[GH-ISSUE #4149] All queries to the upstream failed #8137

Open
opened 2026-08-05 01:16:10 -04:00 by saavagebueno · 1 comment
Owner

Originally created by @LuposX on GitHub (Jul 15, 2025).
Original GitHub issue: https://github.com/netbirdio/netbird/issues/4149

Describe the problem

I am using NetBird on three devices: my laptop, my phone, and a Raspberry Pi in my home network, which I use as an exit node. From both my phone and laptop, I have access to the local resources inside my home network provided by the Raspberry Pi. If I enable the exit node for my phone, everything still works — I can access local resources and have the correct IP address for the exit node. However, on my laptop, if I enable the exit node, I can neither access local resources nor the internet anymore. When checking the errors, I get All queries to the upstream failed. I am using the official NetBird management server.

Without any DNS nameserver set up in NetBird management:

Jul 14 13:24:40 pneuma netbird[44021]: 2025-07-14T13:24:40+02:00 INFO client/internal/routemanager/client/client.go:250: New chosen route is d1qchtrl0ubs7382jfhg with peer T0bfr6dRA9wIAu/EHZoLtDClWkII71IYEcfVD85pX0k= with score 111110.001000 for network [0.0.0.0/0]
Jul 14 13:24:42 pneuma netbird[44021]: 2025-07-14T13:24:42+02:00 ERRO [request_id: 336bcf32] client/internal/dns/upstream.go:161: all queries to the upstream [] failed for question domain=...
Jul 14 13:24:44 pneuma netbird[44021]: 2025-07-14T13:24:44+02:00 ERRO [request_id: 7a20efdd] client/internal/dns/upstream.go:161: all queries to the upstream [] failed for question domain=app.netbird.io.
Jul 14 13:24:46 pneuma netbird[44021]: 2025-07-14T13:24:46+02:00 INFO [peer: 5ImeVn0DW7sXMdxoaOu9xCZ0Mr0eSczncP5IMNgGeik=] client/internal/peer/

With Google DNS nameserver set up, I get the following error:

Jul 15 10:04:34 pneuma netbird[955]: 2025-07-15T10:04:34+02:00 ERRO [request_id: 984dfc5e] client/internal/dns/upstream.go:161: all queries to the upstream [8.8.8.8:53 8.8.4.4:53] failed for question doma>
Jul 15 10:04:34 pneuma netbird[955]: 2025-07-15T10:04:34+02:00 WARN [request_id: ed3b9798] client/internal/dns/upstream.go:138: upstream 8.8.4.4:53 timed out for question domain=example.org.

To Reproduce

Steps to reproduce the behavior:

  1. On the Raspberry Pi with NixOS, install NetBird using Docker like this:
{ config, pkgs, ... }: let
  hostname = config.var.hostname;
in {
  virtualisation.docker.enable = true;

  systemd.services.netbird-docker = {
    description = "NetBird client in Docker";
    after = [ "network-online.target" "docker.service" ];
    wants = [ "network-online.target" ];
    wantedBy = [ "multi-user.target" ];
    serviceConfig = {
      Type = "simple";
      Restart = "always";
      ExecStart = ''
        ${pkgs.docker}/bin/docker run \
          --network host \
          --privileged \
          --rm \
          --name netbird-client-${hostname} \
          -e NB_SETUP_KEY_FILE=/run/secrets/netbird-setup-key \
          -v /var/lib/netbird:/etc/netbird \
          -v /run/secrets/netbird-setup-key:/run/secrets/netbird-setup-key:ro \
          netbirdio/netbird:latest
      '';
      ExecStop = "${pkgs.docker}/bin/docker stop netbird-client-${hostname} || true";
    };
  };

  # Ensure the persistent volume directory exists
  systemd.tmpfiles.rules = [
    "d /var/lib/netbird 0700 root root -"
  ];

  # Make sure Docker is pulled during activation (optional)
  system.activationScripts.pullNetbirdImage = ''
    ${pkgs.docker}/bin/docker pull netbirdio/netbird:latest || true
  '';

  # This is needed, I think, for exit nodes.
  boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
  networking = {
    nat = {
      enable = true;
      internalInterfaces = [ "wt0" ];  # NetBird wg interface
      externalInterface = "eth0";
    };

    firewall = {
      checkReversePath = "loose";

      extraCommands = ''
        iptables -t nat -A POSTROUTING -s 100.71.0.0/16 -d 192.168.12.0/24 -j MASQUERADE
      '';

      allowedTCPPorts = [
        443
      ];

      allowedUDPPorts = [
        80
        443
        3478
        5555
        51820
      ];
    };
  };
}
  1. On the laptop (NixOS), install NetBird:
{ pkgs, ... }: {
  services.netbird.enable = true; # for NetBird service & CLI
  environment.systemPackages = [ pkgs.netbird-ui ]; # for GUI
}
  1. Set up the Raspberry Pi as an exit node.
  2. On the laptop, activate the exit node — notice there is no access to the internet or local resources. The phone with the exit node active works.

