[GH-ISSUE #6068] Reverse Proxy: TLS passthrough not working #11556

New Issue

saavagebueno · 2026-08-05T01:30:01-04:00

saavagebueno commented

2026-08-05 01:30:01 -04:00

Originally created by @johannesbolnbach on GitHub (May 4, 2026).
Original GitHub issue: https://github.com/netbirdio/netbird/issues/6068

Describe the problem

It just shows "Error" in the UI..

When I open the domain, it gives me a 404 page:

When I use https as service type, it works fine.

To Reproduce

Host some TLS app and use "TLS" type when setting up the service.

Expected behavior

Should work normally.

Are you using NetBird Cloud?

I am using https://app.netbird.io/reverse-proxy/services

NetBird version

0.70.4

Is any other VPN software installed?

No

Debug output

To help us resolve the problem, please attach the following anonymized status output

Peers detail:
 proxy-d7sft1afadhs73d7hsdg-92-109.netbird.cloud:
  NetBird IP: 100.113.92.109
  Public key: uOTHhN4EvIENj1HdTFihX/oXAPq2RXPWKiPV0ByR1yo=
  Status: Connecting
  -- detail --
  Connection type: -
  ICE candidate (Local/Remote): -/-
  ICE candidate endpoints (Local/Remote): -/-
  Relay server address: 
  Last connection update: 34 seconds ago
  Last WireGuard handshake: -
  Transfer status (received/sent) 0 B/0 B
  Quantum resistance: false
  Networks: -
  Latency: 0s

 proxy-d7sfqiafadhs73d6shpg-111-108.netbird.cloud:
  NetBird IP: 100.113.111.108
  Public key: 3GlInK5CT+992p9uEfCZvUFG2JEx6oSU16ygfkI6iHo=
  Status: Connecting
  -- detail --
  Connection type: -
  ICE candidate (Local/Remote): -/-
  ICE candidate endpoints (Local/Remote): -/-
  Relay server address: 
  Last connection update: 36 seconds ago
  Last WireGuard handshake: -
  Transfer status (received/sent) 0 B/0 B
  Quantum resistance: false
  Networks: -
  Latency: 0s

 proxy-d7sft1bl0ubs73aqr3k0-114-147.netbird.cloud:
  NetBird IP: 100.113.114.147
  Public key: Hz/XSedm8DeXF5L2pdViqzFTqRKOaySvdGtt8hv8m20=
  Status: Connecting
  -- detail --
  Connection type: -
  ICE candidate (Local/Remote): -/-
  ICE candidate endpoints (Local/Remote): -/-
  Relay server address: 
  Last connection update: 34 seconds ago
  Last WireGuard handshake: -
  Transfer status (received/sent) 0 B/0 B
  Quantum resistance: false
  Networks: -
  Latency: 0s

 proxy-d7sfqibl0ubs73apuadg-228-158.netbird.cloud:
  NetBird IP: 100.113.228.158
  Public key: 92z97j74NVqo9YRUsesqJG3LWhYeojo3YwEFkZrFaHI=
  Status: Connecting
  -- detail --
  Connection type: -
  ICE candidate (Local/Remote): -/-
  ICE candidate endpoints (Local/Remote): -/-
  Relay server address: 
  Last connection update: 36 seconds ago
  Last WireGuard handshake: -
  Transfer status (received/sent) 0 B/0 B
  Quantum resistance: false
  Networks: -
  Latency: 0s

Events:
  [INFO] SYSTEM (89d9b064-5144-440c-8200-87864b2cb91b)
    Message: Network map updated
    Time: 11 minutes, 5 seconds ago
  [INFO] SYSTEM (c2eb24ec-62b5-4384-8e0f-d6d5814f6440)
    Message: Network map updated
    Time: 11 minutes, 4 seconds ago
  [INFO] SYSTEM (20c17d60-68cc-4a4b-8687-bc120170d8fd)
    Message: Network map updated
    Time: 6 minutes, 26 seconds ago
  [INFO] SYSTEM (8f9266f9-a5fe-4677-ad10-7f84d3ebab18)
    Message: Network map updated
    Time: 5 minutes, 51 seconds ago
  [INFO] SYSTEM (31eb2fd5-9564-4edd-9788-60cf7e47bfbb)
    Message: Network map updated
    Time: 5 minutes, 50 seconds ago
  [INFO] SYSTEM (60da252e-9ad2-4c6b-ae6b-c122bc4ec5bf)
    Message: Network map updated
    Time: 5 minutes, 14 seconds ago
  [INFO] SYSTEM (42b70a10-b073-467f-9936-35101d543eb6)
    Message: Network map updated
    Time: 1 minute, 44 seconds ago
  [INFO] SYSTEM (dfe2d4b0-037a-4626-9336-7697eec758a0)
    Message: Network map updated
    Time: 41 seconds ago
  [INFO] SYSTEM (fa9f95c9-032f-4351-a88f-fc9eee9b02e4)
    Message: Network map updated
    Time: 36 seconds ago
  [INFO] SYSTEM (b87c7879-cf6b-42b2-9128-22dc58416c2c)
    Message: Network map updated
    Time: 34 seconds ago
OS: linux/amd64
Daemon version: 0.70.4
CLI version: 0.70.4
Profile: default
Management: Connected to https://api.netbird.io:443
Signal: Connected to https://signal.netbird.io:443
Relays: 
  [stun:stun.netbird.io:443] is Available
  [stun:stun.netbird.io:5555] is Available
  [turns:turn.netbird.io:443?transport=tcp] is Available
  [rels://streamline-de-fra1-9.relay.netbird.io:443] is Available
Nameservers: 
FQDN: host.netbird.cloud
NetBird IP: 100.113.67.163/16
Interface type: Kernel
Quantum resistance: false
Lazy connection: false
SSH Server: Disabled
Networks: -
Peers count: 0/4 Connected

Additional context

Add any other context about the problem here.

Have you tried these troubleshooting steps?

