[GH-ISSUE #5821] L4-Reverse Proxy: Allow forwarding of multiple ports/ranges for one subdomain. #12067

Open
opened 2026-08-05 01:32:20 -04:00 by saavagebueno · 15 comments
Owner

Originally created by @DasRaschloch on GitHub (Apr 7, 2026).
Original GitHub issue: https://github.com/netbirdio/netbird/issues/5821

Is your feature request related to a problem? Please describe.
You cannot map more than one udp or tcp port to one subdomain/Service.

For example: Application A needs the udp ports 5000-5030 and tcp port 447 forwarded.

Currently i have to create 31 rules just for this application, where each rule also uses a different subdomain.
This technically works fine, due to each domain resolving to the correct IP (wildcard cert). But it gets convoluted and complex really quick if you need multiple ports for multiple applications.

Describe the solution you'd like

A) Being able to forward multiple ports within one service to one subdomain.

It would be simpler, if you were able to create one service that allows multiple ports and ranges. Layoutwise i would envision something similar to the current HTTP(S) Services tab, where you add different ports or port ranges instead of new targets.

Something like:

Domain: app.mydomain.com
Target: Peer 1
Ports:
Rule 1 [TCP 1111 => 1111]
Rule 2 [UDP 1112 => 2222]
Rule 1 [TCP 1000-1050 => 1000-1050]
Rule 1 [TCP 2000-2050 => 5000-5050]

B) Allow the user to make multiple rules for one Subdomain, as long as they dont cause port conflicts.

If i host multiple applications it is easier to create one Service for each, so i can toggle them on or off on the fly instead of manually removing ports.

Additional context
What i mean by the HTTP-Target-UI

Image
Originally created by @DasRaschloch on GitHub (Apr 7, 2026). Original GitHub issue: https://github.com/netbirdio/netbird/issues/5821 **Is your feature request related to a problem? Please describe.** You cannot map more than one udp or tcp port to one subdomain/Service. For example: `Application A needs the udp ports 5000-5030 and tcp port 447 forwarded.` Currently i have to create 31 rules just for this application, where each rule also uses a different subdomain. This technically works fine, due to each domain resolving to the correct IP (wildcard cert). But it gets convoluted and complex really quick if you need multiple ports for multiple applications. **Describe the solution you'd like** #### A) Being able to forward multiple ports within one service to one subdomain. It would be simpler, if you were able to create one service that allows multiple ports and ranges. Layoutwise i would envision something similar to the current HTTP(S) Services tab, where you add different ports or port ranges instead of new targets. Something like: ``` Domain: app.mydomain.com Target: Peer 1 Ports: Rule 1 [TCP 1111 => 1111] Rule 2 [UDP 1112 => 2222] Rule 1 [TCP 1000-1050 => 1000-1050] Rule 1 [TCP 2000-2050 => 5000-5050] ``` #### B) Allow the user to make multiple rules for one Subdomain, as long as they dont cause port conflicts. If i host multiple applications it is easier to create one Service for each, so i can toggle them on or off on the fly instead of manually removing ports. **Additional context** What i mean by the HTTP-Target-UI <img width="501" height="429" alt="Image" src="https://github.com/user-attachments/assets/f9b509c2-68a3-4ebd-b2c8-ed121c4d847c" />
saavagebueno added the feature-request label 2026-08-05 01:32:20 -04:00
Author
Owner

@Monkey-Business-2020 commented on GitHub (Apr 11, 2026):

Yeah I’m needing this as well! For example I’m trying to run RustDesk which I’m using the self hosted version. I can’t point 21114-21119 to remote-server.domain.uk ports 21114-21119.

I can add the first one fine. Try to add a second and I get “this subdomain already exists” error message.

Image

<!-- gh-comment-id:4230245457 --> @Monkey-Business-2020 commented on GitHub (Apr 11, 2026): Yeah I’m needing this as well! For example I’m trying to run RustDesk which I’m using the self hosted version. I can’t point 21114-21119 to remote-server.domain.uk ports 21114-21119. I can add the first one fine. Try to add a second and I get “this subdomain already exists” error message. ![Image](https://github.com/user-attachments/assets/58c0b5ff-8626-499b-8712-b45acb9440b9)
Author
Owner

@DasRaschloch commented on GitHub (Apr 11, 2026):

@Monkey-Business-2020 You can assign the other ports to other domains, for example remote-server1, remote-server2 etc.. In Portforwarding the domain is irrelevant, due to it resolving to the same IP.

<!-- gh-comment-id:4230263081 --> @DasRaschloch commented on GitHub (Apr 11, 2026): @Monkey-Business-2020 You can assign the other ports to other domains, for example remote-server1, remote-server2 etc.. In Portforwarding the domain is irrelevant, due to it resolving to the same IP.
Author
Owner

@Monkey-Business-2020 commented on GitHub (Apr 11, 2026):

Tried this and it doesn’t seem to work for RustDesk. I believe the client uses a range of different ports for different parts of the communications.

