[GH-ISSUE #651] Netbird behind nginx: stream terminated by RST_STREAM #1195

Open
opened 2026-08-05 00:41:34 -04:00 by saavagebueno · 0 comments
Owner

Originally created by @ykorzikowski on GitHub (Jan 11, 2023).
Original GitHub issue: https://github.com/netbirdio/netbird/issues/651

Hey there,

I am successfully running netbird since couple of months. Some clients cant speak with each other. I am investigating this issue right now and found, that I have errors regarding the signal-service in my client-logs (all clients, also the working ones):

time="2023-01-11T09:50:08+01:00" level=warning msg="disconnected from the Signal service but will retry silently. Reason: rpc error: code = Internal desc = stream terminated by RST_STREAM with error code: PROTOCOL_ERROR" file="grpc.go:144"
time="2023-01-11T09:50:23+01:00" level=info msg="connected to the Signal Service stream" file="grpc.go:136"
time="2023-01-11T09:51:08+01:00" level=warning msg="disconnected from the Signal service but will retry silently. Reason: rpc error: code = Internal desc = stream terminated by RST_STREAM with error code: PROTOCOL_ERROR" file="grpc.go:144"
time="2023-01-11T09:51:23+01:00" level=info msg="connected to the Signal Service stream" file="grpc.go:136"
server{
    listen *:80;
    listen [::]:80;
    server_name  ganymede.redacted.com;

    location / {
        return 301 https://$server_name$request_uri;
    }
}

# Dashboard

server {
    include security.conf;
    listen *:443 ssl http2;
    listen [::]:443 ssl http2;
    server_name ganymede.redacted.com;
    ssl_certificate /etc/letsencrypt/live/ganymede.redacted.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/ganymede.redacted.com/privkey.pem;

    access_log /var/log/nginx/ganymede.redacted.com/netbird.log;
    error_log /var/log/nginx/ganymede.redacted.com/err/netbird.log;

    location / {
        proxy_pass http://10.10.11.199:8080;
        proxy_set_header        X-Real-IP $remote_addr;
        proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header        X-Scheme $scheme;
	proxy_set_header        X-Forwarded-Proto https;
        proxy_set_header        X-Forwarded-Host ganymede.redacted.com;
    }
}

# MGMT HTTPS API

server {
    include security.conf;
    listen *:4443 ssl http2;
    listen [::]:4443 ssl http2;
    server_name ganymede.redacted.com;
    ssl_certificate /etc/letsencrypt/live/ganymede.redacted.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/ganymede.redacted.com/privkey.pem;

    access_log /var/log/nginx/ganymede.redacted.com/netbird-api.log;
    error_log /var/log/nginx/ganymede.redacted.com/err/netbird-api.log;

    location / {
        proxy_pass http://10.10.11.199:8081;
        proxy_set_header        X-Real-IP $remote_addr;
        proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header        X-Scheme $scheme;
	proxy_set_header        X-Forwarded-Proto https;
        proxy_set_header        X-Forwarded-Host ganymede.redacted.com;
    }
}

# MGMT GRPC API

server {
    include security.conf;
    listen *:33073 ssl http2;
    listen [::]:33073 ssl http2;
    server_name ganymede.redacted.com;
    ssl_certificate /etc/letsencrypt/live/ganymede.redacted.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/ganymede.redacted.com/privkey.pem;

    access_log /var/log/nginx/ganymede.redacted.com/netbird-grpc.log;
    error_log /var/log/nginx/ganymede.redacted.com/err/netbird-grpc.log;

    location / {
        grpc_pass grpc://10.10.11.199:33074;
        grpc_read_timeout 3600s;
    }
}

# Signal GRPC API

server {
    include security.conf;
    listen *:10000 ssl http2;
    listen [::]:10000 ssl http2;
    server_name ganymede.redacted.com;
    ssl_certificate /etc/letsencrypt/live/ganymede.redacted.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/ganymede.redacted.com/privkey.pem;

    access_log /var/log/nginx/ganymede.redacted.com/netbird-signal.log;
    error_log /var/log/nginx/ganymede.redacted.com/err/netbird-signal.log;

    location / {
        grpc_pass grpc://10.10.11.199:10001;
        grpc_read_timeout 3600s;
	grpc_ssl_verify off;
    }
}

Is there a recommendation how to run the netbird service? Like my config or everythin on port 443 like https://github.com/netbirdio/netbird/issues/536 ?

