[GH-ISSUE #4721] can not get traffic routed through exit node #9746

Open
opened 2026-08-05 01:23:19 -04:00 by saavagebueno · 8 comments
Owner

Originally created by @sextonAF on GitHub (Oct 29, 2025).
Original GitHub issue: https://github.com/netbirdio/netbird/issues/4721

I setup a very simple test.

1 exit node running on a pi5 at my office
1 client running on my laptop at home

initially after setup i could hit internal ip addresses at my office but my public ip was still showing my home ip instead of my office ip.

this is an issue because we have web based services that require a certain ip. my hope was to replace our current VPN solution with Netbird.

I followed instructions found on Netbird Docs and now its totally broke as i can't hit internal ip's at the office and my internet traffic is still routed through my home isp

I'm sure its something simple that I'm over looking, can anyone offer any ideas?

Originally created by @sextonAF on GitHub (Oct 29, 2025). Original GitHub issue: https://github.com/netbirdio/netbird/issues/4721 I setup a very simple test. 1 exit node running on a pi5 at my office 1 client running on my laptop at home initially after setup i could hit internal ip addresses at my office but my public ip was still showing my home ip instead of my office ip. this is an issue because we have web based services that require a certain ip. my hope was to replace our current VPN solution with Netbird. I followed instructions found on[ Netbird Docs](https://docs.netbird.io/how-to/configuring-default-routes-for-internet-traffic) and now its totally broke as i can't hit internal ip's at the office and my internet traffic is still routed through my home isp I'm sure its something simple that I'm over looking, can anyone offer any ideas?
saavagebueno added the clientnetworking labels 2026-08-05 01:23:20 -04:00
Author
Owner

@nazarewk commented on GitHub (Oct 30, 2025):

I'd advise against using Exit Nodes for the internal resources and switch to specific (domain or IP based) Network Resources for such use case.

Otherwise you'd best start by figuring out whether the Exit Node is connected to and active using netbird status -d command. On the client you'll see 0.0.0.0/0 listed for the Networks: key under specific Peers detail: when it's active.

<!-- gh-comment-id:3468949752 --> @nazarewk commented on GitHub (Oct 30, 2025): I'd advise against using Exit Nodes for the internal resources and switch to specific (domain or IP based) Network Resources for such use case. Otherwise you'd best start by figuring out whether the Exit Node is connected to and active using `netbird status -d` command. On the client you'll see `0.0.0.0/0` listed for the `Networks:` key under specific `Peers detail:` when it's active.
Author
Owner

@sextonAF commented on GitHub (Oct 30, 2025):

i'm confused by your comment on domain or ip based network resources....

I have 2 goals:

  1. make my remote ip be the office ip for accessing 3rd party vendor website that requires static ip
  2. be able to print from remote connection to office printer

here is what I got from the command you suggested:

OS: linux/arm64 Daemon version: 0.59.11 CLI version: 0.59.11 Profile: default Management: Connected to https://api.netbird.io:443 Signal: Connected to https://signal.netbird.io:443 Relays: [stun:stun.netbird.io:443] is Available [stun:stun.netbird.io:5555] is Available [turns:turn.netbird.io:443?transport=tcp] is Available [rels://streamline-us-nyc1-2.relay.netbird.io:443] is Available Nameservers: FQDN: pi.netbird.cloud NetBird IP: 100.XX.XX.136/16 Interface type: Kernel Quantum resistance: false Lazy connection: false Networks: 0.0.0.0/0 Forwarding rules: 0 Peers count: 0/1 Connected

<!-- gh-comment-id:3469172431 --> @sextonAF commented on GitHub (Oct 30, 2025): i'm confused by your comment on domain or ip based network resources.... I have 2 goals: 1) make my remote ip be the office ip for accessing 3rd party vendor website that requires static ip 2) be able to print from remote connection to office printer here is what I got from the command you suggested: `OS: linux/arm64 Daemon version: 0.59.11 CLI version: 0.59.11 Profile: default Management: Connected to https://api.netbird.io:443 Signal: Connected to https://signal.netbird.io:443 Relays: [stun:stun.netbird.io:443] is Available [stun:stun.netbird.io:5555] is Available [turns:turn.netbird.io:443?transport=tcp] is Available [rels://streamline-us-nyc1-2.relay.netbird.io:443] is Available Nameservers: FQDN: pi.netbird.cloud NetBird IP: 100.XX.XX.136/16 Interface type: Kernel Quantum resistance: false Lazy connection: false Networks: 0.0.0.0/0 Forwarding rules: 0 Peers count: 0/1 Connected`
Author
Owner

@sextonAF commented on GitHub (Oct 30, 2025):

https://pastebin.com/EBsgxTLt

<!-- gh-comment-id:3470435679 --> @sextonAF commented on GitHub (Oct 30, 2025): https://pastebin.com/EBsgxTLt
Author
Owner

@sextonAF commented on GitHub (Oct 30, 2025):

Screenshots: https://imgur.com/a/BcIufZP

<!-- gh-comment-id:3470663208 --> @sextonAF commented on GitHub (Oct 30, 2025): Screenshots: https://imgur.com/a/BcIufZP
Author
Owner

