[GH-ISSUE #5058] Exit node on 0.62.0 (ubuntu 24.04) not working - no internet access #9828

Closed
opened 2026-08-05 01:23:38 -04:00 by saavagebueno · 1 comment
Owner

Originally created by @Bobby1kenoby on GitHub (Jan 7, 2026).
Original GitHub issue: https://github.com/netbirdio/netbird/issues/5058

Good evening,

I have set up netbird with an exit node running on netbird 0.62.0 under ubuntu 24.04 (on raspberry pi 5 8gb) for my network. Unfortunately when I turn the exit node on on a mobile device running on netbird 0.61.0 under android 16, the internet traffic or connection of such mobile device does not work.

I havent changed netbird configuration but only configure the SSH Access of my exit node and "add exit node" for such device whereby "All"'s internet traffic should run through.

I have also tried adding the DNS configuration but without success:

DNS Configuration

Add a DNS server with the match domain set to ALL. This is important, as locally configured DNS servers might not be accessible from the routing peer. This also helps to avoid leaking the client's location.

Expected behavior

I would have expected all my devices connected to my netbird network to see their internet traffic going through the exit node.

Are you using NetBird Cloud?

I am using Netbird cloud.

NetBird version

On the exit node: 0.62.0
On the mobile device: 0.61.0
On another computer: 0.60.4 (but I havent been able to test this one out of my local network)

Is any other VPN software installed?

Yes, proton only on the mobile device (but switched off)

Debug output

To help us resolve the problem, please attach the following anonymized status output

netbird status -dA

Create and upload a debug bundle, and share the returned file key: 2aBns4NRY6MwXCwk5FieJE3ZJHkRDGem6DimILMFMms=

netbird debug for 1m -AS -U

Step above - DONE

Have you tried these troubleshooting steps?

  • [ X] Reviewed client troubleshooting (if applicable)
  • [X ] Checked for newer NetBird versions
  • [ X] Searched for similar issues on GitHub (including closed ones)
  • [X ] Restarted the NetBird client
  • [X ] Disabled other VPN software
  • Checked firewall settings - Not sure how to do this and on a non-LTS ubuntu version, I didnt have this issue.

Thank you for any help you can provide me with.

Originally created by @Bobby1kenoby on GitHub (Jan 7, 2026). Original GitHub issue: https://github.com/netbirdio/netbird/issues/5058 Good evening, I have set up netbird with an exit node running on netbird 0.62.0 under ubuntu 24.04 (on raspberry pi 5 8gb) for my network. Unfortunately when I turn the exit node on on a mobile device running on netbird 0.61.0 under android 16, the internet traffic or connection of such mobile device does not work. I havent changed netbird configuration but only configure the SSH Access of my exit node and "add exit node" for such device whereby "All"'s internet traffic should run through. I have also tried adding the DNS configuration but without success: [DNS Configuration](https://docs.netbird.io/manage/network-routes/configuring-default-routes-for-internet-traffic#dns-configuration) Add a DNS server with the match domain set to ALL. This is important, as locally configured DNS servers might not be accessible from the routing peer. This also helps to avoid leaking the client's location. **Expected behavior** I would have expected all my devices connected to my netbird network to see their internet traffic going through the exit node. **Are you using NetBird Cloud?** I am using Netbird cloud. **NetBird version** On the exit node: 0.62.0 On the mobile device: 0.61.0 On another computer: 0.60.4 (but I havent been able to test this one out of my local network) **Is any other VPN software installed?** Yes, proton only on the mobile device (but switched off) **Debug output** To help us resolve the problem, please attach the following anonymized status output netbird status -dA Create and upload a debug bundle, and share the returned file key: 2aBns4NRY6MwXCwk5FieJE3ZJHkRDGem6DimILMFMms= netbird debug for 1m -AS -U Step above - DONE **Have you tried these troubleshooting steps?** - [ X] Reviewed [client troubleshooting](https://docs.netbird.io/how-to/troubleshooting-client) (if applicable) - [X ] Checked for newer NetBird versions - [ X] Searched for similar issues on GitHub (including closed ones) - [X ] Restarted the NetBird client - [X ] Disabled other VPN software - [ ] Checked firewall settings - Not sure how to do this and on a non-LTS ubuntu version, I didnt have this issue. Thank you for any help you can provide me with.
saavagebueno added the triage-needed label 2026-08-05 01:23:38 -04:00
Author
Owner

@Bobby1kenoby commented on GitHub (Jan 8, 2026):

My apologies, using AI, I was able to obtain some advice since my issue was coming from the ubuntu firewall running on my raspberry pi. In case someone faces the same issue, please see below what I followed to deal with my issue (I skept the DNS part for now):

To allow your Raspberry Pi to function as a NetBird exit node in 2026, you must
address three specific layers: system routing, network address translation (NAT), and the local firewall (likely UFW).

