[GH-ISSUE #5959] Netbird always reports peer public IPs as Nginx Proxy Manager proxy IP instead of real client IP #12557

Closed
opened 2026-08-05 02:06:10 -04:00 by saavagebueno · 2 comments
Owner

Originally created by @olivero2013 on GitHub (Apr 21, 2026).
Original GitHub issue: https://github.com/netbirdio/netbird/issues/5959

Describe the problem

When running a self-hosted NetBird control plane behind a reverse proxy (Nginx Proxy Manager), the server always detects the client IP as the proxy’s internal IP instead of the real public client IP.

This occurs even when following the official NetBird reverse proxy configuration and setting trustedHTTPProxies.

To Reproduce

Steps to reproduce the behavior:

Deploy NetBird (self-hosted) using the standard configuration
Place NetBird behind Nginx Proxy Manager (separate host)
Apply the official NetBird Nginx configuration (including WebSocket, gRPC, and forwarded headers)
Configure reverseProxy.trustedHTTPProxies with the proxy’s IP
Connect a client to the NetBird instance
Observe that the detected client IP is always the proxy IP instead of the real client IP

Expected behavior

NetBird should correctly detect and report the real client IP address using the X-Forwarded-For header when the proxy is listed under trustedHTTPProxies.

Are you using NetBird Cloud?

No; self-hosted control plane

NetBird version

Management: v0.69.0
Dashboard: v2.37.0

Is any other VPN software installed?

No

Debug output

To help us resolve the problem, please attach the following anonymized status output

Peers detail:
Events:
[INFO] SYSTEM (da548b10-fb61-4ddf-8a2c-76cf1cadcd01)
Message: Network map updated
Time: 22 hours, 5 minutes ago
[INFO] SYSTEM (3278d45e-6feb-4074-80fc-1d28a4821a7b)
Message: Network map updated
Time: 22 hours ago
[INFO] SYSTEM (598bf1cb-9903-4f33-bc19-a344db7de4c2)
Message: Network map updated
Time: 21 hours, 58 minutes ago
[INFO] SYSTEM (d66cadde-f19d-4c32-9894-bcc05b66ae91)
Message: Network map updated
Time: 21 hours, 58 minutes ago
[INFO] SYSTEM (842eb690-99ef-41f4-804a-b3969fd80f0e)
Message: Network map updated
Time: 21 hours, 58 minutes ago
[INFO] SYSTEM (3c6ddf2e-1ffb-47f0-b957-50889b9c3890)
Message: Network map updated
Time: 21 hours, 57 minutes ago
[INFO] SYSTEM (20c8c1d1-a418-4b64-b502-61bfb9f3b0f1)
Message: Network map updated
Time: 21 hours, 50 minutes ago
[INFO] SYSTEM (3f088f5a-8b18-4ff3-9783-95afd915dd8f)
Message: Network map updated
Time: 24 minutes, 3 seconds ago
[INFO] SYSTEM (44b7c7ef-5c59-4b38-ab1b-609ec4644879)
Message: Network map updated
Time: 23 minutes, 51 seconds ago
[INFO] SYSTEM (b504be80-abcc-486f-885a-36481c37f605)
Message: Network map updated
Time: 19 minutes, 53 seconds ago
OS: windows/amd64
Daemon version: 0.69.0
CLI version: 0.69.0
Profile: default
Management: Connected to https://netbird.3dstuff.anon-UB01Y.domain:443
Signal: Connected to https://netbird.3dstuff.anon-UB01Y.domain:443
Relays:
[stun:netbird.3dstuff.anon-UB01Y.domain:3478] is Checking...
[rels://netbird.3dstuff.anon-UB01Y.domain:443] is Available
Nameservers:
FQDN: laptop-tnljhdms.netbird.selfhosted
NetBird IP: 100.105.154.126/16
Interface type: Userspace
Quantum resistance: false
Lazy connection: false
SSH Server: Disabled
Networks: -
Peers count: 0/0 Connected

Return Key: c8fec5a4c4b8e0fcdecdadfde0e364f683bc8e2803058c4121b4071c88910ebc/b7c8a203-e765-48d1-be3f-777b007eb406

Screenshots

Image Image

Additional context

Reverse proxy: Nginx Proxy Manager (on separate host)

NetBird config includes:

reverseProxy:
trustedHTTPProxies:
- "192.168.10.13/32"

Nginx configuration includes:

proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
Traffic flow:
Client → Internet → NPM → NetBird
Issue persists even after confirming:
Correct proxy IP
Proper headers are being sent
No additional upstream proxies (e.g., Cloudflare)

It is unclear whether:

NetBird is expected to use X-Forwarded-For for client IP detection
or if this behavior is intentional/limitation when using reverse proxies like Nginx