@nazarewk commented on GitHub (Oct 31, 2025):

Noticed you have also sent us an email and I have looked up your config through that, so I'll just repeat what I wrote there:

Looking briefly at your configs, I would advise to:

  • keep a single ACL-less Exit Node (Network Route) distributed to a group "exit-node-users" or something similar
    • I'm seeing a lot more than this entry currently
    • advertising Exit Node to All has a very high potential to break stuff
    • putting up ACL Group to Exit Node also has a large potential to break it
  • assign the Routing Peer an "exit-node-provider"
  • assign the client Peers an "exit-node-users"
  • disable the (default) All to All policy
  • create a policy allowing any traffic from "exit-node-users" to "exit-node-provider"
<!-- gh-comment-id:3472264674 --> @nazarewk commented on GitHub (Oct 31, 2025): Noticed you have also sent us an email and I have looked up your config through that, so I'll just repeat what I wrote there: > Looking briefly at your configs, I would advise to: > > - keep a single ACL-less Exit Node (Network Route) distributed to a group "exit-node-users" or something similar > - I'm seeing a lot more than this entry currently > - advertising Exit Node to All has a very high potential to break stuff > - putting up ACL Group to Exit Node also has a large potential to break it > - assign the Routing Peer an "exit-node-provider" > - assign the client Peers an "exit-node-users" > - disable the (default) All to All policy > - create a policy allowing any traffic from "exit-node-users" to "exit-node-provider" >
Author
Owner

@sextonAF commented on GitHub (Oct 31, 2025):

Good Morning, and thanks for responding. Do you have instructions on this?

I don't know what a ACL-less Exit node is? I mean I go to create exit node, nothing says "ACL-less"
is the routing peer the same thing as the exit node (pi5) ? the exit-node-provider is also the routing peer and exit node?

Updated "netbird status -d" and "netbird routes list" at: https://pastebin.com/xZPDMdDA

I "attempted" to do this with no results, here are some screen shots:

Image Image Image Image
<!-- gh-comment-id:3473173181 --> @sextonAF commented on GitHub (Oct 31, 2025): Good Morning, and thanks for responding. Do you have instructions on this? I don't know what a ACL-less Exit node is? I mean I go to create exit node, nothing says "ACL-less" is the routing peer the same thing as the exit node (pi5) ? the exit-node-provider is also the routing peer and exit node? Updated "netbird status -d" and "netbird routes list" at: https://pastebin.com/xZPDMdDA I "attempted" to do this with no results, here are some screen shots: <img width="1190" height="554" alt="Image" src="https://github.com/user-attachments/assets/9123c008-4744-405c-b796-b7d8546ff0f4" /> <img width="1190" height="554" alt="Image" src="https://github.com/user-attachments/assets/2fe1521d-ce0b-463d-8e9e-5b480a754ed2" /> <img width="1190" height="554" alt="Image" src="https://github.com/user-attachments/assets/6a6bc578-85d4-474f-8ba1-ea6a95d5c871" /> <img width="1190" height="554" alt="Image" src="https://github.com/user-attachments/assets/3a563304-fb97-4940-b5f8-2782560643d7" />
Author
Owner

@Raito00 commented on GitHub (Nov 1, 2025):

I had a similar problem — in my case, it turned out to be a DNS issue. I added my Pi-hole server’s NetBird IP address to the DNS settings (In Netbird server UI), and that solved it for me.

Image

I also changed the Pi-hole Docker container to listen on port 5353:53, as it could have been an issue with the local service. After that, everything worked fine for me.

<!-- gh-comment-id:3476609697 --> @Raito00 commented on GitHub (Nov 1, 2025): I had a similar problem — in my case, it turned out to be a DNS issue. I added my Pi-hole server’s NetBird IP address to the DNS settings (In Netbird server UI), and that solved it for me. <img width="624" height="615" alt="Image" src="https://github.com/user-attachments/assets/0da01996-005b-48d7-b2a7-4bb7b133ec0a" /> I also changed the Pi-hole Docker container to listen on port 5353:53, as it could have been an issue with the local service. After that, everything worked fine for me.
Author
Owner

@nazarewk commented on GitHub (Nov 3, 2025):

@sextonAF as noted on Slack, could you send us a debug bundle from the laptop and post an upload key here to look into the issue? You can generate it with netbird debug for 1m -U, it will restart into debug mode for a minute (there will be a counter running), then you can try to access some things.

In case the upload fails, please email the *.zip file to the existing email support thread.

<!-- gh-comment-id:3481546967 --> @nazarewk commented on GitHub (Nov 3, 2025): @sextonAF as noted on Slack, could you send us a debug bundle from the laptop and post an upload key here to look into the issue? You can generate it with `netbird debug for 1m -U`, it will restart into debug mode for a minute (there will be a counter running), then you can try to access some things. In case the upload fails, please email the `*.zip` file to the existing email support thread.
Sign in to join this conversation.
No Label client networking
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: DYNR/netbird#9746