Are you using NetBird Cloud?

I am using NetBird Cloud.

NetBird version

  • Laptop: 0.49
  • Phone: 0.50.3
  • Raspberry Pi: 0.50.3

Is any other VPN software installed?

No

Debug output

When exit node is enabled on the laptop:

Peers detail:
 logos.netbird.cloud:
  NetBird IP: 100.71.32.250/32
  Public key: P7VfRVp/ALxwQA5+t+c76ez86RbLqzloy/kRIvRoxHg=
  Status: Idle
  -- detail --
  Connection type:
  ICE candidate (Local/Remote): -/-
  ICE candidate endpoints (Local/Remote): -/-
  Relay server address:
  Last connection update: 2 minutes, 31 seconds ago
  Last WireGuard handshake: -
  Transfer status (received/sent) 0 B/0 B
  Quantum resistance: false
  Networks: -
  Latency: 0s

 phone.netbird.cloud:
  NetBird IP: 100.71.54.118
  Public key: Snea0W09mQP8Th5dW6ANosHBUuiLUOFh8JjUM4iZwXo=
  Status: Connecting
  -- detail --
  Connection type:
  ICE candidate (Local/Remote): -/-
  ICE candidate endpoints (Local/Remote): -/-
  Relay server address:
  Last connection update: 13 minutes, 37 seconds ago
  Last WireGuard handshake: -
  Transfer status (received/sent) 0 B/0 B
  Quantum resistance: false
  Networks: -
  Latency: 0s

 prohairesis.netbird.cloud:
  NetBird IP: 100.71.111.46
  Public key: 5ImeVn0DW7sXMdxoaOu9xCZ0Mr0eSczncP5IMNgGeik=
  Status: Connecting
  -- detail --
  Connection type:
  ICE candidate (Local/Remote): -/-
  ICE candidate endpoints (Local/Remote): -/-
  Relay server address:
  Last connection update: 31 seconds ago
  Last WireGuard handshake: -
  Transfer status (received/sent) 0 B/0 B
  Quantum resistance: false
  Networks: -
  Latency: 221.455102ms

 promox.netbird.cloud:
  NetBird IP: 100.71.231.170
  Public key: T0bfr6dRA9wIAu/EHZoLtDClWkII71IYEcfVD85pX0k=
  Status: Connecting
  -- detail --
  Connection type:
  ICE candidate (Local/Remote): -/-
  ICE candidate endpoints (Local/Remote): -/-
  Relay server address:
  Last connection update: 27 seconds ago
  Last WireGuard handshake: -
  Transfer status (received/sent) 0 B/0 B
  Quantum resistance: false
  Networks: -
  Latency: 0s

