[GH-ISSUE #4549] NetBird Support Ticket: High CPU Usage (100%) due to Conflict with Windows DNS Client Service (Error 0x57) #9382

Open
opened 2026-08-05 01:21:54 -04:00 by saavagebueno · 11 comments
Owner

Originally created by @mrbytehub on GitHub (Sep 26, 2025).
Original GitHub issue: https://github.com/netbirdio/netbird/issues/4549

Description:

Upon starting the NetBird client, the PC's CPU usage immediately spikes to 100%, rendering the system almost unusable. The problem stops immediately upon disconnecting or shutting down the NetBird client.

The issue appears to be strictly related to a conflict with the Windows DNS Client Service and the management of Name Resolution Policy Table (NRPT) rules. The anomaly seems to have worsened after a client update to the latest version.

To Reproduce:

Steps to reproduce the behavior:
Start the NetBird client on the affected PC.
Authenticate and connect to the NetBird network.
Observe CPU usage (via Task Manager) spiking to 100% shortly after connection.

Expected behavior:

The NetBird client should connect and maintain minimal CPU load, without causing stability or usability issues to the operating system.

Are you using NetBird Cloud?:
NO

NetBird version:

Problem observed and persistent with the latest version: v0.58.2.
Problem was also present during an attempted downgrade to version: v0.55.1.

C:\Users\francesco>netbird status
No output

Is any other VPN software installed?:

Yes

If yes, which one?

F5 but not connected.

Debug output:

C:\Users\francesco>netbird status -dA

No Output

Create and upload a debug bundle, and share the returned file key:

C:\Users\francesco>netbird debug for 1m -AS -U
Log level set to trace.
netbird down
netbird up
^C

Unable to complete

Screenshots

Image

Additional context

Problem Origin: The stability issues and excessive CPU consumption increased after a recent NetBird client update.

Windows Event Viewer Log: The Windows Event Viewer shows the following error, strongly indicating a DNS/NRPT conflict:

Name Resolution Policy Table is corrupt. To perform DNS name resolution, the table needs to be reset. Contact your network administrator. For more information, read the policy table for rule NetBird-Match-27 failed with error 0x57

The error code 0x57 corresponds to ERROR_INVALID_PARAMETER, suggesting that a NetBird-configured NRPT rule is invalid or corrupting the table.

Current Workaround: We found that temporarily alleviating the issue is possible by disabling DNS resolution by NetBird and manually inserting all relevant IP/FQDN entries into the local hosts file, reinforcing the link to the client's DNS functionality.

Have you tried these troubleshooting steps?