[ x ] Reviewed client troubleshooting (if applicable)
[ x ] Checked for newer NetBird versions
[ x ] Searched for similar issues on GitHub (including closed ones)
[ x ] Restarted the NetBird client
[ x ] Disabled other VPN software
[ x ] Checked firewall settings

Originally created by @johannesbolnbach on GitHub (May 4, 2026). Original GitHub issue: https://github.com/netbirdio/netbird/issues/6068 **Describe the problem** It just shows "Error" in the UI.. <img width="373" height="138" alt="Image" src="https://github.com/user-attachments/assets/06fd8f0c-d189-432e-8029-38f7551ce56f" /> When I open the domain, it gives me a 404 page: <img width="505" height="196" alt="Image" src="https://github.com/user-attachments/assets/cba6c5ce-3f1f-49cc-ab1d-c33cf9f2a17c" /> When I use https as service type, it works fine. **To Reproduce** Host some TLS app and use "TLS" type when setting up the service. **Expected behavior** Should work normally. **Are you using NetBird Cloud?** I am using `https://app.netbird.io/reverse-proxy/services` **NetBird version** 0.70.4 **Is any other VPN software installed?** No **Debug output** To help us resolve the problem, please attach the following anonymized status output ``` Peers detail: proxy-d7sft1afadhs73d7hsdg-92-109.netbird.cloud: NetBird IP: 100.113.92.109 Public key: uOTHhN4EvIENj1HdTFihX/oXAPq2RXPWKiPV0ByR1yo= Status: Connecting -- detail -- Connection type: - ICE candidate (Local/Remote): -/- ICE candidate endpoints (Local/Remote): -/- Relay server address: Last connection update: 34 seconds ago Last WireGuard handshake: - Transfer status (received/sent) 0 B/0 B Quantum resistance: false Networks: - Latency: 0s proxy-d7sfqiafadhs73d6shpg-111-108.netbird.cloud: NetBird IP: 100.113.111.108 Public key: 3GlInK5CT+992p9uEfCZvUFG2JEx6oSU16ygfkI6iHo= Status: Connecting -- detail -- Connection type: - ICE candidate (Local/Remote): -/- ICE candidate endpoints (Local/Remote): -/- Relay server address: Last connection update: 36 seconds ago Last WireGuard handshake: - Transfer status (received/sent) 0 B/0 B Quantum resistance: false Networks: - Latency: 0s proxy-d7sft1bl0ubs73aqr3k0-114-147.netbird.cloud: NetBird IP: 100.113.114.147 Public key: Hz/XSedm8DeXF5L2pdViqzFTqRKOaySvdGtt8hv8m20= Status: Connecting -- detail -- Connection type: - ICE candidate (Local/Remote): -/- ICE candidate endpoints (Local/Remote): -/- Relay server address: Last connection update: 34 seconds ago Last WireGuard handshake: - Transfer status (received/sent) 0 B/0 B Quantum resistance: false Networks: - Latency: 0s proxy-d7sfqibl0ubs73apuadg-228-158.netbird.cloud: NetBird IP: 100.113.228.158 Public key: 92z97j74NVqo9YRUsesqJG3LWhYeojo3YwEFkZrFaHI= Status: Connecting -- detail -- Connection type: - ICE candidate (Local/Remote): -/- ICE candidate endpoints (Local/Remote): -/- Relay server address: Last connection update: 36 seconds ago Last WireGuard handshake: - Transfer status (received/sent) 0 B/0 B Quantum resistance: false Networks: - Latency: 0s Events: [INFO] SYSTEM (89d9b064-5144-440c-8200-87864b2cb91b) Message: Network map updated Time: 11 minutes, 5 seconds ago [INFO] SYSTEM (c2eb24ec-62b5-4384-8e0f-d6d5814f6440) Message: Network map updated Time: 11 minutes, 4 seconds ago [INFO] SYSTEM (20c17d60-68cc-4a4b-8687-bc120170d8fd) Message: Network map updated Time: 6 minutes, 26 seconds ago [INFO] SYSTEM (8f9266f9-a5fe-4677-ad10-7f84d3ebab18) Message: Network map updated Time: 5 minutes, 51 seconds ago [INFO] SYSTEM (31eb2fd5-9564-4edd-9788-60cf7e47bfbb) Message: Network map updated Time: 5 minutes, 50 seconds ago [INFO] SYSTEM (60da252e-9ad2-4c6b-ae6b-c122bc4ec5bf) Message: Network map updated Time: 5 minutes, 14 seconds ago [INFO] SYSTEM (42b70a10-b073-467f-9936-35101d543eb6) Message: Network map updated Time: 1 minute, 44 seconds ago [INFO] SYSTEM (dfe2d4b0-037a-4626-9336-7697eec758a0) Message: Network map updated Time: 41 seconds ago [INFO] SYSTEM (fa9f95c9-032f-4351-a88f-fc9eee9b02e4) Message: Network map updated Time: 36 seconds ago [INFO] SYSTEM (b87c7879-cf6b-42b2-9128-22dc58416c2c) Message: Network map updated Time: 34 seconds ago OS: linux/amd64 Daemon version: 0.70.4 CLI version: 0.70.4 Profile: default Management: Connected to https://api.netbird.io:443 Signal: Connected to https://signal.netbird.io:443 Relays: [stun:stun.netbird.io:443] is Available [stun:stun.netbird.io:5555] is Available [turns:turn.netbird.io:443?transport=tcp] is Available [rels://streamline-de-fra1-9.relay.netbird.io:443] is Available Nameservers: FQDN: host.netbird.cloud NetBird IP: 100.113.67.163/16 Interface type: Kernel Quantum resistance: false Lazy connection: false SSH Server: Disabled Networks: - Peers count: 0/4 Connected ``` **Additional context** Add any other context about the problem here. **Have you tried these troubleshooting steps?** - [ x ] Reviewed [client troubleshooting](https://docs.netbird.io/how-to/troubleshooting-client) (if applicable) - [ x ] Checked for newer NetBird versions - [ x ] Searched for similar issues on GitHub (including closed ones) - [ x ] Restarted the NetBird client - [ x ] Disabled other VPN software - [ x ] Checked firewall settings

saavagebueno commented

2026-08-05 01:30:01 -04:00

@johannesbolnbach commented on GitHub (May 4, 2026):

I tested it with a windows peer (default settings) and it failed as well.

It first shows "Setting up device", but then again just fails..

