[GH-ISSUE #4851] Unable to Establish RDP Connection to Peer via Browser Client #9940

Open
opened 2026-08-05 01:24:04 -04:00 by saavagebueno · 0 comments
Owner

Originally created by @TheDoDoo on GitHub (Nov 24, 2025).
Original GitHub issue: https://github.com/netbirdio/netbird/issues/4851

Describe the problem

I cannot establish an RDP connection through the browser client. No error message appears on the web interface, but the logs indicate that something is wrong.

To Reproduce

Steps to reproduce the behavior:

  1. Go to the Windows peer
  2. Click the “RDP” button
  3. Enter the password
  4. Nothing happens afterward

Expected behavior

The RDP session should start. ^^

Are you using NetBird Cloud?

No, self-hosted via Adavance (no reverse proxy).

NetBird version

Server: latest (0.60.2 / v2.22.2)
Peer: latest (v0.60.2)

Is any other VPN software installed?

No.

Debug output

Logs etc

target VM Image

The message below only appears after the click on the ‘Connect’ button.

Image
root@srv01-htz:/opt/netbird/infrastructure_files/artifacts# ls -la
total 84
drwxr-xr-x 2 root         root          4096 Nov 24 15:23 .
drwxr-xr-x 6 root         root          4096 Jul 18 23:05 ..
-rw-r--r-- 1 gitlab-ci-cd gitlab-ci-cd  3418 Nov 24 15:11 docker-compose.yml
-rw-r--r-- 1 root         root          3411 Nov 24 15:11 docker-compose.yml.bkp.1763993492
-rw-r--r-- 1 root         root             0 Jul 19 21:13 .gitkeep
-rw-r--r-- 1 root         root          3981 Nov 24 15:11 management.json
-rw-r--r-- 1 root         root          3980 Nov 24 15:11 management.json.bkp.1763993492
-rw-r--r-- 1 root         root          1959 Nov 24 15:11 openid-configuration.json
-rw-r--r-- 1 root         root         26609 Nov 24 15:11 turnserver.conf
-rw-r--r-- 1 root         root         26609 Nov 24 15:11 turnserver.conf.bkp.1763993492
root@srv01-htz:/opt/netbird/infrastructure_files/artifacts# cat docker-compose.yml management.json
services:
  # UI dashboard
  dashboard:
    image: netbirdio/dashboard:latest
    restart: unless-stopped
    ports:
      - 80:80
      - 443:443
    environment:
      # Endpoints
      - NETBIRD_MGMT_API_ENDPOINT=https://vpn.domain.de:33073
      - NETBIRD_MGMT_GRPC_API_ENDPOINT=https://vpn.domain.de:33073
      # OIDC
      - AUTH_AUDIENCE=xxx
      - AUTH_CLIENT_ID=xxx
      - AUTH_CLIENT_SECRET=
      - AUTH_AUTHORITY=https://auth.domain.de/application/o/netbird/
      - USE_AUTH0=false
      - AUTH_SUPPORTED_SCOPES=openid profile email offline_access api
      - AUTH_REDIRECT_URI=
      - AUTH_SILENT_REDIRECT_URI=
      - NETBIRD_TOKEN_SOURCE=accessToken
      # SSL
      - NGINX_SSL_PORT=443
      # Letsencrypt
      - LETSENCRYPT_DOMAIN=vpn.domain.de
      - LETSENCRYPT_EMAIL=me@domain.de
    volumes:
      - netbird-letsencrypt:/etc/letsencrypt/
    logging:
      driver: "json-file"
      options:
        max-size: "500m"
        max-file: "2"

  # Signal
  signal:
    image: netbirdio/signal:latest
    restart: unless-stopped
    volumes:
      - netbird-signal:/var/lib/netbird
    ports:
      - 10000:80
  #      # port and command for Let's Encrypt validation
  #      - 443:443
  #    command: ["--letsencrypt-domain", "vpn.domain.de", "--log-file", "console"]
    logging:
      driver: "json-file"
      options:
        max-size: "500m"
        max-file: "2"