  • [ x ] Reviewed client troubleshooting (if applicable)
  • [ x ] Checked for newer NetBird versions
  • [ x ] Searched for similar issues on GitHub (including closed ones)
  • [ x ] Restarted the NetBird client
  • [ x ] Disabled other VPN software
  • Checked firewall settings
Originally created by @mrbytehub on GitHub (Sep 26, 2025). Original GitHub issue: https://github.com/netbirdio/netbird/issues/4549 Description: Upon starting the NetBird client, the PC's CPU usage immediately spikes to 100%, rendering the system almost unusable. The problem stops immediately upon disconnecting or shutting down the NetBird client. The issue appears to be strictly related to a conflict with the Windows DNS Client Service and the management of Name Resolution Policy Table (NRPT) rules. The anomaly seems to have worsened after a client update to the latest version. To Reproduce: Steps to reproduce the behavior: Start the NetBird client on the affected PC. Authenticate and connect to the NetBird network. Observe CPU usage (via Task Manager) spiking to 100% shortly after connection. Expected behavior: The NetBird client should connect and maintain minimal CPU load, without causing stability or usability issues to the operating system. Are you using NetBird Cloud?: NO NetBird version: Problem observed and persistent with the latest version: v0.58.2. Problem was also present during an attempted downgrade to version: v0.55.1. C:\Users\francesco>netbird status No output Is any other VPN software installed?: Yes If yes, which one? F5 but not connected. Debug output: C:\Users\francesco>netbird status -dA No Output Create and upload a debug bundle, and share the returned file key: C:\Users\francesco>netbird debug for 1m -AS -U Log level set to trace. netbird down netbird up ^C Unable to complete **Screenshots** <img width="703" height="363" alt="Image" src="https://github.com/user-attachments/assets/64f12b4f-1158-4eab-bba8-5276301ba20c" /> **Additional context** Problem Origin: The stability issues and excessive CPU consumption increased after a recent NetBird client update. Windows Event Viewer Log: The Windows Event Viewer shows the following error, strongly indicating a DNS/NRPT conflict: Name Resolution Policy Table is corrupt. To perform DNS name resolution, the table needs to be reset. Contact your network administrator. For more information, read the policy table for rule NetBird-Match-27 failed with error 0x57 The error code 0x57 corresponds to ERROR_INVALID_PARAMETER, suggesting that a NetBird-configured NRPT rule is invalid or corrupting the table. Current Workaround: We found that temporarily alleviating the issue is possible by disabling DNS resolution by NetBird and manually inserting all relevant IP/FQDN entries into the local hosts file, reinforcing the link to the client's DNS functionality. **Have you tried these troubleshooting steps?** - [ x ] Reviewed [client troubleshooting](https://docs.netbird.io/how-to/troubleshooting-client) (if applicable) - [ x ] Checked for newer NetBird versions - [ x ] Searched for similar issues on GitHub (including closed ones) - [ x ] Restarted the NetBird client - [ x ] Disabled other VPN software - [ ] Checked firewall settings
saavagebueno added the triage-needed label 2026-08-05 01:21:54 -04:00
Author
Owner

@mlsmaycon commented on GitHub (Sep 28, 2025):

Hello @mrbytehub can you please run the following command and share the upload key with us?

netbird debug for 1m -U

Please share the CPU consumption during this time

<!-- gh-comment-id:3342610377 --> @mlsmaycon commented on GitHub (Sep 28, 2025): Hello @mrbytehub can you please run the following command and share the upload key with us? netbird debug for 1m -U Please share the CPU consumption during this time
Author
Owner

@mrbytehub commented on GitHub (Sep 28, 2025):

CPU 100%

Image Image

C:\Users\xxxxxx>netbird debug for 1m -U
Log level set to trace.
netbird down
netbird up
Remaining time: 00:00:01
Duration completed
Creating debug bundle...
Log level restored to INFO
Local file:
C:\WINDOWS\SystemTemp\netbird.debug.3632154207.zip
Upload file key:
25d058dd725ac38f7b6585233a3b014beeac33cd0df67ef8f662399982d5f73d/fa8fb54e-f45b-4626-b532-885ebcfa2962

Any help are appreciate.

<!-- gh-comment-id:3344221991 --> @mrbytehub commented on GitHub (Sep 28, 2025): CPU 100% <img width="1293" height="966" alt="Image" src="https://github.com/user-attachments/assets/4243a79a-8b00-4eee-a6d2-cbbdbe54bf7d" /> <img width="1553" height="1074" alt="Image" src="https://github.com/user-attachments/assets/333edfae-322d-4fc4-8682-1691dbac2a17" /> C:\Users\xxxxxx>netbird debug for 1m -U Log level set to trace. netbird down netbird up Remaining time: 00:00:01 Duration completed Creating debug bundle... Log level restored to INFO Local file: C:\WINDOWS\SystemTemp\netbird.debug.3632154207.zip Upload file key: 25d058dd725ac38f7b6585233a3b014beeac33cd0df67ef8f662399982d5f73d/fa8fb54e-f45b-4626-b532-885ebcfa2962 Any help are appreciate.
Author
Owner

@simonericcio commented on GitHub (Oct 24, 2025):

Hi, are there any updates on this issue?

<!-- gh-comment-id:3442102992 --> @simonericcio commented on GitHub (Oct 24, 2025): Hi, are there any updates on this issue?
Author
Owner

@AntonAttano commented on GitHub (Mar 4, 2026):

We are having the exact same problem.
We just started setting up Netbird Cloud for our company. We rolled out the Client 0.66.1 to multiple PCs and all are showing the same high CPU Usage in the Windows DNS-Client. We also get the Event Log about the "Name Resolution Policy Table is corrupt." but this seems to only happen once on connect. So maybe this is not related.