@johannesbolnbach commented on GitHub (May 4, 2026): I tested it with a windows peer (default settings) and it failed as well. It first shows "Setting up device", but then again just fails.. <img width="201" height="79" alt="Image" src="https://github.com/user-attachments/assets/edf2387a-752e-48db-bb01-9c82c2e1a775" /> <img width="107" height="64" alt="Image" src="https://github.com/user-attachments/assets/7c07af42-2c79-4e3c-9b35-09ddee1097af" />

saavagebueno commented

2026-08-05 01:30:01 -04:00

@web2brain commented on GitHub (May 5, 2026):

Experiencing the same issue

@web2brain commented on GitHub (May 5, 2026): Experiencing the same issue

saavagebueno commented

2026-08-05 01:30:02 -04:00

@lukuichina commented on GitHub (May 8, 2026):

So did I

@lukuichina commented on GitHub (May 8, 2026): So did I

saavagebueno commented

2026-08-05 01:30:02 -04:00

@lukuichina commented on GitHub (May 14, 2026):

Do not use the default remote 443 port.
It will work well

■Video
https://youtu.be/A15xiNuo-Z0

@lukuichina commented on GitHub (May 14, 2026): Do not use the default remote 443 port. It will work well ■Video https://youtu.be/A15xiNuo-Z0

saavagebueno commented

2026-08-05 01:30:02 -04:00

@Lemmmma commented on GitHub (May 16, 2026):

There seems to be an issue with certain ports. I can set up the service on listen port 443 but when I try to connect I get SSL_ERROR_INTERNAL_ERROR_ALERT. On the ports I tested so far it works fine for listen ports 7000, 7001, 7443, 9443 and 10443. However, on ports 444 and 8443 I can set up the service but I get a timeout instead when trying to connect. This is while keeping the local port of the service the same

@Lemmmma commented on GitHub (May 16, 2026): There seems to be an issue with certain ports. I can set up the service on listen port 443 but when I try to connect I get SSL_ERROR_INTERNAL_ERROR_ALERT. On the ports I tested so far it works fine for listen ports 7000, 7001, 7443, 9443 and 10443. However, on ports 444 and 8443 I can set up the service but I get a timeout instead when trying to connect. This is while keeping the local port of the service the same

saavagebueno commented

2026-08-05 01:30:02 -04:00

@erdelmaero commented on GitHub (May 19, 2026):

Confirming on self-hosted v0.71.0 (not just Cloud), and adding the underlying error from netbird-proxy since I don't see it in the thread yet — may help locate the bug:

WARN [http-server: https] http: TLS handshake error from <client-ip>: acme/autocert: unknown domain "<service-domain>"

The autocert library rejects the SNI with a 7-byte TLS alert (tlsv1 alert internal error, SSL alert 80) because the domain isn't in its host policy. This matches openssl s_client reporting "7 bytes read … no peer certificate available" and Firefox/Chrome showing SSL_ERROR_INTERNAL_ERROR_ALERT (mentioned upthread).

Worth noting: netbird-proxy does register the service correctly otherwise — I see this immediately after creating the service:

INFO [target: <internal-ip>:<port>, port: 443, service: <id>, domain: <service-domain>] proxy/server.go:1319: TLS passthrough mapping added

So the TLS-passthrough mapping is wired up; the issue appears to be that autocert sits in front of it and isn't told to allow mode=tls service domains through. The service record's meta.certificate_issued_at is never populated for mode=tls services (it is populated normally for mode=http), which seems consistent with that diagnosis — autocert never issues because the domain isn't in the policy.

Things that don't help (tried):

Restarting netbird-proxy
Deleting and recreating the service via the API (POST /api/reverse-proxies/services) — new record, same broken state

The workaround from @lukuichina / @Lemmmma (use a non-443 listen_port) is consistent with the diagnosis: a different listen_port lands the SNI on a TCP listener that isn't fronted by the autocert HTTPS handler.

@erdelmaero commented on GitHub (May 19, 2026): Confirming on **self-hosted v0.71.0** (not just Cloud), and adding the underlying error from `netbird-proxy` since I don't see it in the thread yet — may help locate the bug: ``` WARN [http-server: https] http: TLS handshake error from <client-ip>: acme/autocert: unknown domain "<service-domain>" ``` The autocert library rejects the SNI with a 7-byte TLS alert (`tlsv1 alert internal error`, SSL alert 80) because the domain isn't in its host policy. This matches `openssl s_client` reporting *"7 bytes read … no peer certificate available"* and Firefox/Chrome showing `SSL_ERROR_INTERNAL_ERROR_ALERT` (mentioned upthread). Worth noting: `netbird-proxy` *does* register the service correctly otherwise — I see this immediately after creating the service: ``` INFO [target: <internal-ip>:<port>, port: 443, service: <id>, domain: <service-domain>] proxy/server.go:1319: TLS passthrough mapping added ``` So the TLS-passthrough mapping is wired up; the issue appears to be that **autocert sits in front of it and isn't told to allow `mode=tls` service domains through**. The service record's `meta.certificate_issued_at` is never populated for `mode=tls` services (it is populated normally for `mode=http`), which seems consistent with that diagnosis — autocert never issues because the domain isn't in the policy. Things that don't help (tried): - Restarting `netbird-proxy` - Deleting and recreating the service via the API (`POST /api/reverse-proxies/services`) — new record, same broken state The workaround from @lukuichina / @Lemmmma (use a non-443 `listen_port`) is consistent with the diagnosis: a different `listen_port` lands the SNI on a TCP listener that isn't fronted by the autocert HTTPS handler.

saavagebueno commented

2026-08-05 01:30:02 -04:00

@Lemmmma commented on GitHub (May 23, 2026):

I also did some experimenting using the self-hosted server. It seems that changing the label

- traefik.tcp.services.proxy-tls.loadbalancer.server.port=8443

in the docker-compose proxy service to

- traefik.tcp.services.proxy-tls.loadbalancer.server.port=443

fixed the problem and lets me do a working TLS passthrough on port 443. However, I'm not sure if this breaks anything else.

@Lemmmma commented on GitHub (May 23, 2026): I also did some experimenting using the self-hosted server. It seems that changing the label ``` - traefik.tcp.services.proxy-tls.loadbalancer.server.port=8443 ``` in the docker-compose proxy service to ``` - traefik.tcp.services.proxy-tls.loadbalancer.server.port=443 ``` fixed the problem and lets me do a working TLS passthrough on port 443. However, I'm not sure if this breaks anything else.

saavagebueno commented

2026-08-05 01:30:02 -04:00

@erdelmaero commented on GitHub (May 24, 2026):

Following up on @Lemmmma's comment:

changing the label
- traefik.tcp.services.proxy-tls.loadbalancer.server.port=8443
in the docker-compose proxy service to
- traefik.tcp.services.proxy-tls.loadbalancer.server.port=443
fixed the problem and lets me do a working TLS passthrough on port 443. However, I'm not sure if this breaks anything else.

This works cleanly only if all services routed through the catch-all are mode=tls.

Mechanism: the label flip reroutes Traefik's TCP passthrough to netbird-proxy's per-port router on :443, which lives outside the autocert host-policy gate. But per-port routers only spin up when a mode=tls service registers with that listen_port. Any mode=http services on the same proxy (HTTP-level routing, pass_host_header, OAuth callback paths, path-based service mapping) stay on the main :8443 HTTPS handler with autocert — and after the label change, no longer receive traffic.

Verified on a stack with mixed mode=http + mode=tls: nothing listens on :443 inside the container unless an explicit listen_port=443 service is configured.