Originally created by @olivero2013 on GitHub (Apr 21, 2026). Original GitHub issue: https://github.com/netbirdio/netbird/issues/5959 **Describe the problem** When running a self-hosted NetBird control plane behind a reverse proxy (Nginx Proxy Manager), the server always detects the client IP as the proxy’s internal IP instead of the real public client IP. This occurs even when following the official NetBird reverse proxy configuration and setting trustedHTTPProxies. **To Reproduce** Steps to reproduce the behavior: Deploy NetBird (self-hosted) using the standard configuration Place NetBird behind Nginx Proxy Manager (separate host) Apply the official NetBird Nginx configuration (including WebSocket, gRPC, and forwarded headers) Configure reverseProxy.trustedHTTPProxies with the proxy’s IP Connect a client to the NetBird instance Observe that the detected client IP is always the proxy IP instead of the real client IP **Expected behavior** NetBird should correctly detect and report the real client IP address using the X-Forwarded-For header when the proxy is listed under trustedHTTPProxies. **Are you using NetBird Cloud?** No; self-hosted control plane **NetBird version** Management: v0.69.0 Dashboard: v2.37.0 **Is any other VPN software installed?** No **Debug output** To help us resolve the problem, please attach the following anonymized status output Peers detail: Events: [INFO] SYSTEM (da548b10-fb61-4ddf-8a2c-76cf1cadcd01) Message: Network map updated Time: 22 hours, 5 minutes ago [INFO] SYSTEM (3278d45e-6feb-4074-80fc-1d28a4821a7b) Message: Network map updated Time: 22 hours ago [INFO] SYSTEM (598bf1cb-9903-4f33-bc19-a344db7de4c2) Message: Network map updated Time: 21 hours, 58 minutes ago [INFO] SYSTEM (d66cadde-f19d-4c32-9894-bcc05b66ae91) Message: Network map updated Time: 21 hours, 58 minutes ago [INFO] SYSTEM (842eb690-99ef-41f4-804a-b3969fd80f0e) Message: Network map updated Time: 21 hours, 58 minutes ago [INFO] SYSTEM (3c6ddf2e-1ffb-47f0-b957-50889b9c3890) Message: Network map updated Time: 21 hours, 57 minutes ago [INFO] SYSTEM (20c8c1d1-a418-4b64-b502-61bfb9f3b0f1) Message: Network map updated Time: 21 hours, 50 minutes ago [INFO] SYSTEM (3f088f5a-8b18-4ff3-9783-95afd915dd8f) Message: Network map updated Time: 24 minutes, 3 seconds ago [INFO] SYSTEM (44b7c7ef-5c59-4b38-ab1b-609ec4644879) Message: Network map updated Time: 23 minutes, 51 seconds ago [INFO] SYSTEM (b504be80-abcc-486f-885a-36481c37f605) Message: Network map updated Time: 19 minutes, 53 seconds ago OS: windows/amd64 Daemon version: 0.69.0 CLI version: 0.69.0 Profile: default Management: Connected to https://netbird.3dstuff.anon-UB01Y.domain:443 Signal: Connected to https://netbird.3dstuff.anon-UB01Y.domain:443 Relays: [stun:netbird.3dstuff.anon-UB01Y.domain:3478] is Checking... [rels://netbird.3dstuff.anon-UB01Y.domain:443] is Available Nameservers: FQDN: laptop-tnljhdms.netbird.selfhosted NetBird IP: 100.105.154.126/16 Interface type: Userspace Quantum resistance: false Lazy connection: false SSH Server: Disabled Networks: - Peers count: 0/0 Connected Return Key: c8fec5a4c4b8e0fcdecdadfde0e364f683bc8e2803058c4121b4071c88910ebc/b7c8a203-e765-48d1-be3f-777b007eb406 **Screenshots** <img width="554" height="303" alt="Image" src="https://github.com/user-attachments/assets/f63fdd22-79ec-48cc-b908-91cc503bf86e" /> <img width="793" height="1119" alt="Image" src="https://github.com/user-attachments/assets/4f59ee66-06a3-4551-899a-a30877cec5c9" /> **Additional context** Reverse proxy: Nginx Proxy Manager (on separate host) NetBird config includes: reverseProxy: trustedHTTPProxies: - "192.168.10.13/32" Nginx configuration includes: proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; Traffic flow: Client → Internet → NPM → NetBird Issue persists even after confirming: Correct proxy IP Proper headers are being sent No additional upstream proxies (e.g., Cloudflare) It is unclear whether: NetBird is expected to use X-Forwarded-For for client IP detection or if this behavior is intentional/limitation when using reverse proxies like Nginx
saavagebueno added the triage-needed label 2026-08-05 02:06:10 -04:00
Author
Owner

@robbsta commented on GitHub (May 5, 2026):

Had the same issues.
I solved it by adding the grpc-headers into the second location block.
Works for all remote-clients that are not on the same docker-host as the server.

location ~ ^/(signalexchange.... {
....
    grpc_set_header X-Real-IP $remote_addr;
    grpc_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    grpc_set_header X-Forwarded-Proto $scheme;
...
}
<!-- gh-comment-id:4383385696 --> @robbsta commented on GitHub (May 5, 2026): Had the same issues. I solved it by adding the grpc-headers into the second location block. Works for all remote-clients that are not on the same docker-host as the server. ``` location ~ ^/(signalexchange.... { .... grpc_set_header X-Real-IP $remote_addr; grpc_set_header X-Forwarded-For $proxy_add_x_forwarded_for; grpc_set_header X-Forwarded-Proto $scheme; ... } ```
Author
Owner

@olivero2013 commented on GitHub (May 5, 2026):

Thank you, that fixed it

<!-- gh-comment-id:4383719658 --> @olivero2013 commented on GitHub (May 5, 2026): Thank you, that fixed it
Sign in to join this conversation.
No Label triage-needed
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: DYNR/netbird#12557