[GH-ISSUE #3627] Can't reach docker containers #7264

Open
opened 2026-08-05 01:12:14 -04:00 by saavagebueno · 7 comments
Owner

Originally created by @serversathome-personal on GitHub (Apr 6, 2025).
Original GitHub issue: https://github.com/netbirdio/netbird/issues/3627

Originally assigned to: @nazarewk on GitHub.

Describe the problem

Hey all. I have a question about subnet routing. I am running a netbird client on bare metal on an ubuntu server 10.245.0.244. When I connect from a remote client (my phone) I can reach services running on 10.245.0.244 like webmin on port 10000 but anything I have running on docker is inaccessible. Does anyone know why this is?

To Reproduce

Steps to reproduce the behavior:

  1. create network route
  2. add peer
  3. connect from phone
  4. attempt to access 10.245.0.244:5055 (dockge)

Expected behavior

I should be able to pull up the webUI.

Are you using NetBird Cloud?
Yes

NetBird version

0.39.2

Is any other VPN software installed?

no

We advise reviewing the anonymized output for any remaining personal information.

Screenshots

If applicable, add screenshots to help explain your problem.

Additional context

Add any other context about the problem here.

Have you tried these troubleshooting steps?

  • Checked for newer NetBird versions
  • Searched for similar issues on GitHub (including closed ones)
  • Restarted the NetBird client
  • Disabled other VPN software
  • Checked firewall settings
Originally created by @serversathome-personal on GitHub (Apr 6, 2025). Original GitHub issue: https://github.com/netbirdio/netbird/issues/3627 Originally assigned to: @nazarewk on GitHub. **Describe the problem** Hey all. I have a question about subnet routing. I am running a netbird client on bare metal on an ubuntu server 10.245.0.244. When I connect from a remote client (my phone) I can reach services running on 10.245.0.244 like webmin on port 10000 but anything I have running on docker is inaccessible. Does anyone know why this is? **To Reproduce** Steps to reproduce the behavior: 1. create network route 2. add peer 3. connect from phone 4. attempt to access 10.245.0.244:5055 (dockge) **Expected behavior** I should be able to pull up the webUI. **Are you using NetBird Cloud?** Yes **NetBird version** 0.39.2 **Is any other VPN software installed?** no We advise reviewing the anonymized output for any remaining personal information. **Screenshots** If applicable, add screenshots to help explain your problem. **Additional context** Add any other context about the problem here. **Have you tried these troubleshooting steps?** - [x] Checked for newer NetBird versions - [x] Searched for similar issues on GitHub (including closed ones) - [x] Restarted the NetBird client - [x] Disabled other VPN software - [x] Checked firewall settings
saavagebueno added the triage-needed label 2026-08-05 01:12:14 -04:00
Author
Owner

@ghost commented on GitHub (Apr 6, 2025):

i could not reproduce this problem.
Did you add those other ports to your access policies?
Did you try to connect from a non-mobile device?
Are you aware mobile browsers block certain ports for security reasons?

I started a docker container on ubuntu server (docker run -p 8000:8000 webserver), added an access control policy and connected without problems.

<!-- gh-comment-id:2781719730 --> @ghost commented on GitHub (Apr 6, 2025): i could not reproduce this problem. Did you add those other ports to your access policies? Did you try to connect from a non-mobile device? Are you aware mobile browsers block certain ports for security reasons? I started a docker container on ubuntu server (docker run -p 8000:8000 webserver), added an access control policy and connected without problems.
Author
Owner

@serversathome-personal commented on GitHub (Apr 7, 2025):

@md-dfir huh. yes i also tried from my browser via desktop. my access policy is default right now, which is ALL:ALL. there are no traffic restrictions at all. i was able to produce this in various ways - running the connector bare metal on ubuntu, in a docker container with network_mode: host on ubuntu & on truenas.

do I need a special access control policy to make this work?

<!-- gh-comment-id:2782793669 --> @serversathome-personal commented on GitHub (Apr 7, 2025): @md-dfir huh. yes i also tried from my browser via desktop. my access policy is default right now, which is ALL:ALL. there are no traffic restrictions at all. i was able to produce this in various ways - running the connector bare metal on ubuntu, in a docker container with `network_mode: host` on ubuntu & on truenas. do I need a special access control policy to make this work?
Author
Owner

@nazarewk commented on GitHub (Apr 7, 2025):

@imjustleaving

What kind of Netbird-side setup do you have in terms of Networks, Network Routes & Access Control rules? The more details you provide the faster we will be able to help or reproduce the issue.