So this is a viable workaround for SNI-passthrough-only deployments, but it breaks HTTP-routed services in a mixed deployment.

The proper fix is upstream: register mode=tls service domains in autocert's host policy (or skip the autocert layer entirely for per-port-router SNIs).

@erdelmaero commented on GitHub (May 24, 2026): Following up on **@Lemmmma**'s comment: > changing the label > `- traefik.tcp.services.proxy-tls.loadbalancer.server.port=8443` > in the docker-compose proxy service to > `- traefik.tcp.services.proxy-tls.loadbalancer.server.port=443` > fixed the problem and lets me do a working TLS passthrough on port 443. However, I'm not sure if this breaks anything else. This works cleanly **only if all services routed through the catch-all are `mode=tls`**. **Mechanism:** the label flip reroutes Traefik's TCP passthrough to netbird-proxy's per-port router on `:443`, which lives outside the autocert host-policy gate. But per-port routers only spin up when a `mode=tls` service registers with that `listen_port`. Any `mode=http` services on the same proxy (HTTP-level routing, `pass_host_header`, OAuth callback paths, path-based service mapping) stay on the main `:8443` HTTPS handler with autocert — and after the label change, no longer receive traffic. **Verified** on a stack with mixed `mode=http` + `mode=tls`: nothing listens on `:443` inside the container unless an explicit `listen_port=443` service is configured. So this is a viable workaround for SNI-passthrough-only deployments, but it breaks HTTP-routed services in a mixed deployment. **The proper fix is upstream:** register `mode=tls` service domains in autocert's host policy (or skip the autocert layer entirely for per-port-router SNIs).

saavagebueno commented

2026-08-05 01:30:02 -04:00

@tnucera commented on GitHub (Jun 3, 2026):

NetBird Cloud (eu1) — same failure; differential evidence that the proxy never starts its peer side for mode=tls services

Reproduced on NetBird Cloud, eu1.netbird.services, validated custom domain, agent v0.71.4 on the routing peer:

mode=tls service (TLS passthrough, listen 443, subnet target behind a routing peer) → dashboard stuck on error ("Something went wrong while setting up this service"), zero Proxy Events.
Edge behaves as if the SNI was never registered: openssl s_client with the configured service SNI returns TLS alert 80 (internal_error) immediately after ClientHello — byte-identical to an unknown/unconfigured SNI and to no SNI at all. The tls service registered no route at the edge.
Routing peer logs show the proxy's ephemeral peer never comes up for tls services. Same routing peer, same account, ~30 min apart:
- tls service peer: SentOffer: 17, RemoteOffer: 0, RemoteAnswer: 0, RemoteCandidate: 0, RelayConnected: 0 — the peer is pushed by management, our side keeps offering, the proxy side never answers, the peer is then removed on the next sync (loops on every enable).
- http (L7) control service on the same target host: RemoteOffer: 3, RemoteAnswer: 4, RemoteCandidate: 14, RelayConnected: 1, LocalProxies: 1 — connects in seconds and serves traffic first try.
This matches the autocert host-policy / per-port-router analysis above: the service setup aborts proxy-side for mode=tls, while management still provisions the ephemeral peers.
The "non-443 listen port" workaround is not available on Cloud: both built-in and custom domains report supports_custom_ports: false via the API.

Happy to share account/service IDs privately.

@tnucera commented on GitHub (Jun 3, 2026): **NetBird Cloud (eu1) — same failure; differential evidence that the proxy never starts its peer side for `mode=tls` services** Reproduced on NetBird Cloud, `eu1.netbird.services`, validated custom domain, agent v0.71.4 on the routing peer: - `mode=tls` service (TLS passthrough, listen 443, subnet target behind a routing peer) → dashboard stuck on `error` ("Something went wrong while setting up this service"), zero Proxy Events. - **Edge behaves as if the SNI was never registered**: `openssl s_client` with the configured service SNI returns `TLS alert 80 (internal_error)` immediately after ClientHello — byte-identical to an unknown/unconfigured SNI and to no SNI at all. The tls service registered no route at the edge. - **Routing peer logs show the proxy's ephemeral peer never comes up for tls services.** Same routing peer, same account, ~30 min apart: - tls service peer: `SentOffer: 17, RemoteOffer: 0, RemoteAnswer: 0, RemoteCandidate: 0, RelayConnected: 0` — the peer is pushed by management, our side keeps offering, the proxy side never answers, the peer is then removed on the next sync (loops on every enable). - http (L7) control service on the **same target host**: `RemoteOffer: 3, RemoteAnswer: 4, RemoteCandidate: 14, RelayConnected: 1, LocalProxies: 1` — connects in seconds and serves traffic first try. - This matches the autocert host-policy / per-port-router analysis above: the service setup aborts proxy-side for `mode=tls`, while management still provisions the ephemeral peers. - The "non-443 listen port" workaround is **not available on Cloud**: both built-in and custom domains report `supports_custom_ports: false` via the API. Happy to share account/service IDs privately.

saavagebueno commented

2026-08-05 01:30:02 -04:00

@polettix commented on GitHub (Jun 7, 2026):

Just out of curiosity, is this "beta" of TLS passthrough working for anyone?

It never worked for me, even though my setup is as basic as possible:

Cloud-based, no self-hosting where I could botch the whole thing
I'm always updating the netbird client in Linux before trying to use the feature
I'm not doing any tweaking on the client side, just netbird up, logging in and confirming that the peer is marked as being up
The Custom Domain is Active in the web interface, pointing to eu1.netbird.services which is the one and only option available (even though the docs say it should be eu.proxy.netbird.io, whatever)
I just follow the instructions and the web form for adding a Service with TLS Passthrough.
The service is up and using a self-signed certificate; it can be invoked successfully by another Peer on its target port.

Using ports 443 and 8443 simply gives a plain Error in the web interface like many others pointed out.

Using port 10443 as hinted in some other post here gets rid of the Error in the web interface but does not work practically:

# from the outside
$ curl -k https://***:10443/
curl: (35) OpenSSL SSL_connect: SSL_ERROR_SYSCALL in connection to ***:10443

$ openssl s_client -connect ***:10443
CONNECTED(00000003)
400725546D760000:error:0A000126:SSL routines:ssl3_read_n:unexpected eof while reading:../ssl/record/rec_layer_s3.c:318:
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 0 bytes and written 345 bytes
Verification: OK
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)
---

I also tried to use the free domain, with the same results as above.

So back to my initial question: is TLS Passthrough working for anyone?