Events:
  [INFO] NETWORK (148fbf76-3b25-4623-b185-a5c1f5b1c88a)
    Message: Default route added
    Time: 9 minutes, 44 seconds ago
    Metadata: id: Exit Node, network: 0.0.0.0/0, peer: T0bfr6dRA9wIAu/EHZoLtDClWkII71IYEcfVD85pX0k=
  [WARNING] DNS (3124d33d-9d47-47e0-b29e-40c9c7d5dec6)
    Message: All upstream servers failed (fail count exceeded)
    Time: 9 minutes, 21 seconds ago
    Metadata: upstreams: 8.8.8.8:53, 8.8.4.4:53
  [WARNING] NETWORK (ec1534b4-3066-4455-ab58-5d03c9d5e1aa)
    Message: Default route disconnected due to peer unreachability
    Time: 8 minutes, 56 seconds ago
    Metadata: id: Exit Node, network: 0.0.0.0/0, peer: T0bfr6dRA9wIAu/EHZoLtDClWkII71IYEcfVD85pX0k=
  [INFO] SYSTEM (e448032a-67e8-446d-b0fb-52c60688fc81)
    Message: Network deselection changed
    Time: 4 minutes, 5 seconds ago
    Metadata: all: false, append: false, networks: Exit Node
  [INFO] SYSTEM (fa5343b2-5f17-43c1-843b-e5e91c2276ce)
    Message: Network map updated
    Time: 2 minutes, 31 seconds ago
  [INFO] SYSTEM (d0d52f16-e57d-41f6-b3aa-d9b2a0e1d683)
    Message: Network selection changed
    Time: 1 minute, 12 seconds ago
    Metadata: all: false, append: true, networks: Exit Node
  [INFO] NETWORK (5c780c97-6404-4984-877f-e36fc193a600)
    Message: Default route added
    Time: 1 minute, 12 seconds ago
    Metadata: id: Exit Node, network: 0.0.0.0/0, peer: T0bfr6dRA9wIAu/EHZoLtDClWkII71IYEcfVD85pX0k=
  [INFO] NETWORK (7645b4d0-8db6-4b7d-bf05-8f9ca026c4d5)
    Message: Default route added
    Time: 1 minute, 12 seconds ago
    Metadata: id: Exit Node, network: 0.0.0.0/0, peer: T0bfr6dRA9wIAu/EHZoLtDClWkII71IYEcfVD85pX0k=
  [WARNING] DNS (4f0807ac-75c8-4a69-bda3-4c9788bfb79d)
    Message: All upstream servers failed (fail count exceeded)
    Time: 1 minute, 7 seconds ago
    Metadata: upstreams: 8.8.8.8:53, 8.8.4.4:53
  [WARNING] NETWORK (6554d1d9-0884-4737-8913-15764cddd0ba)
    Message: Default route disconnected due to peer unreachability
    Time: 27 seconds ago
    Metadata: id: Exit Node, network: 0.0.0.0/0, peer: T0bfr6dRA9wIAu/EHZoLtDClWkII71IYEcfVD85pX0k=
OS: linux/amd64
Daemon version: 0.49.0
CLI version: 0.49.0
Management: Disconnected, reason: rpc error: code = Unavailable desc = keepalive ping failed to receive ACK within timeout
Signal: Disconnected, reason: rpc error: code = Unavailable desc = keepalive ping failed to receive ACK within timeout
Relays:
  [stun:stun.netbird.io:443] is Unavailable, reason: dial: failed to listen: d.Dialer.DialContext: dial udp: lookup stun.netbird.io: Temporary failure in name resolution
  [stun:stun.netbird.io:5555] is Unavailable, reason: dial: failed to listen: d.Dialer.DialContext: dial udp: lookup stun.netbird.io: Temporary failure in name resolution
  [turns:turn.netbird.io:443?transport=tcp] is Unavailable, reason: dial: d.Dialer.DialContext: dial tcp: lookup turn.netbird.io: i/o timeout
  [rels://relay.netbird.io:443] is Unavailable, reason: relay connection is not established
Nameservers:
  [8.8.8.8:53, 8.8.4.4:53] for [.] is Unavailable, reason: with udp: read udp 100.71.255.179:47142->8.8.4.4:53: i/o timeout
FQDN: pneuma.netbird.cloud
NetBird IP: 100.71.255.179/16
Interface type: Kernel
Quantum resistance: false
Lazy connection: false
Networks: -
Forwarding rules: 0
Peers count: 0/4 Connected

When exit node is disabled on the laptop:



Peers detail:
 logos.netbird.cloud:
  NetBird IP: 100.71.32.250/32
  Public key: P7VfRVp/ALxwQA5+t+c76ez86RbLqzloy/kRIvRoxHg=
  Status: Idle
  -- detail --
  Connection type:
  ICE candidate (Local/Remote): -/-
  ICE candidate endpoints (Local/Remote): -/-
  Relay server address:
  Last connection update: 3 seconds ago
  Last WireGuard handshake: -
  Transfer status (received/sent) 0 B/0 B
  Quantum resistance: false
  Networks: -
  Latency: 0s

 phone.netbird.cloud:
  NetBird IP: 100.71.54.118
  Public key: Snea0W09mQP8Th5dW6ANosHBUuiLUOFh8JjUM4iZwXo=
  Status: Connecting
  -- detail --
  Connection type:
  ICE candidate (Local/Remote): -/-
  ICE candidate endpoints (Local/Remote): -/-
  Relay server address:
  Last connection update: 14 minutes, 38 seconds ago
  Last WireGuard handshake: -
  Transfer status (received/sent) 0 B/0 B
  Quantum resistance: false
  Networks: -
  Latency: 0s

 prohairesis.netbird.cloud:
  NetBird IP: 100.71.111.46
  Public key: 5ImeVn0DW7sXMdxoaOu9xCZ0Mr0eSczncP5IMNgGeik=
  Status: Connected
  -- detail --
  Connection type: P2P
  ICE candidate (Local/Remote): srflx/prflx
  ICE candidate endpoints (Local/Remote): 198.51.100.0:51820/198.51.100.1:51820
  Relay server address: rels://streamline-de-fra1-0.relay.netbird.io:443
  Last connection update: 1 second ago
  Last WireGuard handshake: 3 minutes, 48 seconds ago
  Transfer status (received/sent) 2.0 KiB/2.6 KiB
  Quantum resistance: false
  Networks: 192.168.12.0/24
  Latency: 221.455102ms

 promox.netbird.cloud:
  NetBird IP: 100.71.231.170
  Public key: T0bfr6dRA9wIAu/EHZoLtDClWkII71IYEcfVD85pX0k=
  Status: Connected
  -- detail --
  Connection type: Relayed
  ICE candidate (Local/Remote): -/-
  ICE candidate endpoints (Local/Remote): -/-
  Relay server address: rels://streamline-de-fra1-2.relay.netbird.io:443
  Last connection update: 2 seconds ago
  Last WireGuard handshake: 3 minutes, 48 seconds ago
  Transfer status (received/sent) 92 B/6.2 KiB
  Quantum resistance: false
  Networks: -
  Latency: 0s