  1. Enable IP Forwarding
    By default, Linux blocks traffic passing from one interface (like the NetBird wt0 interface) to another (your Ethernet/Wi-Fi).

    Open the sysctl configuration: sudo nano /etc/sysctl.conf
    Uncomment or add the following lines:
    text

    net.ipv4.ip_forward=1
    net.ipv6.conf.all.forwarding=1

    Use code with caution.

Apply the changes immediately: sudo sysctl -p.

  1. Configure NAT (Masquerading)
    The Raspberry Pi must "masquerade" the traffic coming from NetBird peers so it appears to originate from the Pi's own IP address when it hits the internet.

    Identify your internet-facing interface (usually eth0 or wlan0) using ip addr.
    Add the masquerade rule:
    bash

    sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

    Use code with caution.

(Replace eth0 with your actual interface if different).
To make this persistent after a reboot, install iptables-persistent:
bash

sudo apt install iptables-persistent
sudo netfilter-persistent save

Use code with caution.

  1. Adjust the Firewall (UFW)
    UFW often blocks "forwarded" traffic by default. If you use UFW, you must explicitly allow traffic to pass between the NetBird interface and your internet interface.

    Edit the UFW default configuration: sudo nano /etc/default/ufw
    Change DEFAULT_FORWARD_POLICY from "DROP" to "ACCEPT":
    text

    DEFAULT_FORWARD_POLICY="ACCEPT"

    Use code with caution.

Allow the NetBird interface specifically:
bash

sudo ufw allow in on wt0
sudo ufw route allow in on wt0 out on eth0

Use code with caution.
Reload UFW: sudo ufw reload.

  1. Dashboard Configuration
    Ensure the Raspberry Pi is correctly designated in the NetBird Dashboard:

    Go to Peers, select your Raspberry Pi, and click Set Up Exit Node.
    Assign it to the correct Distribution Groups so your other devices can "see" and use it as a route.
    Important: Ensure your clients have a DNS server configured in the NetBird dashboard (Settings > DNS) with "Match Domains" set to ALL to prevent DNS leaks and ensure connectivity.

Learn to configure IP forwarding, masquerading rules, and UFW policies to establish your Raspberry Pi as a NetBird exit node.

<!-- gh-comment-id:3723241237 --> @Bobby1kenoby commented on GitHub (Jan 8, 2026): My apologies, using AI, I was able to obtain some advice since my issue was coming from the ubuntu firewall running on my raspberry pi. In case someone faces the same issue, please see below what I followed to deal with my issue (I skept the DNS part for now): To allow your Raspberry Pi to function as a NetBird exit node in 2026, you must address three specific layers: system routing, network address translation (NAT), and the local firewall (likely UFW). 1. Enable IP Forwarding By default, Linux blocks traffic passing from one interface (like the NetBird wt0 interface) to another (your Ethernet/Wi-Fi). Open the sysctl configuration: sudo nano /etc/sysctl.conf Uncomment or add the following lines: text net.ipv4.ip_forward=1 net.ipv6.conf.all.forwarding=1 Use code with caution. Apply the changes immediately: sudo sysctl -p. 2. Configure NAT (Masquerading) The Raspberry Pi must "masquerade" the traffic coming from NetBird peers so it appears to originate from the Pi's own IP address when it hits the internet. Identify your internet-facing interface (usually eth0 or wlan0) using ip addr. Add the masquerade rule: bash sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE Use code with caution. (Replace eth0 with your actual interface if different). To make this persistent after a reboot, install iptables-persistent: bash sudo apt install iptables-persistent sudo netfilter-persistent save Use code with caution. 3. Adjust the Firewall (UFW) UFW often blocks "forwarded" traffic by default. If you use UFW, you must explicitly allow traffic to pass between the NetBird interface and your internet interface. Edit the UFW default configuration: sudo nano /etc/default/ufw Change DEFAULT_FORWARD_POLICY from "DROP" to "ACCEPT": text DEFAULT_FORWARD_POLICY="ACCEPT" Use code with caution. Allow the NetBird interface specifically: bash sudo ufw allow in on wt0 sudo ufw route allow in on wt0 out on eth0 Use code with caution. Reload UFW: sudo ufw reload. 4. Dashboard Configuration Ensure the Raspberry Pi is correctly designated in the NetBird Dashboard: Go to Peers, select your Raspberry Pi, and click Set Up Exit Node. Assign it to the correct Distribution Groups so your other devices can "see" and use it as a route. Important: Ensure your clients have a DNS server configured in the NetBird dashboard (Settings > DNS) with "Match Domains" set to ALL to prevent DNS leaks and ensure connectivity. Learn to configure IP forwarding, masquerading rules, and UFW policies to establish your Raspberry Pi as a NetBird exit node.
Sign in to join this conversation.
No Label triage-needed
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: DYNR/netbird#9828