@polettix commented on GitHub (Jun 7, 2026): Just out of curiosity, is this "beta" of TLS passthrough working for anyone? It **never** worked for me, even though my setup is as basic as possible: * Cloud-based, no self-hosting where I could botch the whole thing * I'm always updating the netbird client in Linux before trying to use the feature * I'm not doing any tweaking on the client side, just `netbird up`, logging in and confirming that the peer is marked as being *up* * The Custom Domain is `Active` in the web interface, pointing to `eu1.netbird.services` which is the one and only option available (even though the docs say it should be `eu.proxy.netbird.io`, whatever) * I just follow the instructions and the web form for adding a Service with TLS Passthrough. * The service is up and using a self-signed certificate; it can be invoked successfully by another Peer on its target port. Using ports 443 and 8443 simply gives a plain `Error` in the web interface like many others pointed out. Using port 10443 as hinted in some other post here gets rid of the `Error` in the web interface but does not work practically: ``` # from the outside $ curl -k https://***:10443/ curl: (35) OpenSSL SSL_connect: SSL_ERROR_SYSCALL in connection to ***:10443 $ openssl s_client -connect ***:10443 CONNECTED(00000003) 400725546D760000:error:0A000126:SSL routines:ssl3_read_n:unexpected eof while reading:../ssl/record/rec_layer_s3.c:318: --- no peer certificate available --- No client certificate CA names sent --- SSL handshake has read 0 bytes and written 345 bytes Verification: OK --- New, (NONE), Cipher is (NONE) Secure Renegotiation IS NOT supported Compression: NONE Expansion: NONE No ALPN negotiated Early data was not sent Verify return code: 0 (ok) --- ``` I also tried to use the free domain, with the same results as above. So back to my initial question: is TLS Passthrough working for anyone?

saavagebueno commented

2026-08-05 01:30:02 -04:00

@mariowolff commented on GitHub (Jul 3, 2026):

Just to let you know: Updated my self- hosted environment this morning to
{
"dashboard_available_version": "2.90.3",
"management_available_version": "0.74.1",
"management_current_version": "0.74.1",
"management_update_available": false
}
and this problem still exists!

@mariowolff commented on GitHub (Jul 3, 2026): Just to let you know: Updated my self- hosted environment this morning to { "dashboard_available_version": "2.90.3", "management_available_version": "0.74.1", "management_current_version": "0.74.1", "management_update_available": false } and this problem still exists!

saavagebueno commented

2026-08-05 01:30:02 -04:00

@kleuveld commented on GitHub (Jul 6, 2026):

I can confirm the fix by @Lemmmma does still work. The fact that it allegedly breaks "regular" HTPPS reverse proxy doesn't bother me, so I haven't even checked it.

@kleuveld commented on GitHub (Jul 6, 2026): I can confirm the fix by @Lemmmma does still work. The fact that it allegedly breaks "regular" HTPPS reverse proxy doesn't bother me, so I haven't even checked it.

saavagebueno commented

2026-08-05 01:30:02 -04:00

@Lemmmma commented on GitHub (Jul 7, 2026):

In case that does bother anyone, heres a workaround that doesn't break regular HTTPS. Just add this in your docker-compose.yml in the labels sections of the proxy service:

      - traefik.tcp.routers.proxy-passthrough-443.entrypoints=websecure
      - traefik.tcp.routers.proxy-passthrough-443.rule=HostSNI(`your-passthrough.example.com`)
      - traefik.tcp.routers.proxy-passthrough-443.tls.passthrough=true
      - traefik.tcp.routers.proxy-passthrough-443.service=proxy-tls-443
      - traefik.tcp.routers.proxy-passthrough-443.priority=2
      - traefik.tcp.services.proxy-tls-443.loadbalancer.server.port=443
      - traefik.tcp.services.proxy-tls-443.loadbalancer.serverstransport=pp-v2@file

So that the proxy section looks like

  # NetBird Proxy - exposes internal resources to the internet
  proxy:
    image: netbirdio/reverse-proxy:latest
    container_name: netbird-proxy
    ports:
    - 51820:51820/udp
    restart: unless-stopped
    networks: [netbird]
    depends_on:
      netbird-server:
        condition: service_started
      crowdsec:
        condition: service_healthy
    env_file:
      - ./proxy.env
    volumes:
      - netbird_proxy_certs:/certs
    labels:
      # TCP passthrough for any unmatched domain (proxy handles its own TLS)
      - traefik.enable=true
      # only for passthrough on port 443
      - traefik.tcp.routers.proxy-passthrough-443.entrypoints=websecure
      - traefik.tcp.routers.proxy-passthrough-443.rule=HostSNI(`your-passthrough.example.com`)
      - traefik.tcp.routers.proxy-passthrough-443.tls.passthrough=true
      - traefik.tcp.routers.proxy-passthrough-443.service=proxy-tls-443
      - traefik.tcp.routers.proxy-passthrough-443.priority=2
      - traefik.tcp.services.proxy-tls-443.loadbalancer.server.port=443
      - traefik.tcp.services.proxy-tls-443.loadbalancer.serverstransport=pp-v2@file
      # all other passthrough
      - traefik.tcp.routers.proxy-passthrough.entrypoints=websecure
      - traefik.tcp.routers.proxy-passthrough.rule=HostSNI(`*`)
      - traefik.tcp.routers.proxy-passthrough.tls.passthrough=true
      - traefik.tcp.routers.proxy-passthrough.service=proxy-tls
      - traefik.tcp.routers.proxy-passthrough.priority=1
      - traefik.tcp.services.proxy-tls.loadbalancer.server.port=8443
      - traefik.tcp.services.proxy-tls.loadbalancer.serverstransport=pp-v2@file
    logging:
      driver: "json-file"
      options:
        max-size: "500m"
        max-file: "2"

Change the HostSNI argument to the domains you want to work with TLS passthrough. TLS passthrough works perfectly fine for me like this and in some very basic testing regular HTTPS reverse proxy also seems to work fine.
If you want multiple domains you should be able to use wildcards or to separate them with commas like so:

      - traefik.tcp.routers.proxy-passthrough-443.rule=HostSNI(`your-passthrough.example.com`,`your-passthrough1.example.com`,`your-passthrough2.example.com`)