Events:
  [WARNING] NETWORK (ec1534b4-3066-4455-ab58-5d03c9d5e1aa)
    Message: Default route disconnected due to peer unreachability
    Time: 9 minutes, 57 seconds ago
    Metadata: id: Exit Node, network: 0.0.0.0/0, peer: T0bfr6dRA9wIAu/EHZoLtDClWkII71IYEcfVD85pX0k=
  [INFO] SYSTEM (e448032a-67e8-446d-b0fb-52c60688fc81)
    Message: Network deselection changed
    Time: 5 minutes, 6 seconds ago
    Metadata: all: false, append: false, networks: Exit Node
  [INFO] SYSTEM (fa5343b2-5f17-43c1-843b-e5e91c2276ce)
    Message: Network map updated
    Time: 3 minutes, 32 seconds ago
  [INFO] SYSTEM (d0d52f16-e57d-41f6-b3aa-d9b2a0e1d683)
    Message: Network selection changed
    Time: 2 minutes, 13 seconds ago
    Metadata: all: false, append: true, networks: Exit Node
  [INFO] NETWORK (5c780c97-6404-4984-877f-e36fc193a600)
    Message: Default route added
    Time: 2 minutes, 13 seconds ago
    Metadata: id: Exit Node, network: 0.0.0.0/0, peer: T0bfr6dRA9wIAu/EHZoLtDClWkII71IYEcfVD85pX0k=
  [INFO] NETWORK (7645b4d0-8db6-4b7d-bf05-8f9ca026c4d5)
    Message: Default route added
    Time: 2 minutes, 13 seconds ago
    Metadata: id: Exit Node, network: 0.0.0.0/0, peer: T0bfr6dRA9wIAu/EHZoLtDClWkII71IYEcfVD85pX0k=
  [WARNING] DNS (4f0807ac-75c8-4a69-bda3-4c9788bfb79d)
    Message: All upstream servers failed (fail count exceeded)
    Time: 2 minutes, 8 seconds ago
    Metadata: upstreams: 8.8.8.8:53, 8.8.4.4:53
  [WARNING] NETWORK (6554d1d9-0884-4737-8913-15764cddd0ba)
    Message: Default route disconnected due to peer unreachability
    Time: 1 minute, 28 seconds ago
    Metadata: id: Exit Node, network: 0.0.0.0/0, peer: T0bfr6dRA9wIAu/EHZoLtDClWkII71IYEcfVD85pX0k=
  [INFO] SYSTEM (eef61845-abea-4ec7-b094-7402845d0991)
    Message: Network deselection changed
    Time: 13 seconds ago
    Metadata: all: false, append: false, networks: Exit Node
  [INFO] SYSTEM (50f2288b-3a5d-4989-9b7f-34432a70a694)
    Message: Network map updated
    Time: 2 seconds ago
OS: linux/amd64
Daemon version: 0.49.0
CLI version: 0.49.0
Management: Disconnected, reason: EOF
Signal: Connected to https://signal.netbird.io:443
Relays:
  [stun:stun.netbird.io:443] is Available
  [stun:stun.netbird.io:5555] is Unavailable, reason: stun request: context deadline exceeded
  [turns:turn.netbird.io:443?transport=tcp] is Available
  [rels://streamline-de-fra1-0.relay.netbird.io:443] is Available
Nameservers:
  [8.8.8.8:53, 8.8.4.4:53] for [.] is Unavailable, reason: with udp: read udp 100.71.255.179:47142->8.8.4.4:53: i/o timeout
FQDN: pneuma.netbird.cloud
NetBird IP: 100.71.255.179/16
Interface type: Kernel
Quantum resistance: false
Lazy connection: false
Networks: -
Forwarding rules: 0
Peers count: 2/4 Connected

Uploaded files are automatically deleted after 30 days.

netbird.debug.3877729573.zip

Have you tried these troubleshooting steps?