It’s funnelling it all to remote-server.domain.uk but if I start tying different subdomains in NetBird, then I also have to set them subdomains in the RustDesk config somehow.

<!-- gh-comment-id:4230322431 --> @Monkey-Business-2020 commented on GitHub (Apr 11, 2026): Tried this and it doesn’t seem to work for RustDesk. I believe the client uses a range of different ports for different parts of the communications. It’s funnelling it all to remote-server.domain.uk but if I start tying different subdomains in NetBird, then I also have to set them subdomains in the RustDesk config somehow.
Author
Owner

@DasRaschloch commented on GitHub (Apr 11, 2026):

if you use a wildcard cname any subdomain resolves to the same ip unless you have a static record overwriting this for a specific subdomain. So it shouldnt matter to which domain you tell netbird to bind the ports to, as rustdesk willl resolve the ip internally anyway and plain tcp-L4 wont track to which domain the package was supposed to go. the reverse proxy just sees incoming traffic on port x, and forwards it to service y according to the set rules.

<!-- gh-comment-id:4230330843 --> @DasRaschloch commented on GitHub (Apr 11, 2026): if you use a wildcard cname any subdomain resolves to the same ip unless you have a static record overwriting this for a specific subdomain. So it shouldnt matter to which domain you tell netbird to bind the ports to, as rustdesk willl resolve the ip internally anyway and plain tcp-L4 wont track to which domain the package was supposed to go. the reverse proxy just sees incoming traffic on port x, and forwards it to service y according to the set rules.
Author
Owner

@palandri commented on GitHub (May 12, 2026):

+1, this is an important feature to me too!

<!-- gh-comment-id:4430376243 --> @palandri commented on GitHub (May 12, 2026): +1, this is an important feature to me too!
Author
Owner

@Mupu commented on GitHub (May 27, 2026):

+1, would be awesome

<!-- gh-comment-id:4557827425 --> @Mupu commented on GitHub (May 27, 2026): +1, would be awesome
Author
Owner

@ghosty2004 commented on GitHub (May 30, 2026):

+1, I would also need this feature

<!-- gh-comment-id:4582031668 --> @ghosty2004 commented on GitHub (May 30, 2026): +1, I would also need this feature
Author
Owner

@da-wilky commented on GitHub (May 30, 2026):

+1 I would love to see creating one Service and applying it different port forwards for multiple ports, ranges and different protocols (both udp and tcp), so one can create one service with all ports that are needed for that service

<!-- gh-comment-id:4583158964 --> @da-wilky commented on GitHub (May 30, 2026): +1 I would love to see creating one Service and applying it different port forwards for multiple ports, ranges and different protocols (both udp and tcp), so one can create one service with all ports that are needed for that service
Author
Owner

@loepperts commented on GitHub (Jun 16, 2026):

+1 :D

<!-- gh-comment-id:4717301615 --> @loepperts commented on GitHub (Jun 16, 2026): +1 :D
Author
Owner

@SleazeStiKs commented on GitHub (Jun 16, 2026):

+1 needed for Fluxer to work

<!-- gh-comment-id:4719163850 --> @SleazeStiKs commented on GitHub (Jun 16, 2026): +1 needed for Fluxer to work
Author
Owner

@mrandre79 commented on GitHub (Jun 17, 2026):

+1

<!-- gh-comment-id:4730128871 --> @mrandre79 commented on GitHub (Jun 17, 2026): +1
Author
Owner

@aturkenov commented on GitHub (Jun 18, 2026):

+1

<!-- gh-comment-id:4747491975 --> @aturkenov commented on GitHub (Jun 18, 2026): +1
Author
Owner

@sonalys commented on GitHub (Jun 19, 2026):

Please stop commenting +1. It floods everyone who is subscribed to the discussion with spam.
If you want the functionality, just give it a thumbs up.

<!-- gh-comment-id:4749176717 --> @sonalys commented on GitHub (Jun 19, 2026): Please stop commenting +1. It floods everyone who is subscribed to the discussion with spam. If you want the functionality, just give it a thumbs up.
Author
Owner

@Monkey-Business-2020 commented on GitHub (Jun 19, 2026):

Please stop commenting +1. It floods everyone who is subscribed to the discussion with spam. If you want the functionality, just give it a thumbs up.

+1

<!-- gh-comment-id:4749421105 --> @Monkey-Business-2020 commented on GitHub (Jun 19, 2026): > Please stop commenting +1. It floods everyone who is subscribed to the discussion with spam. If you want the functionality, just give it a thumbs up. +1
Author
Owner

@heywander commented on GitHub (Jul 21, 2026):

+1 btw

<!-- gh-comment-id:5035026995 --> @heywander commented on GitHub (Jul 21, 2026): +1 btw
Sign in to join this conversation.
No Label feature-request
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: DYNR/netbird#12067