@Lemmmma commented on GitHub (Jul 7, 2026): In case that does bother anyone, heres a workaround that doesn't break regular HTTPS. Just add this in your docker-compose.yml in the labels sections of the proxy service: ``` - traefik.tcp.routers.proxy-passthrough-443.entrypoints=websecure - traefik.tcp.routers.proxy-passthrough-443.rule=HostSNI(`your-passthrough.example.com`) - traefik.tcp.routers.proxy-passthrough-443.tls.passthrough=true - traefik.tcp.routers.proxy-passthrough-443.service=proxy-tls-443 - traefik.tcp.routers.proxy-passthrough-443.priority=2 - traefik.tcp.services.proxy-tls-443.loadbalancer.server.port=443 - traefik.tcp.services.proxy-tls-443.loadbalancer.serverstransport=pp-v2@file ``` So that the proxy section looks like ``` # NetBird Proxy - exposes internal resources to the internet proxy: image: netbirdio/reverse-proxy:latest container_name: netbird-proxy ports: - 51820:51820/udp restart: unless-stopped networks: [netbird] depends_on: netbird-server: condition: service_started crowdsec: condition: service_healthy env_file: - ./proxy.env volumes: - netbird_proxy_certs:/certs labels: # TCP passthrough for any unmatched domain (proxy handles its own TLS) - traefik.enable=true # only for passthrough on port 443 - traefik.tcp.routers.proxy-passthrough-443.entrypoints=websecure - traefik.tcp.routers.proxy-passthrough-443.rule=HostSNI(`your-passthrough.example.com`) - traefik.tcp.routers.proxy-passthrough-443.tls.passthrough=true - traefik.tcp.routers.proxy-passthrough-443.service=proxy-tls-443 - traefik.tcp.routers.proxy-passthrough-443.priority=2 - traefik.tcp.services.proxy-tls-443.loadbalancer.server.port=443 - traefik.tcp.services.proxy-tls-443.loadbalancer.serverstransport=pp-v2@file # all other passthrough - traefik.tcp.routers.proxy-passthrough.entrypoints=websecure - traefik.tcp.routers.proxy-passthrough.rule=HostSNI(`*`) - traefik.tcp.routers.proxy-passthrough.tls.passthrough=true - traefik.tcp.routers.proxy-passthrough.service=proxy-tls - traefik.tcp.routers.proxy-passthrough.priority=1 - traefik.tcp.services.proxy-tls.loadbalancer.server.port=8443 - traefik.tcp.services.proxy-tls.loadbalancer.serverstransport=pp-v2@file logging: driver: "json-file" options: max-size: "500m" max-file: "2" ``` Change the HostSNI argument to the domains you want to work with TLS passthrough. TLS passthrough works perfectly fine for me like this and in some very basic testing regular HTTPS reverse proxy also seems to work fine. If you want multiple domains you should be able to use wildcards or to separate them with commas like so: ``` - traefik.tcp.routers.proxy-passthrough-443.rule=HostSNI(`your-passthrough.example.com`,`your-passthrough1.example.com`,`your-passthrough2.example.com`) ```

saavagebueno commented

2026-08-05 01:30:02 -04:00

@kleuveld commented on GitHub (Jul 9, 2026):

The only thing that doesn't work for me is disabling a service. The service will be greyed out in the GUI, but netbird will happily continue forwarding traffic, which seems odd and potentially unsafe. I haven't noticed this with HTTP(s) services.

@kleuveld commented on GitHub (Jul 9, 2026): The only thing that doesn't work for me is disabling a service. The service will be greyed out in the GUI, but netbird will happily continue forwarding traffic, which seems odd and potentially unsafe. I haven't noticed this with HTTP(s) services.

saavagebueno commented

2026-08-05 01:30:02 -04:00

@sdegroot commented on GitHub (Jul 12, 2026):

I've been in contact @emrcbrn via email. He mentioned they're going to have a look. As of today I still see 'Error' upon creating a TLS Passthrough service in Netbird (Cloud)

@sdegroot commented on GitHub (Jul 12, 2026): I've been in contact @emrcbrn via email. He mentioned they're going to have a look. As of today I still see 'Error' upon creating a TLS Passthrough service in Netbird (Cloud)

Sign in to join this conversation.