  • Reviewed client troubleshooting (if applicable)
  • Checked for newer NetBird versions
  • Searched for similar issues on GitHub (including closed ones)
  • Restarted the NetBird client
  • Disabled other VPN software
  • Checked firewall settings
Originally created by @LuposX on GitHub (Jul 15, 2025). Original GitHub issue: https://github.com/netbirdio/netbird/issues/4149 **Describe the problem** I am using NetBird on three devices: my laptop, my phone, and a Raspberry Pi in my home network, which I use as an exit node. From both my phone and laptop, I have access to the local resources inside my home network provided by the Raspberry Pi. If I enable the exit node for my phone, everything still works — I can access local resources and have the correct IP address for the exit node. However, on my laptop, if I enable the exit node, I can neither access local resources nor the internet anymore. When checking the errors, I get `All queries to the upstream failed`. I am using the official NetBird management server. Without any DNS nameserver set up in NetBird management: ```sh Jul 14 13:24:40 pneuma netbird[44021]: 2025-07-14T13:24:40+02:00 INFO client/internal/routemanager/client/client.go:250: New chosen route is d1qchtrl0ubs7382jfhg with peer T0bfr6dRA9wIAu/EHZoLtDClWkII71IYEcfVD85pX0k= with score 111110.001000 for network [0.0.0.0/0] Jul 14 13:24:42 pneuma netbird[44021]: 2025-07-14T13:24:42+02:00 ERRO [request_id: 336bcf32] client/internal/dns/upstream.go:161: all queries to the upstream [] failed for question domain=... Jul 14 13:24:44 pneuma netbird[44021]: 2025-07-14T13:24:44+02:00 ERRO [request_id: 7a20efdd] client/internal/dns/upstream.go:161: all queries to the upstream [] failed for question domain=app.netbird.io. Jul 14 13:24:46 pneuma netbird[44021]: 2025-07-14T13:24:46+02:00 INFO [peer: 5ImeVn0DW7sXMdxoaOu9xCZ0Mr0eSczncP5IMNgGeik=] client/internal/peer/ ``` With Google DNS nameserver set up, I get the following error: ```sh Jul 15 10:04:34 pneuma netbird[955]: 2025-07-15T10:04:34+02:00 ERRO [request_id: 984dfc5e] client/internal/dns/upstream.go:161: all queries to the upstream [8.8.8.8:53 8.8.4.4:53] failed for question doma> Jul 15 10:04:34 pneuma netbird[955]: 2025-07-15T10:04:34+02:00 WARN [request_id: ed3b9798] client/internal/dns/upstream.go:138: upstream 8.8.4.4:53 timed out for question domain=example.org. ``` **To Reproduce** Steps to reproduce the behavior: 1. On the Raspberry Pi with NixOS, install NetBird using Docker like this: ```nix { config, pkgs, ... }: let hostname = config.var.hostname; in { virtualisation.docker.enable = true; systemd.services.netbird-docker = { description = "NetBird client in Docker"; after = [ "network-online.target" "docker.service" ]; wants = [ "network-online.target" ]; wantedBy = [ "multi-user.target" ]; serviceConfig = { Type = "simple"; Restart = "always"; ExecStart = '' ${pkgs.docker}/bin/docker run \ --network host \ --privileged \ --rm \ --name netbird-client-${hostname} \ -e NB_SETUP_KEY_FILE=/run/secrets/netbird-setup-key \ -v /var/lib/netbird:/etc/netbird \ -v /run/secrets/netbird-setup-key:/run/secrets/netbird-setup-key:ro \ netbirdio/netbird:latest ''; ExecStop = "${pkgs.docker}/bin/docker stop netbird-client-${hostname} || true"; }; }; # Ensure the persistent volume directory exists systemd.tmpfiles.rules = [ "d /var/lib/netbird 0700 root root -" ]; # Make sure Docker is pulled during activation (optional) system.activationScripts.pullNetbirdImage = '' ${pkgs.docker}/bin/docker pull netbirdio/netbird:latest || true ''; # This is needed, I think, for exit nodes. boot.kernel.sysctl."net.ipv4.ip_forward" = 1; networking = { nat = { enable = true; internalInterfaces = [ "wt0" ]; # NetBird wg interface externalInterface = "eth0"; }; firewall = { checkReversePath = "loose"; extraCommands = '' iptables -t nat -A POSTROUTING -s 100.71.0.0/16 -d 192.168.12.0/24 -j MASQUERADE ''; allowedTCPPorts = [ 443 ]; allowedUDPPorts = [ 80 443 3478 5555 51820 ]; }; }; } ``` 3. On the laptop (NixOS), install NetBird: ```nix { pkgs, ... }: { services.netbird.enable = true; # for NetBird service & CLI environment.systemPackages = [ pkgs.netbird-ui ]; # for GUI } ``` 5. Set up the Raspberry Pi as an exit node. 6. On the laptop, activate the exit node — notice there is no access to the internet or local resources. The phone with the exit node active works. **Are you using NetBird Cloud?