[GH-ISSUE #5892] netbird-proxy keeps crashing | invalid domain format: #12249

Open
opened 2026-08-05 01:32:43 -04:00 by saavagebueno · 5 comments
Owner

Originally created by @Aiakio on GitHub (Apr 15, 2026).
Original GitHub issue: https://github.com/netbirdio/netbird/issues/5892

Describe the problem

netbird-proxy keeps crashing

To Reproduce

Steps to reproduce the behavior:

  1. Try to install via [...]/getting-started.sh | bash
  2. Get error Error starting userland proxy: listen tcp4 0.0.0.0:443: listen: address already in use
  3. Change traefik ports to 8480:80 & 8433:443 in the docker-compose.yaml
  4. docker-compose up -d
  5. See log

Expected behavior

No crashes

Are you using NetBird Cloud?

Self-hosted NetBird

NetBird version

latest

Is any other VPN software installed?

No

Log

2026-04-15 09:20:50 2026-04-15 09:20:50 INFO proxy/cmd/proxy/cmd/root.go:142: configured log level: info
2026-04-15 09:20:50 Error: invalid domain value "": invalid domain format: 
[netbird-proxy] 2026-04-15 09:19:51 2026-04-15 09:19:51 INFO proxy/cmd/proxy/cmd/root.go:142: configured log level: info
[netbird-proxy] 2026-04-15 09:19:51 Error: invalid domain value "": invalid domain format: 

Additional context

-

Have you tried these troubleshooting steps?

  • Reviewed client troubleshooting (if applicable)
  • Checked for newer NetBird versions
  • Searched for similar issues on GitHub (including closed ones)
  • Restarted the NetBird client
  • Disabled other VPN software
  • Checked firewall settings
Originally created by @Aiakio on GitHub (Apr 15, 2026). Original GitHub issue: https://github.com/netbirdio/netbird/issues/5892 **Describe the problem** `netbird-proxy` keeps crashing **To Reproduce** Steps to reproduce the behavior: 1. Try to install via `[...]/getting-started.sh | bash` 2. Get error `Error starting userland proxy: listen tcp4 0.0.0.0:443: listen: address already in use` 3. Change traefik ports to `8480:80` & `8433:443` in the docker-compose.yaml 4. `docker-compose up -d` 5. See log **Expected behavior** No crashes **Are you using NetBird Cloud?** Self-hosted NetBird **NetBird version** `latest` **Is any other VPN software installed?** No **Log** ``` 2026-04-15 09:20:50 2026-04-15 09:20:50 INFO proxy/cmd/proxy/cmd/root.go:142: configured log level: info 2026-04-15 09:20:50 Error: invalid domain value "": invalid domain format: [netbird-proxy] 2026-04-15 09:19:51 2026-04-15 09:19:51 INFO proxy/cmd/proxy/cmd/root.go:142: configured log level: info [netbird-proxy] 2026-04-15 09:19:51 Error: invalid domain value "": invalid domain format: ``` **Additional context** \- **Have you tried these troubleshooting steps?** - [x] Reviewed [client troubleshooting](https://docs.netbird.io/how-to/troubleshooting-client) (if applicable) - [x] Checked for newer NetBird versions - [x] Searched for similar issues on GitHub (including closed ones) - [x] Restarted the NetBird client - [x] Disabled other VPN software - [x] Checked firewall settings
saavagebueno added the triage-needed label 2026-08-05 01:32:43 -04:00
Author
Owner

@Zydepoint commented on GitHub (Apr 18, 2026):

same issue here, no changes to the configuration that should affect the domain at all, there is no variable missing in my config from what i can see

<!-- gh-comment-id:4273985081 --> @Zydepoint commented on GitHub (Apr 18, 2026): same issue here, no changes to the configuration that should affect the domain at all, there is no variable missing in my config from what i can see
Author
Owner

@xpufx commented on GitHub (Apr 19, 2026):

I think this is happening because the getting-started script is broken. There are bug reports about it getting stuck with "waiting for ... server". Because this happens the script does not complete. We all thought it didn't matter because the dashboard works. However, at a later step proxy.env is supposed to be populated and this never happens. There's a template in the script to populate it with some variables for domain and such. But more importantly there's a token that needs to go in there.