Branches Tags

main

claude/agent-network-test-cases-p743vw

android/gui-integration

revert/component-types

feat-post_quantum_ml_kem

ice-stun-wg-demux

dependabot/npm_and_yarn/proxy/web/npm_and_yarn-b39864987c

agent-network-setup-poc

dependabot/go_modules/aws-sdk-8f849ebaed

dependabot/github_actions/actions-a940c7c866

dependabot/go_modules/otel-e34c790afd

dependabot/go_modules/testcontainers-de325c0dd6

dependabot/go_modules/wireguard-dbd6b95108

dependabot/go_modules/pion-5f703e1eca

dependabot/go_modules/gorm-2271c8195b

fix-login-needed-check

dependabot/go_modules/google.golang.org/grpc-1.82.1

fix/ui-gtk3-support

enterprise-traefik-and-migration-fixes

disambiguate_p2p_metrics

revert/component-types-hookup

embedded-vnc

feature/ios-ssh

docs/agent-network-docs-update

dependabot/go_modules/github.com/aws/aws-sdk-go-v2/service/s3-1.106.3

dependabot/go_modules/github.com/pion/stun/v3-3.1.5

fix-ssh-authorized-users-multi-rule

peer-acl-multi-source

reverse-proxy-crowdsec-appsec

reverse-proxy-allow-match-or

client-local-metrics

lazy-conn-per-peer

lazy-conn-rosenpass

dependabot/go_modules/github.com/gopacket/gopacket-1.7.0

dependabot/go_modules/goauthentik.io/api/v3-3.2026050.6

dependabot/go_modules/github.com/pires/go-proxyproto-0.15.0

dependabot/go_modules/github.com/jackc/pgx/v5-5.10.0

dependabot/go_modules/github.com/oapi-codegen/runtime-1.6.0

dependabot/go_modules/github.com/eko/gocache/lib/v4-4.2.4

dependabot/go_modules/github.com/pkg/sftp-1.13.11

dependabot/go_modules/github.com/coreos/go-oidc/v3-3.20.0

ssh-windows-privilege-check

fix/explicit-cors-handling

fix/remove-math-rand

test/gui-memory-leak-fix

fix/ui-status-dispatch

install-script-ui-dependencies

fix/grpc-get-network-map

fix/subscribe-status-coalesce

fix/tray-menu-item-leak

fix/windows-tray-race

feature/changeset

worktree-dns-route-qtype-fallthrough

mdm_integration

mlsmaycon-patch-2

feat/agent-network-ollama

proxy-tunnel-cache-ttl-env

coderabbitai/utg/1e5b0a5

grpc-acl

test/battery-drain

components-impl-drop-indexes-use-xids-no-resource-policy-map

fix/nmap-relevant-groups

e2e-guardrail-blocks-unselected-model

fix/lazyconn-cold-start-allowed-ips

vertex-guardrails-model-access-e2e

add-atomic-cache-ops

refactor/relay-foreign-cache

ci/trigger-release-tests

feature/kimi-3-agent-networks-dns-warmup

feature/dns-lazy-conn-warmup

daemon-ipc-acl

feature/ui-translation-key-parity-check

refactor/relay-foreign-cache-tests

fix/lazyconn-idle-keep-wg-peer

dmitri-propagate-auth-grant-types-on-combined

0.74.7-branch

diagnose-empty-vs-corrupt-state

windows-sleep-detector

fix/cli-up-wait-for-daemon

rp_key_persistency

feature/native-grpc

0.74.6-branch

0.74.6-branch-sync

0.74.5-branch-sync

0.74.4-branch

fix/remove-stale-peers-removal

fix/remove-stale-proxy-logic

fix/nsis-preserve-autostart-on-upgrade

refactor/peer-event-bus

dependabot/go_modules/goauthentik.io/api/v3-3.2026050.3

dependabot/go_modules/github.com/pkg/sftp-1.13.10

components-impl-drop-indexes

fix-reset-aggregation-window-flake

dependabot/go_modules/github.com/pion/dtls/v3-3.1.5

0.74.x

fix/relay-states-lock

update-process-pkg

update-gopsutil-v4

fix/relay_states_lock

increase-sysinfo-timeout

dependabot/go_modules/github.com/Azure/go-ntlmssp-0.1.1

dependabot/go_modules/github.com/eko/gocache/store/redis/v4-4.2.6

dependabot/go_modules/github.com/eko/gocache/lib/v4-4.2.3

fix/fail-to-create-upnp-port-mapping-on-opnsense-firewall

0.74.3-branch

fix/routeselector-atomic-exit-node

netmap_progressive_alignment

nmap/components-impl

dependabot/go_modules/github.com/jackc/pgx/v5-5.9.2

dependabot/go_modules/github.com/oapi-codegen/runtime-1.4.2

dependabot/go_modules/github.com/gopacket/gopacket-1.6.1

dependabot/go_modules/github.com/coreos/go-oidc/v3-3.19.0

dependabot/go_modules/github.com/pires/go-proxyproto-0.12.0

fix/signal-watchdog-sync-stop

docs/agent-network

test/affected-logic

fix/revert-ice-filter

refactor/simplify-affected-peers

pascal-filter-policies-by-direction

claude/lock-contention-peer-connect-g8t6au

dmitri-filter-policies-by-direction

refactor/migrate-profiles-to-go

profile-bindings-ios

fix/skip-restart-unchanged-route

fix/mgmt-cache-async-resolve

refactor/wails-update-105

client_lifetime_serialization_refactor

fix/browser-ssh-2

fix/ipv6-and-netstack-accept-loop

fix/browser-ssh

profile-id-name-test

refactor/mgmt-bootstrap

feat/getting-started-unified-wizard

socket-grpc-permissions

fix/mysql-index-migration

windows-dns-firewall

tests/enable-race-on-tests

ui-refactor-gtk3

feature/affected-peers-grpc

profile-id

lazyconn-first-packet-fix-v2

claude/focused-gates-VMTgb

ui-tray-linux-leftclick

fix/ctx-enrichment

daemon-owner

feature/android-client-ssh

worktree-accept-ra-forwarding

nmap/combined-deploy

task/align_protobuff_toolset

feature/session-extend

add-json-yaml-flags

refactor/ephemeral-cleanup

claude/webtransport-relay-wasm-mUjY9

claude/vnc-udp-feasibility-6KB1U

fix/wgport-config

e2e-windows-dns-combined

fix/login-cmd-root-flags

feat/reseller-openapi-spec

github-issue-resolver

add-steamos-support

fix-darwin-uninstaller

flutter-test

ci/freebsd-pkg-bootstrap

cached-serial-check-on-sync

fix-mgmt-cache-bypass-overlay

revert-easyjson-5938

revert-ice-5820

revert-firewalld-5928

refactor/permissions-manager

revert-dns-5935-systemd-resolved

revert-dns-5935-5945

revert-dns-5945-mgmt-cache

feature/log-most-busy-peers

prototype/ui-wails

coderabbitai/utg/8ae8f20

feature/use-peer-fqdn-on-https

release/0.68.3

add-slack-channel

claude/rdp-token-passthrough-eNcqW

transparent-proxy

fix/macos-stale-route-eexist

crowdsec-selfhosted

fix/remove-otel-units

entire/checkpoints/v1

fix/getting-started

feat/static-connectors-combined-server

feature/use-local-keys-embedded

feature/fleetdm

set-env-only-if-not-fork

feature/expose-has-channel

fix/connection-status-race

fix/filter-cgnat-cni-ice-candidates

feature/check-cert-locker-before-acme

test/proxy-fixes

test/proxy-mtu

prototype/ui-tauri

test/proxy-speed

fix-reused-ports

feat/migrate-to-embedded-idp

feature/add-serial-to-proxy-merged

deploy/proxy-serial

test/connection

feature/disable-legacy-port

feature/flag-to-disable-legacy-port

test/perftest

fix/http-redirect

poc-token-command

dn-reverse-proxy

prototype/reverse-proxy-rename

prototype/reverse-proxy-logs-pagination

feature/client-metrics

prototype/reverse-proxy-clusters

debug-dns-route

fix/win-dns-batch

add-extra-route-logs

job-stream-notify-disconnection-eof

deploy/secrets-manager

trigger-proxy-update

bug/update-ios-client-code-build-tags

sync-client-netmap-serial

log/conn-disconn

nmap/compaction-deploy

ci-win-test

feature/disk-encryption-check

wasm-debug

swap-dns-prio

fix/dex-config

feature/migrate-auto-groups-to-table

nmap/compaction

dex-nocgo-stub