** I am using NetBird Cloud. **NetBird version** * Laptop: 0.49 * Phone: 0.50.3 * Raspberry Pi: 0.50.3 **Is any other VPN software installed?** No **Debug output** When exit node is enabled on the laptop: ```sh Peers detail: logos.netbird.cloud: NetBird IP: 100.71.32.250/32 Public key: P7VfRVp/ALxwQA5+t+c76ez86RbLqzloy/kRIvRoxHg= Status: Idle -- detail -- Connection type: ICE candidate (Local/Remote): -/- ICE candidate endpoints (Local/Remote): -/- Relay server address: Last connection update: 2 minutes, 31 seconds ago Last WireGuard handshake: - Transfer status (received/sent) 0 B/0 B Quantum resistance: false Networks: - Latency: 0s phone.netbird.cloud: NetBird IP: 100.71.54.118 Public key: Snea0W09mQP8Th5dW6ANosHBUuiLUOFh8JjUM4iZwXo= Status: Connecting -- detail -- Connection type: ICE candidate (Local/Remote): -/- ICE candidate endpoints (Local/Remote): -/- Relay server address: Last connection update: 13 minutes, 37 seconds ago Last WireGuard handshake: - Transfer status (received/sent) 0 B/0 B Quantum resistance: false Networks: - Latency: 0s prohairesis.netbird.cloud: NetBird IP: 100.71.111.46 Public key: 5ImeVn0DW7sXMdxoaOu9xCZ0Mr0eSczncP5IMNgGeik= Status: Connecting -- detail -- Connection type: ICE candidate (Local/Remote): -/- ICE candidate endpoints (Local/Remote): -/- Relay server address: Last connection update: 31 seconds ago Last WireGuard handshake: - Transfer status (received/sent) 0 B/0 B Quantum resistance: false Networks: - Latency: 221.455102ms promox.netbird.cloud: NetBird IP: 100.71.231.170 Public key: T0bfr6dRA9wIAu/EHZoLtDClWkII71IYEcfVD85pX0k= Status: Connecting -- detail -- Connection type: ICE candidate (Local/Remote): -/- ICE candidate endpoints (Local/Remote): -/- Relay server address: Last connection update: 27 seconds ago Last WireGuard handshake: - Transfer status (received/sent) 0 B/0 B Quantum resistance: false Networks: - Latency: 0s Events: [INFO] NETWORK (148fbf76-3b25-4623-b185-a5c1f5b1c88a) Message: Default route added Time: 9 minutes, 44 seconds ago Metadata: id: Exit Node, network: 0.0.0.0/0, peer: T0bfr6dRA9wIAu/EHZoLtDClWkII71IYEcfVD85pX0k= [WARNING] DNS (3124d33d-9d47-47e0-b29e-40c9c7d5dec6) Message: All upstream servers failed (fail count exceeded) Time: 9 minutes, 21 seconds ago Metadata: upstreams: 8.8.8.8:53, 8.8.4.4:53 [WARNING] NETWORK (ec1534b4-3066-4455-ab58-5d03c9d5e1aa) Message: Default route disconnected due to peer unreachability Time: 8 minutes, 56 seconds ago Metadata: id: Exit Node, network: 0.0.0.0/0, peer: T0bfr6dRA9wIAu/EHZoLtDClWkII71IYEcfVD85pX0k= [INFO] SYSTEM (e448032a-67e8-446d-b0fb-52c60688fc81) Message: Network deselection changed Time: 4 minutes, 5 seconds ago Metadata: all: false, append: false, networks: Exit Node [INFO] SYSTEM (fa5343b2-5f17-43c1-843b-e5e91c2276ce) Message: Network map updated Time: 2 minutes, 31 seconds ago [INFO] SYSTEM (d0d52f16-e57d-41f6-b3aa-d9b2a0e1d683) Message: Network selection changed Time: 1 minute, 12 seconds ago Metadata: all: false, append: true, networks: Exit Node [INFO] NETWORK (5c780c97-6404-4984-877f-e36fc193a600) Message: Default route added Time: 1 minute, 12 seconds ago Metadata: id: Exit Node, network: 0.0.0.0/0, peer: T0bfr6dRA9wIAu/EHZoLtDClWkII71IYEcfVD85pX0k= [INFO] NETWORK (7645b4d0-8db6-4b7d-bf05-8f9ca026c4d5) Message: Default route added Time: 1 minute, 12 seconds ago Metadata: id: Exit Node, network: 0.0.0.0/0, peer: T0bfr6dRA9wIAu/EHZoLtDClWkII71IYEcfVD85pX0k= [WARNING] DNS (4f0807ac-75c8-4a69-bda3-4c9788bfb79d) Message: All upstream servers failed (fail count exceeded) Time: 