Here's how to create the token

docker compose exec -T netbird-server /go/bin/netbird-server token create --name "default-proxy"
--config /etc/netbird/config.yaml

It will return something like this:

WARN[0000] The "NETBIRD_DOMAIN" variable is not set. Defaulting to a blank string.
WARN[0000] The "PROXY_TOKEN" variable is not set. Defaulting to a blank string.
WARN[0000] The "TRAEFIK_IP" variable is not set. Defaulting to a blank string.
Token created successfully!
Token: nbx_efqbKfrOXY2luma9aMVCHKRqeVqcOU0Uehls

IMPORTANT: Save this token now. It will not be shown again.
Token ID: d7idu5o11tv0040e4cn0

Copy the Token (not Token ID) string and plug it into proxy.env which should look like this.

# NetBird Proxy Configuration
NB_PROXY_DEBUG_LOGS=false
# Use internal Docker network to connect to management (avoids hairpin NAT issues)
NB_PROXY_MANAGEMENT_ADDRESS=http://netbird-server:80
# Allow insecure gRPC connection to management (required for internal Docker network)
NB_PROXY_ALLOW_INSECURE=true
# Public URL where this proxy is reachable (used for cluster registration)
NB_PROXY_DOMAIN=$NETBIRD_DOMAIN
NB_PROXY_ADDRESS=:8443
NB_PROXY_TOKEN=nbx_efqbKfrOXY2luma9aMVCHKRqeVqcOU0Uehls
NB_PROXY_CERTIFICATE_DIRECTORY=/certs
NB_PROXY_ACME_CERTIFICATES=true
NB_PROXY_ACME_CHALLENGE_TYPE=tls-alpn-01
NB_PROXY_FORWARDED_PROTO=https
# Enable PROXY protocol to preserve client IPs through L4 proxies (Traefik TCP passthrough)
NB_PROXY_PROXY_PROTOCOL=true
# Trust Traefik's IP for PROXY protocol headers
NB_PROXY_TRUSTED_PROXIES=$TRAEFIK_IP

I am not sure if this is sufficient to have the $NETBIRD_DOMAIN and $TRAEFIK_IP variables to be picked up but I am not getting that error anymore. (Haven't tested actual proxy functionality)

EDIT: I did have to manually set the missing variables NB_PROXY_DOMAIN and NB_PROXY_TRUSTED_PROXIES (this latter one is currently 172.30.0.10. It's in the docker compose file.

<!-- gh-comment-id:4276063635 --> @xpufx commented on GitHub (Apr 19, 2026): I think this is happening because the getting-started script is broken. There are bug reports about it getting stuck with "waiting for ... server". Because this happens the script does not complete. We all thought it didn't matter because the dashboard works. However, at a later step proxy.env is supposed to be populated and this never happens. There's a template in the script to populate it with some variables for domain and such. But more importantly there's a token that needs to go in there. Here's how to create the token ``` docker compose exec -T netbird-server /go/bin/netbird-server token create --name "default-proxy" --config /etc/netbird/config.yaml ``` It will return something like this: > > WARN[0000] The "NETBIRD_DOMAIN" variable is not set. Defaulting to a blank string. > WARN[0000] The "PROXY_TOKEN" variable is not set. Defaulting to a blank string. > WARN[0000] The "TRAEFIK_IP" variable is not set. Defaulting to a blank string. > Token created successfully! > Token: nbx_efqbKfrOXY2luma9aMVCHKRqeVqcOU0Uehls > > IMPORTANT: Save this token now. It will not be shown again. > Token ID: d7idu5o11tv0040e4cn0 Copy the Token (not Token ID) string and plug it into proxy.env which should look like this. ``` # NetBird Proxy Configuration NB_PROXY_DEBUG_LOGS=false # Use internal Docker network to connect to management (avoids hairpin NAT issues) NB_PROXY_MANAGEMENT_ADDRESS=http://netbird-server:80 # Allow insecure gRPC connection to management (required for internal Docker network) NB_PROXY_ALLOW_INSECURE=true # Public URL where this proxy is reachable (used for cluster registration) NB_PROXY_DOMAIN=$NETBIRD_DOMAIN NB_PROXY_ADDRESS=:8443 NB_PROXY_TOKEN=nbx_efqbKfrOXY2luma9aMVCHKRqeVqcOU0Uehls NB_PROXY_CERTIFICATE_DIRECTORY=/certs NB_PROXY_ACME_CERTIFICATES=true NB_PROXY_ACME_CHALLENGE_TYPE=tls-alpn-01 NB_PROXY_FORWARDED_PROTO=https # Enable PROXY protocol to preserve client IPs through L4 proxies (Traefik TCP passthrough) NB_PROXY_PROXY_PROTOCOL=true # Trust Traefik's IP for PROXY protocol headers NB_PROXY_TRUSTED_PROXIES=$TRAEFIK_IP ``` I am not sure if this is sufficient to have the $NETBIRD_DOMAIN and $TRAEFIK_IP variables to be picked up but I am not getting that error anymore. (Haven't tested actual proxy functionality) EDIT: I did have to manually set the missing variables NB_PROXY_DOMAIN and NB_PROXY_TRUSTED_PROXIES (this latter one is currently 172.30.0.10. It's in the docker compose file.
Author
Owner