  # Relay
  relay:
    image: netbirdio/relay:latest
    restart: unless-stopped
    environment:
    - NB_LOG_LEVEL=info
    - NB_LISTEN_ADDRESS=:33080
    - NB_EXPOSED_ADDRESS=rel://vpn.domain.de:33080
    # todo: change to a secure secret
    - NB_AUTH_SECRET=xxx
    ports:
      - 33080:33080
    logging:
      driver: "json-file"
      options:
        max-size: "500m"
        max-file: "2"

  # Management
  management:
    image: netbirdio/management:latest
    restart: unless-stopped
    depends_on:
      - dashboard
    volumes:
      - netbird-mgmt:/var/lib/netbird
      - netbird-letsencrypt:/etc/letsencrypt:ro
      - ./management.json:/etc/netbird/management.json
    ports:
      - 33073:443 #API port
  #    # command for Let's Encrypt validation without dashboard container
  #    command: ["--letsencrypt-domain", "vpn.domain.de", "--log-file", "console"]
    command: [
      "--port", "443",
      "--log-file", "console",
      "--log-level", "info",
      "--disable-anonymous-metrics=true",
      "--single-account-mode-domain=vpn.domain.de",
      "--dns-domain=vpn.host.domain.de",
      "--disable-single-account-mode"
      ]
    logging:
      driver: "json-file"
      options:
        max-size: "500m"
        max-file: "2"
    environment:
      - NETBIRD_STORE_ENGINE_POSTGRES_DSN=
      - NETBIRD_STORE_ENGINE_MYSQL_DSN=

  # Coturn
  coturn:
    image: coturn/coturn:latest
    restart: unless-stopped
    #domainname: vpn.domain.de # only needed when TLS is enabled
    volumes:
      - ./turnserver.conf:/etc/turnserver.conf:ro
    #      - ./privkey.pem:/etc/coturn/private/privkey.pem:ro
    #      - ./cert.pem:/etc/coturn/certs/cert.pem:ro
    network_mode: host
    command:
      - -c /etc/turnserver.conf
    logging:
      driver: "json-file"
      options:
        max-size: "500m"
        max-file: "2"