1 minute, 7 seconds ago Metadata: upstreams: 8.8.8.8:53, 8.8.4.4:53 [WARNING] NETWORK (6554d1d9-0884-4737-8913-15764cddd0ba) Message: Default route disconnected due to peer unreachability Time: 27 seconds ago Metadata: id: Exit Node, network: 0.0.0.0/0, peer: T0bfr6dRA9wIAu/EHZoLtDClWkII71IYEcfVD85pX0k= OS: linux/amd64 Daemon version: 0.49.0 CLI version: 0.49.0 Management: Disconnected, reason: rpc error: code = Unavailable desc = keepalive ping failed to receive ACK within timeout Signal: Disconnected, reason: rpc error: code = Unavailable desc = keepalive ping failed to receive ACK within timeout Relays: [stun:stun.netbird.io:443] is Unavailable, reason: dial: failed to listen: d.Dialer.DialContext: dial udp: lookup stun.netbird.io: Temporary failure in name resolution [stun:stun.netbird.io:5555] is Unavailable, reason: dial: failed to listen: d.Dialer.DialContext: dial udp: lookup stun.netbird.io: Temporary failure in name resolution [turns:turn.netbird.io:443?transport=tcp] is Unavailable, reason: dial: d.Dialer.DialContext: dial tcp: lookup turn.netbird.io: i/o timeout [rels://relay.netbird.io:443] is Unavailable, reason: relay connection is not established Nameservers: [8.8.8.8:53, 8.8.4.4:53] for [.] is Unavailable, reason: with udp: read udp 100.71.255.179:47142->8.8.4.4:53: i/o timeout FQDN: pneuma.netbird.cloud NetBird IP: 100.71.255.179/16 Interface type: Kernel Quantum resistance: false Lazy connection: false Networks: - Forwarding rules: 0 Peers count: 0/4 Connected ``` When exit node is disabled on the laptop: ```sh Peers detail: logos.netbird.cloud: NetBird IP: 100.71.32.250/32 Public key: P7VfRVp/ALxwQA5+t+c76ez86RbLqzloy/kRIvRoxHg= Status: Idle -- detail -- Connection type: ICE candidate (Local/Remote): -/- ICE candidate endpoints (Local/Remote): -/- Relay server address: Last connection update: 3 seconds ago Last WireGuard handshake: - Transfer status (received/sent) 0 B/0 B Quantum resistance: false Networks: - Latency: 0s phone.netbird.cloud: NetBird IP: 100.71.54.118 Public key: Snea0W09mQP8Th5dW6ANosHBUuiLUOFh8JjUM4iZwXo= Status: Connecting -- detail -- Connection type: ICE candidate (Local/Remote): -/- ICE candidate endpoints (Local/Remote): -/- Relay server address: Last connection update: 14 minutes, 38 seconds ago Last WireGuard handshake: - Transfer status (received/sent) 0 B/0 B Quantum resistance: false Networks: - Latency: 0s prohairesis.netbird.cloud: NetBird IP: 100.71.111.46 Public key: 5ImeVn0DW7sXMdxoaOu9xCZ0Mr0eSczncP5IMNgGeik= Status: Connected -- detail -- Connection type: P2P ICE candidate (Local/Remote): srflx/prflx ICE candidate endpoints (Local/Remote): 198.51.100.0:51820/198.51.100.1:51820 Relay server address: rels://streamline-de-fra1-0.relay.netbird.io:443 Last connection update: 1 second ago Last WireGuard handshake: 3 minutes, 48 seconds ago Transfer status (received/sent) 2.0 KiB/2.6 KiB Quantum resistance: false Networks: 192.168.12.0/24 Latency: 221.455102ms promox.netbird.cloud: NetBird IP: 100.71.231.170 Public key: T0bfr6dRA9wIAu/EHZoLtDClWkII71IYEcfVD85pX0k= Status: Connected -- detail -- Connection type: Relayed ICE candidate (Local/Remote): -/- ICE candidate endpoints (Local/Remote): -/- Relay server address: rels://streamline-de-fra1-2.relay.netbird.io:443 Last connection update: 2 seconds ago Last WireGuard handshake: 3 minutes, 48 seconds ago Transfer status (received/sent) 92 B/6.2 KiB Quantum resistance: false Networks: - Latency: 0s Events: [WARNING] NETWORK (ec1534b4-3066-4455-ab58-5d03c9d5e1aa) Message: Default route disconnected due to peer unreachability Time: 9 minutes, 57 seconds ago Metadata: id: Exit Node, network: 0.0.0.0/0, peer: T0bfr6dRA9wIAu/EHZoLtDClWkII71IYEcfVD85pX0k= [INFO] SYSTEM (e448032a-67e8-446d-b0fb-52c60688fc81) Message: Network deselection changed Time: 5 minutes, 6 seconds ago Metadata: all: false, append: false, networks: Exit Node [INFO] SYSTEM (fa5343b2-5f17-43c1-843b-e5e91c2276ce) Message: Network map updated Time: 3 