I even installed the client on my private PC to see if we maybe have some policies on our corporate devices that conflict, but i see the same problem there.

<!-- gh-comment-id:3996405855 --> @AntonAttano commented on GitHub (Mar 4, 2026): We are having the exact same problem. We just started setting up Netbird Cloud for our company. We rolled out the Client 0.66.1 to multiple PCs and all are showing the same high CPU Usage in the Windows DNS-Client. We also get the Event Log about the "Name Resolution Policy Table is corrupt." but this seems to only happen once on connect. So maybe this is not related. I even installed the client on my private PC to see if we maybe have some policies on our corporate devices that conflict, but i see the same problem there.
Author
Owner

@lixmal commented on GitHub (Mar 4, 2026):

Can you share how you configured DNS? Is there a loop somewhere?

<!-- gh-comment-id:3996476272 --> @lixmal commented on GitHub (Mar 4, 2026): Can you share how you configured DNS? Is there a loop somewhere?
Author
Owner

@AntonAttano commented on GitHub (Mar 4, 2026):

I just found something that is fitting:

Image

Once i connect the tunnel the Netbird client tries to resolve stun.netbird.io and turn.netbird.io over and over again. Every few milliseconds.

As to our DNS Setup. I added a Nameserver for two local domains that is running on the one routing peer I setup. But disabling this does not change the CPU usage.

<!-- gh-comment-id:3996555458 --> @AntonAttano commented on GitHub (Mar 4, 2026): I just found something that is fitting: <img width="1280" height="831" alt="Image" src="https://github.com/user-attachments/assets/bf4c40bc-2e5c-4f41-9ca6-91cd75b9cf4e" /> Once i connect the tunnel the Netbird client tries to resolve stun.netbird.io and turn.netbird.io over and over again. Every few milliseconds. As to our DNS Setup. I added a Nameserver for two local domains that is running on the one routing peer I setup. But disabling this does not change the CPU usage.
Author
Owner

@lixmal commented on GitHub (Mar 4, 2026):

Can you provide a debug bundle with trace logs please?

netbird debug for 1m -UA

(check the CPU load while running this)

<!-- gh-comment-id:3996761720 --> @lixmal commented on GitHub (Mar 4, 2026): Can you provide a debug bundle with trace logs please? netbird debug for 1m -UA (check the CPU load while running this)
Author
Owner

@AntonAttano commented on GitHub (Mar 4, 2026):

Image

Upload file key:
f79e391890ab27fb37c88b3b4be7011e22aa2e5ca6f38ffa9c4481884941f726/2a891081-9339-4a43-b87a-4311cfa6b8e2

Immediately after starting the debug command my CPU went from 20% average to 95%+ average.

<!-- gh-comment-id:3996816086 --> @AntonAttano commented on GitHub (Mar 4, 2026): <img width="629" height="160" alt="Image" src="https://github.com/user-attachments/assets/f8140086-1865-4324-a856-e9570ae09c19" /> Upload file key: f79e391890ab27fb37c88b3b4be7011e22aa2e5ca6f38ffa9c4481884941f726/2a891081-9339-4a43-b87a-4311cfa6b8e2 Immediately after starting the debug command my CPU went from 20% average to 95%+ average.
Author
Owner

@AntonAttano commented on GitHub (Mar 5, 2026):

I did some more testing and noticed at least for us this only happen if we assign a specific network to the clients.

We currently have 3 Networks:
One small one only containing 2 Wildcard Domains und an IP.
One medium one containing 27 IPs.
And a bigger one containern 261 IPs.
All three Networks use the same routing peer.

Only when adding the bigger Network do the frequent dns lookups for stun.netbird.io and turn.netbird.io start.
Does that at all help narrow it down?

We are currently in the process of adding our billing info, after that I can also open a official support ticket.

