and when attempting to use TLS passthrough, I only get 404 errors.
saavagebueno commented 2026-08-05 01:29:52 -04:00
Author
Owner
Copy Link

@doschn commented on GitHub (Apr 30, 2026):

Same behavior in my setup - only direct connections to the backends are working. Accessing resources, where the connections terminate on an internal caddy proxy, results in 404.

TLS handshake errors appear in the log.

<!-- gh-comment-id:4355608775 --> @doschn commented on GitHub (Apr 30, 2026): Same behavior in my setup - only direct connections to the backends are working. Accessing resources, where the connections terminate on an internal caddy proxy, results in 404. TLS handshake errors appear in the log.
saavagebueno commented 2026-08-05 01:29:52 -04:00
Author
Owner
Copy Link

@dasunsrule32 commented on GitHub (Apr 30, 2026):

Yep, same.

<!-- gh-comment-id:4355679014 --> @dasunsrule32 commented on GitHub (Apr 30, 2026): Yep, same.
saavagebueno commented 2026-08-05 01:29:52 -04:00
Author
Owner
Copy Link

@doschn commented on GitHub (May 26, 2026):

no news on this topic so far?

<!-- gh-comment-id:4547464806 --> @doschn commented on GitHub (May 26, 2026): no news on this topic so far?
saavagebueno commented 2026-08-05 01:29:52 -04:00
Author
Owner
Copy Link

@sandroshu commented on GitHub (May 26, 2026):

no news on this topic so far?

You can skip SSL verification, no info about SNI override.

<!-- gh-comment-id:4547489025 --> @sandroshu commented on GitHub (May 26, 2026): > no news on this topic so far? You can skip SSL verification, no info about SNI override.
saavagebueno commented 2026-08-05 01:29:52 -04:00
Author
Owner
Copy Link

@wm-ek commented on GitHub (May 27, 2026):

same

<!-- gh-comment-id:4554990898 --> @wm-ek commented on GitHub (May 27, 2026): same
saavagebueno commented 2026-08-05 01:29:52 -04:00
Author
Owner
Copy Link

@andremohrmann commented on GitHub (Jul 22, 2026):

Big +1 on the Host header part of this specifically, and I want to flag why the recently merged per-target options (#5501) don't cover it.

My backend is an internal Traefik that selects its router by Host. The name the proxy forwards (e.g. service.home.example.com) isn't what my Traefik rule matches, and Pass Host Header only offers two choices: the client's original Host, or the target's hostname. I need a third: a Host value I set explicitly.

#5501 added custom_headers per target, which at first looked like the answer, but it deliberately excludes Host.

Given Host is intentionally filtered out of custom_headers, the clean fix is a dedicated per-target Host, I assume..

This is independent of the SNI override / TLS-verify items in this issue and matters even for plain-HTTP backends, so it could ship on its own.

<!-- gh-comment-id:5043917560 --> @andremohrmann commented on GitHub (Jul 22, 2026): Big +1 on the Host header part of this specifically, and I want to flag why the recently merged per-target options (#5501) don't cover it. My backend is an internal Traefik that selects its router by Host. The name the proxy forwards (e.g. service.home.example.com) isn't what my Traefik rule matches, and Pass Host Header only offers two choices: the client's original Host, or the target's hostname. I need a third: a Host value I set explicitly. #5501 added custom_headers per target, which at first looked like the answer, but it deliberately excludes Host. Given Host is intentionally filtered out of custom_headers, the clean fix is a dedicated per-target Host, I assume.. This is independent of the SNI override / TLS-verify items in this issue and matters even for plain-HTTP backends, so it could ship on its own.
saavagebueno commented 2026-08-05 01:29:52 -04:00
Author
Owner
Copy Link

@dasunsrule32 commented on GitHub (Jul 30, 2026):

I think this is really the only holding me back from using Netbird.

<!-- gh-comment-id:5137664855 --> @dasunsrule32 commented on GitHub (Jul 30, 2026): I think this is really the only holding me back from using Netbird.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
2021 Q4
2021 Q4
2021 Q4
2022 Q1
2022 Q1
2022 Q1
2022 Q1
2022 Q1
2022 Q1
accessibility
accessibility
accessibility
acl
acl
acl
agent
agent
agent
agent
agent
agent
Android
Android
Android
Android
Android
Android
api
api
api
authentik
authentik
authentik
automation
automation
automation
azure
azure
azure
battery-usage
battery-usage
battery-usage
bug
cache
cache
cache
client
client
client
client-ui
client-ui
client-ui
cloud
cloud
cloud
cloud-only
cloud-only
cloud-only
cloudflare
cloudflare
cloudflare
community
community
community
compatibility
compatibility
compatibility
config-idp
config-idp
config-idp
config-issue
config-issue
config-issue
connection
connection
connection
contribution
contribution
contribution
coturn
coturn
coturn
cross-vpn
cross-vpn
cross-vpn
dashboard
dashboard
dashboard
data-usage
data-usage
data-usage
distribution
distribution
distribution
dns
dns
dns
docker
docker
docker
documentation
documentation
documentation
duplicate
duplicate
duplicate
enhancement
enhancement
event-stream
event-stream
event-stream
feature-request
feature-request
feature-request
freebsd
freebsd
freebsd
getting-started
getting-started
getting-started
go
go
go
good first issue
good first issue
good first issue
gui
gui
gui
help wanted
help wanted
help wanted
home-assistant
home-assistant
home-assistant
idp
idp
idp
inconsistency
inconsistency
inconsistency
integration
integration
integration
integrations
integrations
integrations
ios
ios
ios
ipv6
ipv6
ipv6
jwt
jwt
jwt
k8s
k8s
k8s
keycloak
keycloak
keycloak
linux
linux
linux
login
login
login
macos
macos
macos
management-service
management-service
management-service
Medium
Medium
Medium
missing-docs
missing-docs
missing-docs
mobile
mobile
mobile
moved-internal
moved-internal
moved-internal
needs-review
needs-review
needs-review
netbird-ui
netbird-ui
netbird-ui
networking
networking
networking
new-platform
new-platform
new-platform
nginx
nginx
nginx
notification
notification
notification
okta
okta
okta
openwrt
openwrt
openwrt
P2
P2
P2
packaging
packaging
packaging
peer-management
peer-management
peer-management
peer-management
peer-management
peer-management
peer-management
peer-management
peer-management
performance
performance
performance
postgres
postgres
postgres
posture-checks
posture-checks
posture-checks
psk
psk
psk
pull-request
Mirrored from GitHub Pull Request
 question
question
question
refactor
refactor
refactor
relay
relay
relay
release
release
release
rfc
rfc
rfc
routes
routes
routes
security
security
security
security-improvement
security-improvement
security-improvement
security-related
security-related
security-related
self-hosting
self-hosting
self-hosting
server
server
server
signal
signal
signal
sleep-issue
sleep-issue
sleep-issue
ssh
ssh
ssh
ssl
ssl
ssl
status
status
status
store
store
store
synology
synology
synology
system-compatibility-issue
system-compatibility-issue
system-compatibility-issue
test-suite
test-suite
test-suite
third-party-integration
third-party-integration
third-party-integration
triage
triage
triage
triage
triage
triage
triage-needed
triage-needed
triage-needed
troubleshooting
troubleshooting
troubleshooting
UX
UX
UX
waiting-feedback
waiting-feedback
waiting-feedback
windows
windows
windows
wontfix
wontfix
wontfix
zitadel
zitadel
zitadel
No Label feature-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
dynr-servers saavagebueno
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: DYNR/netbird#11506
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?