volumes:
  netbird-mgmt:
  netbird-signal:
  netbird-letsencrypt:
{
    "Stuns": [
        {
            "Proto": "udp",
            "URI": "stun:vpn.domain.de:3478",
            "Username": "",
            "Password": ""
        }
    ],
    "TURNConfig": {
        "TimeBasedCredentials": false,
        "CredentialsTTL": "12h0m0s",
        "Secret": "secret",
        "Turns": [
            {
                "Proto": "udp",
                "URI": "turn:vpn.domain.de:3478",
                "Username": "self",
                "Password": "xxx"
            }
        ]
    },
    "Relay": {
        "Addresses": [
            "rel://vpn.domain.de:33080"
        ],
        "CredentialsTTL": "24h0m0s",
        "Secret": "xxx"
    },
    "Signal": {
        "Proto": "http",
        "URI": "vpn.domain.de:10000",
        "Username": "",
        "Password": ""
    },
    "Datadir": "/var/lib/netbird/",
    "DataStoreEncryptionKey": "xxx",
    "HttpConfig": {
        "LetsEncryptDomain": "",
        "CertFile": "/etc/letsencrypt/live/vpn.domain.de/fullchain.pem",
        "CertKey": "/etc/letsencrypt/live/vpn.domain.de/privkey.pem",
        "AuthAudience": "xxx",
        "AuthIssuer": "https://auth.domain.de/application/o/netbird/",
        "AuthUserIDClaim": "",
        "AuthKeysLocation": "https://auth.domain.de/application/o/netbird/jwks/",
        "OIDCConfigEndpoint": "https://auth.domain.de/application/o/netbird/.well-known/openid-configuration",
        "IdpSignKeyRefreshEnabled": false,
        "ExtraAuthAudience": ""
    },
    "IdpManagerConfig": {
        "ManagerType": "authentik",
        "ClientConfig": {
            "Issuer": "https://auth.domain.de/application/o/netbird/",
            "TokenEndpoint": "https://auth.domain.de/application/o/token/",
            "ClientID": "xxx",
            "ClientSecret": "",
            "GrantType": "client_credentials"
        },
        "ExtraConfig": {
            "Password": "xxx",
            "Username": "netbird"
        },
        "Auth0ClientCredentials": null,
        "AzureClientCredentials": null,
        "KeycloakClientCredentials": null,
        "ZitadelClientCredentials": null
    },
    "DeviceAuthorizationFlow": {
        "Provider": "hosted",
        "ProviderConfig": {
            "ClientID": "xxx",
            "ClientSecret": "",
            "Domain": "auth.domain.de",
            "Audience": "xxx",
            "TokenEndpoint": "https://auth.domain.de/application/o/token/",
            "DeviceAuthEndpoint": "https://auth.domain.de/application/o/device/",
            "AuthorizationEndpoint": "",
            "Scope": "openid",
            "UseIDToken": false,
            "RedirectURLs": null,
            "DisablePromptLogin": false,
            "LoginFlag": 0
        }
    },
    "PKCEAuthorizationFlow": {
        "ProviderConfig": {
            "ClientID": "xxx",
            "ClientSecret": "",
            "Domain": "",
            "Audience": "xxx",
            "TokenEndpoint": "https://auth.domain.de/application/o/token/",
            "DeviceAuthEndpoint": "",
            "AuthorizationEndpoint": "https://auth.domain.de/application/o/authorize/",
            "Scope": "openid profile email offline_access api",
            "UseIDToken": false,
            "RedirectURLs": [
                "http://localhost:53000"
            ],
            "DisablePromptLogin": true,
            "LoginFlag": 0
        }
    },
    "StoreConfig": {
        "Engine": "sqlite"
    },
    "ReverseProxy": {
        "TrustedHTTPProxies": [],
        "TrustedHTTPProxiesCount": 0,
        "TrustedPeers": [
            "0.0.0.0/0"
        ]
    },
    "DisableDefaultPolicy": false
}

Have you tried these troubleshooting steps?