<!-- gh-comment-id:4004979158 --> @AntonAttano commented on GitHub (Mar 5, 2026): I did some more testing and noticed at least for us this only happen if we assign a specific network to the clients. We currently have 3 Networks: One small one only containing 2 Wildcard Domains und an IP. One medium one containing 27 IPs. And a bigger one containern 261 IPs. All three Networks use the same routing peer. Only when adding the bigger Network do the frequent dns lookups for stun.netbird.io and turn.netbird.io start. Does that at all help narrow it down? We are currently in the process of adding our billing info, after that I can also open a official support ticket.
Author
Owner

@AntonAttano commented on GitHub (Mar 5, 2026):

We getting closer and we are maybe doing something that is not intended.

The IPs (Resources) in the bigger network are our own servers. This are all only accessible from the routing peer and this setups mimics our OpenVPN Setup that we are replacing.

I then also installed the Netbird client on all those servers and added an access policy to enable direct access to these servers through Netbird.

Doing both is what seems to be causing the issue.

When I only add an access policy for the peers it's fine and when only adding one for the network its fine, but both cause the problem.

Is it not supportet to have a resource point to an IP that is also running the Netbird Client?

PS.: The routing part / access worked fine when I added both access policies. I could access the servers either through the routing peer or directly through Netbird peer to peer.

<!-- gh-comment-id:4005313032 --> @AntonAttano commented on GitHub (Mar 5, 2026): We getting closer and we are maybe doing something that is not intended. The IPs (Resources) in the bigger network are our own servers. This are all only accessible from the routing peer and this setups mimics our OpenVPN Setup that we are replacing. I then also installed the Netbird client on all those servers and added an access policy to enable direct access to these servers through Netbird. Doing both is what seems to be causing the issue. When I only add an access policy for the peers it's fine and when only adding one for the network its fine, but both cause the problem. Is it not supportet to have a resource point to an IP that is also running the Netbird Client? PS.: The routing part / access worked fine when I added both access policies. I could access the servers either through the routing peer or directly through Netbird peer to peer.
Author
Owner

@mrbytehub commented on GitHub (Mar 12, 2026):

We’ve successfully mitigated the high CPU usage issue caused by the NetBird-Windows DNS/NRPT conflict on our end. Here’s how we resolved it, along with recommendations for others experiencing the same problem:

Mitigation Steps Applied:

Registry Cleanup:

Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\DnsPolicyConfig

Deleted all NetBird-Match-* subkeys.

Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient

Removed all entries except:
(Default) REG_SZ (value not set)
DnsPolicy REG_DWORD 1

If issues persisted, we cleared the entire DNSClient key and restarted NetBird, allowing it to recreate valid entries.

Verification:

After cleanup, we ran:

netbird down
netbird up
netbird status

CPU usage returned to normal, and no further NRPT corruption errors (Error 0x57) were observed.

Temporary Workaround (if needed):

Disabled NetBird’s DNS resolution and manually added critical IPs/FQDNs to the hosts file as a stopgap.

<!-- gh-comment-id:4049892352 --> @mrbytehub commented on GitHub (Mar 12, 2026): We’ve successfully mitigated the high CPU usage issue caused by the NetBird-Windows DNS/NRPT conflict on our end. Here’s how we resolved it, along with recommendations for others experiencing the same problem: Mitigation Steps Applied: Registry Cleanup: Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\DnsPolicyConfig Deleted all NetBird-Match-* subkeys. Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient Removed all entries except: (Default) REG_SZ (value not set) DnsPolicy REG_DWORD 1 If issues persisted, we cleared the entire DNSClient key and restarted NetBird, allowing it to recreate valid entries. Verification: After cleanup, we ran: netbird down netbird up netbird status CPU usage returned to normal, and no further NRPT corruption errors (Error 0x57) were observed. Temporary Workaround (if needed): Disabled NetBird’s DNS resolution and manually added critical IPs/FQDNs to the hosts file as a stopgap.
Sign in to join this conversation.
No Label triage-needed
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: DYNR/netbird#9382