feature/exclude-terraform-from-rate-limiting

test-freebsd

retries-refactor

coderabbitai/docstrings/b7e98ac

feat/integrate-zitadel

bug/ios-hanging-reconection

zitadel-idp

feat/network-map-serial

refactor/get-account-no-users

feat/auto-upgrade

feature/report-high-pat-id

feature/temporary-access-for-resource

fix/nmap-fwrules

dont-restart-dns

prototype/ui

update-gomobile

go-dns-for-ice

wasm-ldflags

test-ldflags

wasmbuild-test

feature/networks-s2s

vk/compare-nmaps

dbg/bothmaps

reorder-dns-shutdown

fix/relay-reconnection-race

fix/nmap-exitnodes

vk/debug/nmap-both

move-licensed-code

feat/better-daemon-connection-lost-message

feat/auto-update-2

test/timings

refactor/getaccount-raw

tests/nmap-getaccount

refactor/nmap

refactor/nmap-limit-buffer

feature/detect-mac-wakeup

feature/extract-modules

quick-setings

feat/sync-limiter

feature/store-cache-impl

fix-install-version

feature/store-metrics

feature/metrics-on-store

feature/use-gorm-cache

loadtest-signal

unsymmetrical-squash

refactor/reducate-signaling

test/update-reduce

feature/store-cache

feature/remote-debug

cli-ws-proxy-backend-addr

feat/mgmt-map-serial

snyk-fix-d9d0081a4c7f9137bdb59d0d50a141a2

snyk-fix-7415cea5a11acd66753540ca2c598c63

job-yml-update

feature/android-allow-selecting-routes

fix/up-sequence

fix/dns-hash-update

snyk-fix-967adae9863f17f108ce8948d9117b8d

log/getaccount-by-peer

signal-suppressor

dns-exit-node

feature/auto-updates

feature/cache-srv-key

merged-fixes

fix/missed-offers-and-debug

debug-and-fixes

poc-wasm-clean-backend-s2s

test/remote-debug

debug-api

fix/remove-gpo-if-empty

fix/test-freebsd

fix/mysql-setup

fix/remove-logout-btn

handle-existing-domain-user

chore/unify-domain-validation

snyk-fix-c5fafc8a50ce1f29046e25a1fc346185

feat/profile-edit-btn

snyk-fix-a54966211e18d4cf67e5a2757cc006d1

log-short-id

feat/logout-ephemeral

log-checks

batch-wg-ops

nb-interface-default

feat/aws-integration

add/race-test

feature/relay-feature-versioning

fix/systemd-service-logs

poc/preprocessed-map

add-account-onboarding

bind-ipv6

fix/merge-main

logs/peerlogs-addpeer

feature/net-297-network-migration

feature/support-skip-auto-apply-exit-node-routes

set-cmd

set-command-with-cursor

feature/limit-update-channel

stop-using-locking-share

feature/poc-lazy-detection

feature/net-248-removal-of-sync-mutex-locks

test/multiple-peer-logging

preresolve

add-ns-punnycode-support

apply-routes-early

windows-search-domains

fix/connecting-route-filter

feature/management/rest-client/impersonate

debug-local-records

resource-fields-snake-case

test/grpc-rate-limit

traffic-correlation-policy

feature/rest-client-options

feat/events-metrics

feature/buf-cli

test/add-ratelimiter

test/remove-write-lock-on-add-peer

fix/add-peer-semaphore

feature/users-roles-endpoint

mlsmaycon-patch-1

debug-user-role

chore/primary-key-on-networks

feature/update-account-peers-buffer-startup

remove-ubuntu2004-runners

refactor/permissions-no-pat-allowed

ref/logrus-factory

use-conntrack-zone

deploy/permissions-account

feature/lazy-connection-idle

ref/improve-test-cov

restore-pr-3440

test/increase-grpc-timeouts

feat/buffer-account-peers-update

test/networkmapgeneration-changes

feature/base-manager

feature/flow-receiver

chore/benchmark-with-large-runner

refactor/handshake-initiator

client/ui-update-systray-icons

userspace-router

wgwatcher-test

output-if-key-already-exists

fix/relay-reconnection

feature/port-forwarding-client-codecleaning

detached2

test/callbacks-nil-iceconninfo

refactor/optimize-peer-expiration

enable-udp-port-for-docker-template

fix/relay-update

feature/apply-posture-netmap

fix/group-update-existing-resource

conntrack-stats

upgrade-okta-sdk

multi-price

test/conn-stat

set-min-parallel-tests-for-management

dns-interceptor

debug-dns

router-dns

add-static-system-info

debug-0.29.4

debug-0.33.0

account-refactoring

relay/2800_quic

route-get-account-refactoring

test/seed-random-routes

feature/get-account-refactoring

test/reconnect-race-condition

refactor/get-account-usage

feature/add-session-id-to-update-channel

improve-ipv4conn

fix/async-pion-event-handling

debug

add-offload

feature/validate-group-association-debug

fix/limit-conn-for-sqlite

test/engine-iface

test/transaction-for-jwt-sync

fix/engine-stop-in-foreground

feature/add-mysql-support

test-migration

refactor/header-size-values

relay/eliminate-gob

test/signal-dispatcher-with-relay

relay/debug

validate-icon

feature/ipv6-support

use-pre-expanded-peers-map

feature/use-signal-dispatcher

validate/peer-status

add-read-write-times

fix/sync-peer-race

feature/relay-status

netmap

evaluate/network-map-hash

fix/lower-dns-resolve-interval-on-fail

feature/relay

fix/go-mod-version

upgrade-nftables

synology-userspace-mode

fix/use-ip-for-default-routes-on-darwin

fix/proxy_close

enable-release-workflow-on-pr

deploy/peer-performance

feature/permanent-turn

feature/permanent-turn-proxy

deploy/posture-check-sqlite

feature/optimize_sqlite_save

debug-ios-behavior

fix/delete-route-only-after-adding

tshoot/windows-logger

remove-new-routing

refactor/eliminate-repo-dependency

add-arm-to-ci

refactor-demo-account-object

test/abc2

test/abc

send-ssh-rosenpass-config-meta

refactor-demo

ensure-schedule-never-runs-non-positive

feature/peer-validator-groupmgm

feature/peer-validator-fix

fix/include-active-dashboard-users

fix/handle-canceling-schedule

fix/geo-download

debug-google-workspace

yury/resolve-ip-to-location

feature/extend-sysinfo

sqlite-async-peer-status

yury/add-postgresql-store

fix/route

test-build

posture-checks-poc

debug-keycloak-idp

poc/netstack

for-pascal-tmp

peer-logout-management

manual-peer-logout

detached

chore/refactor-management

test/dns-bind

fix/enforce-acl-for-containers

yury/use-sync-map-in-updatechannel

fix/events-key-handling

filter-cache-on-load-account

fix/user-expiration

handle-user-context-cancellation

nb-client-k8s-statefulset

fake-addr

fix/iptables_in_docker

ebpf-debug

update-getting-started-flow-use-postgres

fix/peer_list_notification

feature/device-authentication-with-client-secret

feature/keep_alive

feat-groups-from-jwt

separate_proxy_from_wgconfig

fix/wg_conn

wg_conn_fix

wg_bind_parallel_processing

fix-rollback-get-acls

proxy_cfg_cleanup

performance-improvement-rego

update-lock-log-level

feat-client-side-acl

refactor/move_grpcserver_logic_to_account_manager

feature/event-storage

feature/update-idp-redeeming-invite

feature/api-peer-info

return-groupminimum-setupkey

feature/interface-bind

documentation_enhancement

fix-peer-registration

ssh

users_cache

pass-client-caller

client_caller_type

revert-283-feat-fix-windows-installer

periodic-peer-updates

ebpf

braginini/wasm

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: DYNR/netbird#11556