@Zydepoint commented on GitHub (Apr 21, 2026):

I think this is happening because the getting-started script is broken. There are bug reports about it getting stuck with "waiting for ... server". Because this happens the script does not complete. We all thought it didn't matter because the dashboard works. However, at a later step proxy.env is supposed to be populated and this never happens. There's a template in the script to populate it with some variables for domain and such. But more importantly there's a token that needs to go in there.

This worked!

<!-- gh-comment-id:4288183486 --> @Zydepoint commented on GitHub (Apr 21, 2026): > I think this is happening because the getting-started script is broken. There are bug reports about it getting stuck with "waiting for ... server". Because this happens the script does not complete. We all thought it didn't matter because the dashboard works. However, at a later step proxy.env is supposed to be populated and this never happens. There's a template in the script to populate it with some variables for domain and such. But more importantly there's a token that needs to go in there. This worked!
Author
Owner

@GrapeFruitStudioUK commented on GitHub (Jun 9, 2026):

FYI I had this issue and it turned out that the server was unable to pass the check in the script to test whether the netbird container was up, it does this by doing a curl on the EXTERNAL DNS name of your installation. If I went to the DNS name e.g. netbird.example.com on a separate machine I got the webUI and everything was working but from the server itself, nothing. Now in my case I needed to add a hairpin NAT rule on my router to get this test to pass otherwise it would just hang on "Waiting for ... server" I did try @ypufx's fix but it turns out there ends up being a lot more that is broken if the install script doesn't finish. This is just a note for anyone else who may end up with the fact that the server is up, accessible but the install hangs at this point because the server can't see itself.

<!-- gh-comment-id:4660097247 --> @GrapeFruitStudioUK commented on GitHub (Jun 9, 2026): FYI I had this issue and it turned out that the server was unable to pass the check in the script to test whether the netbird container was up, it does this by doing a curl on the EXTERNAL DNS name of your installation. If I went to the DNS name e.g. netbird.example.com on a separate machine I got the webUI and everything was working but from the server itself, nothing. Now in my case I needed to add a hairpin NAT rule on my router to get this test to pass otherwise it would just hang on "Waiting for ... server" I did try @ypufx's fix but it turns out there ends up being a lot more that is broken if the install script doesn't finish. This is just a note for anyone else who may end up with the fact that the server is up, accessible but the install hangs at this point because the server can't see itself.
Author
Owner

@CoderSufiyan commented on GitHub (Jul 13, 2026):

PR https://github.com/netbirdio/netbird/pull/6754 adds an internal container-name health-check fallback so the script completes even without hairpin NAT, preventing proxy.env from being left empty.

<!-- gh-comment-id:4960531413 --> @CoderSufiyan commented on GitHub (Jul 13, 2026): PR https://github.com/netbirdio/netbird/pull/6754 adds an internal container-name health-check fallback so the script completes even without hairpin NAT, preventing proxy.env from being left empty.
Sign in to join this conversation.
No Label triage-needed
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: DYNR/netbird#12249