<!-- gh-comment-id:2782837834 --> @nazarewk commented on GitHub (Apr 7, 2025): @imjustleaving What kind of Netbird-side setup do you have in terms of Networks, Network Routes & Access Control rules? The more details you provide the faster we will be able to help or reproduce the issue.
Author
Owner

@serversathome-personal commented on GitHub (Apr 7, 2025):

@nazarewk here is an example of trying to get to my home net through netbird setup in docker on truenas. i am running over 40 containers in truenas and all i can reach is the webui running on baremetal (port 81). i have disabled proxmox bc there is nothing running on that, so when i set it to 1 i can reach all of my truenas containers since its not using the truenas peer. as soon as i switch it so truenas is the only available peer it fails to reach any containers. the active policy is the default one, so ALL:ALL.

again, I can reproduce this in a number of ways, including doing it with the peer running on bare metal ubuntu, so i know its not a truenas/docker issue. (well, it is a docker issue in that it only affects docker containers being reached not how the peer is connecting).

Image

services:
  netbird:
    cap_add:
      - NET_ADMIN
    container_name: netbird
    environment:
      - NB_SETUP_KEY=[redacted]
    image: netbirdio/netbird:latest
    network_mode: host
    restart: unless-stopped
    volumes:
      - ./netbird-client:/etc/netbird

Image

<!-- gh-comment-id:2782859918 --> @serversathome-personal commented on GitHub (Apr 7, 2025): @nazarewk here is an example of trying to get to my home net through netbird setup in docker on truenas. i am running over 40 containers in truenas and all i can reach is the webui running on baremetal (port 81). i have disabled proxmox bc there is nothing running on that, so when i set it to `1` i can reach all of my truenas containers since its not using the truenas peer. as soon as i switch it so truenas is the only available peer it fails to reach any containers. the active policy is the default one, so ALL:ALL. again, I can reproduce this in a number of ways, including doing it with the peer running on bare metal ubuntu, so i know its not a truenas/docker issue. (well, it is a docker issue in that it only affects docker containers being reached not how the peer is connecting). ![Image](https://github.com/user-attachments/assets/a3a4f6bd-9a81-4cfd-92a5-90987360d815) ``` services: netbird: cap_add: - NET_ADMIN container_name: netbird environment: - NB_SETUP_KEY=[redacted] image: netbirdio/netbird:latest network_mode: host restart: unless-stopped volumes: - ./netbird-client:/etc/netbird ``` ![Image](https://github.com/user-attachments/assets/71989f2b-ca40-48a0-80ca-c0200acda662)
Author
Owner

@nazarewk commented on GitHub (Apr 7, 2025):

  1. I don't think you have enough capabilities enabled on the client, see https://github.com/netbirdio/netbird/issues/3478#issuecomment-2720834750
  2. I don't think Network Resources can work with just All group, can you try with creating a dedicated group while naming it explicitly inside Access Control Policy?
<!-- gh-comment-id:2783514919 --> @nazarewk commented on GitHub (Apr 7, 2025): 1. I don't think you have enough capabilities enabled on the client, see https://github.com/netbirdio/netbird/issues/3478#issuecomment-2720834750 2. I don't think Network Resources can work with just `All` group, can you try with creating a _dedicated_ group while naming it explicitly inside Access Control Policy?
Author
Owner

@serversathome-personal commented on GitHub (Apr 7, 2025):

@nazarewk

  1. i saw this before. i just added all of those to the truenas clients running in docker. no change. also, i dont think this is the root of the issue because i have the same problem when i am running the connector on the peer bare metal, which shouldnt need any of those since they are particular to docker containers.
  2. again, i dont think this is the issue. i can reach all my docker containers in a subnet as long as the peer im connecting to isnt hosting the containers. for example, if i have two peers publishing a subnet route (in my case a proxmox ubuntu lxc and a truenas docker container) i can reach all of the docker containers on truenas when connecting from proxmox, but not when i am connecting via truenas. so i know its not a group issue or i would not be able to reach the containers at all from any endpoint.
<!-- gh-comment-id:2783771557 --> @serversathome-personal commented on GitHub (Apr 7, 2025): @nazarewk 1. i saw this before. i just added all of those to the truenas clients running in docker. **no change**. also, i dont think this is the root of the issue because i have the same problem when i am running the connector on the peer bare metal, which shouldnt need any of those since they are particular to docker containers. 2. again, i dont think this is the issue. i can reach all my docker containers in a subnet as long as the peer im connecting to isnt hosting the containers. for example, if i have two peers publishing a subnet route (in my case a proxmox ubuntu lxc and a truenas docker container) i can reach all of the docker containers on truenas when connecting from proxmox, but **not** when i am connecting via truenas. so i know its not a group issue or i would not be able to reach the containers at all from any endpoint.
Author
Owner
<!-- gh-comment-id:2832248421 --> @nimdasx commented on GitHub (Apr 26, 2025): i thinks this issue related to - https://github.com/netbirdio/netbird/issues/2701 - https://github.com/netbirdio/netbird/issues/3017 - https://github.com/netbirdio/netbird/issues/3579
Sign in to join this conversation.
No Label triage-needed
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: DYNR/netbird#7264