minutes, 32 seconds ago [INFO] SYSTEM (d0d52f16-e57d-41f6-b3aa-d9b2a0e1d683) Message: Network selection changed Time: 2 minutes, 13 seconds ago Metadata: all: false, append: true, networks: Exit Node [INFO] NETWORK (5c780c97-6404-4984-877f-e36fc193a600) Message: Default route added Time: 2 minutes, 13 seconds ago Metadata: id: Exit Node, network: 0.0.0.0/0, peer: T0bfr6dRA9wIAu/EHZoLtDClWkII71IYEcfVD85pX0k= [INFO] NETWORK (7645b4d0-8db6-4b7d-bf05-8f9ca026c4d5) Message: Default route added Time: 2 minutes, 13 seconds ago Metadata: id: Exit Node, network: 0.0.0.0/0, peer: T0bfr6dRA9wIAu/EHZoLtDClWkII71IYEcfVD85pX0k= [WARNING] DNS (4f0807ac-75c8-4a69-bda3-4c9788bfb79d) Message: All upstream servers failed (fail count exceeded) Time: 2 minutes, 8 seconds ago Metadata: upstreams: 8.8.8.8:53, 8.8.4.4:53 [WARNING] NETWORK (6554d1d9-0884-4737-8913-15764cddd0ba) Message: Default route disconnected due to peer unreachability Time: 1 minute, 28 seconds ago Metadata: id: Exit Node, network: 0.0.0.0/0, peer: T0bfr6dRA9wIAu/EHZoLtDClWkII71IYEcfVD85pX0k= [INFO] SYSTEM (eef61845-abea-4ec7-b094-7402845d0991) Message: Network deselection changed Time: 13 seconds ago Metadata: all: false, append: false, networks: Exit Node [INFO] SYSTEM (50f2288b-3a5d-4989-9b7f-34432a70a694) Message: Network map updated Time: 2 seconds ago OS: linux/amd64 Daemon version: 0.49.0 CLI version: 0.49.0 Management: Disconnected, reason: EOF Signal: Connected to https://signal.netbird.io:443 Relays: [stun:stun.netbird.io:443] is Available [stun:stun.netbird.io:5555] is Unavailable, reason: stun request: context deadline exceeded [turns:turn.netbird.io:443?transport=tcp] is Available [rels://streamline-de-fra1-0.relay.netbird.io:443] is Available Nameservers: [8.8.8.8:53, 8.8.4.4:53] for [.] is Unavailable, reason: with udp: read udp 100.71.255.179:47142->8.8.4.4:53: i/o timeout FQDN: pneuma.netbird.cloud NetBird IP: 100.71.255.179/16 Interface type: Kernel Quantum resistance: false Lazy connection: false Networks: - Forwarding rules: 0 Peers count: 2/4 Connected ``` *Uploaded files are automatically deleted after 30 days.* [netbird.debug.3877729573.zip](https://github.com/user-attachments/files/21228838/netbird.debug.3877729573.zip) **Have you tried these troubleshooting steps?** - [x] Reviewed [client troubleshooting](https://docs.netbird.io/how-to/troubleshooting-client) (if applicable) - [x] Checked for newer NetBird versions - [x] Searched for similar issues on GitHub (including closed ones) - [x] Restarted the NetBird client - [x] Disabled other VPN software - [x] Checked firewall settings
saavagebueno added the clienttriage-needed labels 2026-08-05 01:16:10 -04:00
Author
Owner

@nazarewk commented on GitHub (Jul 15, 2025):

I wonder why you aren't simply running the service directly on the host on rpi? Privileged container with host networking is pretty much equivalent, but with less NixOS-level support. I am running NetBird on my RPi4 the same way as all my other devices and it works just fine.

Could you give a summary (screenshots) of the Networks, Network Routes, Access Policies and Peers you have? I'm mostly interested in groups assigned to each of those.

I'll try to follow up on this further (look into logs etc.) when I have some free time.

<!-- gh-comment-id:3073290606 --> @nazarewk commented on GitHub (Jul 15, 2025): I wonder why you aren't simply running the service directly on the host on rpi? Privileged container with host networking is pretty much equivalent, but with less NixOS-level support. I am running NetBird on my RPi4 the same way as all my other devices and it works just fine. Could you give a summary (screenshots) of the Networks, Network Routes, Access Policies and Peers you have? I'm mostly interested in groups assigned to each of those. I'll try to follow up on this further (look into logs etc.) when I have some free time.
Sign in to join this conversation.
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: DYNR/netbird#8137