Thank you for any help :)

Originally created by @ykorzikowski on GitHub (Jan 11, 2023). Original GitHub issue: https://github.com/netbirdio/netbird/issues/651 Hey there, I am successfully running netbird since couple of months. Some clients cant speak with each other. I am investigating this issue right now and found, that I have errors regarding the signal-service in my client-logs (all clients, also the working ones): ``` time="2023-01-11T09:50:08+01:00" level=warning msg="disconnected from the Signal service but will retry silently. Reason: rpc error: code = Internal desc = stream terminated by RST_STREAM with error code: PROTOCOL_ERROR" file="grpc.go:144" time="2023-01-11T09:50:23+01:00" level=info msg="connected to the Signal Service stream" file="grpc.go:136" time="2023-01-11T09:51:08+01:00" level=warning msg="disconnected from the Signal service but will retry silently. Reason: rpc error: code = Internal desc = stream terminated by RST_STREAM with error code: PROTOCOL_ERROR" file="grpc.go:144" time="2023-01-11T09:51:23+01:00" level=info msg="connected to the Signal Service stream" file="grpc.go:136" ``` ``` server{ listen *:80; listen [::]:80; server_name ganymede.redacted.com; location / { return 301 https://$server_name$request_uri; } } # Dashboard server { include security.conf; listen *:443 ssl http2; listen [::]:443 ssl http2; server_name ganymede.redacted.com; ssl_certificate /etc/letsencrypt/live/ganymede.redacted.com/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/ganymede.redacted.com/privkey.pem; access_log /var/log/nginx/ganymede.redacted.com/netbird.log; error_log /var/log/nginx/ganymede.redacted.com/err/netbird.log; location / { proxy_pass http://10.10.11.199:8080; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Scheme $scheme; proxy_set_header X-Forwarded-Proto https; proxy_set_header X-Forwarded-Host ganymede.redacted.com; } } # MGMT HTTPS API server { include security.conf; listen *:4443 ssl http2; listen [::]:4443 ssl http2; server_name ganymede.redacted.com; ssl_certificate /etc/letsencrypt/live/ganymede.redacted.com/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/ganymede.redacted.com/privkey.pem; access_log /var/log/nginx/ganymede.redacted.com/netbird-api.log; error_log /var/log/nginx/ganymede.redacted.com/err/netbird-api.log; location / { proxy_pass http://10.10.11.199:8081; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Scheme $scheme; proxy_set_header X-Forwarded-Proto https; proxy_set_header X-Forwarded-Host ganymede.redacted.com; } } # MGMT GRPC API server { include security.conf; listen *:33073 ssl http2; listen [::]:33073 ssl http2; server_name ganymede.redacted.com; ssl_certificate /etc/letsencrypt/live/ganymede.redacted.com/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/ganymede.redacted.com/privkey.pem; access_log /var/log/nginx/ganymede.redacted.com/netbird-grpc.log; error_log /var/log/nginx/ganymede.redacted.com/err/netbird-grpc.log; location / { grpc_pass grpc://10.10.11.199:33074; grpc_read_timeout 3600s; } } # Signal GRPC API server { include security.conf; listen *:10000 ssl http2; listen [::]:10000 ssl http2; server_name ganymede.redacted.com; ssl_certificate /etc/letsencrypt/live/ganymede.redacted.com/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/ganymede.redacted.com/privkey.pem; access_log /var/log/nginx/ganymede.redacted.com/netbird-signal.log; error_log /var/log/nginx/ganymede.redacted.com/err/netbird-signal.log; location / { grpc_pass grpc://10.10.11.199:10001; grpc_read_timeout 3600s; grpc_ssl_verify off; } } ``` Is there a recommendation how to run the netbird service? Like my config or everythin on port 443 like https://github.com/netbirdio/netbird/issues/536 ? Thank you for any help :)
saavagebueno added the bugclientmanagement-service labels 2026-08-05 00:41:34 -04:00
Sign in to join this conversation.
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: DYNR/netbird#1195