  • Reviewed client troubleshooting (if applicable)
  • Checked for newer NetBird versions
  • Searched for similar issues on GitHub (including closed ones)
  • Restarted the NetBird client
  • Disabled other VPN software
  • Checked firewall settings
Originally created by @TheDoDoo on GitHub (Nov 24, 2025). Original GitHub issue: https://github.com/netbirdio/netbird/issues/4851 **Describe the problem** I cannot establish an RDP connection through the browser client. No error message appears on the web interface, but the logs indicate that something is wrong. **To Reproduce** Steps to reproduce the behavior: 1. Go to the Windows peer 2. Click the “RDP” button 3. Enter the password 4. Nothing happens afterward **Expected behavior** The RDP session should start. ^^ **Are you using NetBird Cloud?** No, self-hosted via Adavance (no reverse proxy). **NetBird version** Server: latest (0.60.2 / v2.22.2) Peer: latest (v0.60.2) **Is any other VPN software installed?** No. **Debug output** <details><summary>Logs etc</summary> <p> target VM <img width="1201" height="1080" alt="Image" src="https://github.com/user-attachments/assets/381f6bfc-0b0e-4ffb-ad03-d0be185747e8" /> The message below only appears after the click on the ‘Connect’ button. <img width="1657" height="891" alt="Image" src="https://github.com/user-attachments/assets/33ff85fb-f2eb-4640-929d-31721e2235fe" /> ```shell root@srv01-htz:/opt/netbird/infrastructure_files/artifacts# ls -la total 84 drwxr-xr-x 2 root root 4096 Nov 24 15:23 . drwxr-xr-x 6 root root 4096 Jul 18 23:05 .. -rw-r--r-- 1 gitlab-ci-cd gitlab-ci-cd 3418 Nov 24 15:11 docker-compose.yml -rw-r--r-- 1 root root 3411 Nov 24 15:11 docker-compose.yml.bkp.1763993492 -rw-r--r-- 1 root root 0 Jul 19 21:13 .gitkeep -rw-r--r-- 1 root root 3981 Nov 24 15:11 management.json -rw-r--r-- 1 root root 3980 Nov 24 15:11 management.json.bkp.1763993492 -rw-r--r-- 1 root root 1959 Nov 24 15:11 openid-configuration.json -rw-r--r-- 1 root root 26609 Nov 24 15:11 turnserver.conf -rw-r--r-- 1 root root 26609 Nov 24 15:11 turnserver.conf.bkp.1763993492 root@srv01-htz:/opt/netbird/infrastructure_files/artifacts# cat docker-compose.yml management.json services: # UI dashboard dashboard: image: netbirdio/dashboard:latest restart: unless-stopped ports: - 80:80 - 443:443 environment: # Endpoints - NETBIRD_MGMT_API_ENDPOINT=https://vpn.domain.de:33073 - NETBIRD_MGMT_GRPC_API_ENDPOINT=https://vpn.domain.de:33073 # OIDC - AUTH_AUDIENCE=xxx - AUTH_CLIENT_ID=xxx - AUTH_CLIENT_SECRET= - AUTH_AUTHORITY=https://auth.domain.de/application/o/netbird/ - USE_AUTH0=false - AUTH_SUPPORTED_SCOPES=openid profile email offline_access api - AUTH_REDIRECT_URI= - AUTH_SILENT_REDIRECT_URI= - NETBIRD_TOKEN_SOURCE=accessToken # SSL - NGINX_SSL_PORT=443 # Letsencrypt - LETSENCRYPT_DOMAIN=vpn.domain.de - LETSENCRYPT_EMAIL=me@domain.de volumes: - netbird-letsencrypt:/etc/letsencrypt/ logging: driver: "json-file" options: max-size: "500m" max-file: "2" # Signal signal: image: netbirdio/signal:latest restart: unless-stopped volumes: - netbird-signal:/var/lib/netbird ports: - 10000:80 # # port and command for Let's Encrypt validation # - 443:443 # command: ["--letsencrypt-domain", "vpn.domain.de", "--log-file", "console"] logging: driver: "json-file" options: max-size: "500m" max-file: "2" # Relay relay: image: netbirdio/relay:latest restart: unless-stopped environment: - NB_LOG_LEVEL=info - NB_LISTEN_ADDRESS=:33080 - NB_EXPOSED_ADDRESS=rel://vpn.domain.de:33080 # todo: change to a secure secret - NB_AUTH_SECRET=xxx ports: - 33080:33080 logging: driver: "json-file" options: max-size: "500m" max-file: "2" # Management management: image: netbirdio/management:latest restart: unless-stopped depends_on: - dashboard volumes: - netbird-mgmt:/var/lib/netbird - netbird-letsencrypt:/etc/letsencrypt:ro - ./management.json:/etc/netbird/management.json ports: - 33073:443 #API port # # command for Let's Encrypt validation without dashboard container # command: ["--letsencrypt-domain", "vpn.domain.de", "--log-file", "console"] command: [ "--port", "443", "--log-file", "console", "--log-level", "info", "--disable-anonymous-metrics=true", "--single-account-mode-domain=vpn.domain.de", "--dns-domain=vpn.host.domain.de", "--disable-single-account-mode" ] logging: driver: "json-file" options: max-size: "500m" max-file: "2" environment: - NETBIRD_STORE_ENGINE_POSTGRES_DSN= - NETBIRD_STORE_ENGINE_MYSQL_DSN= # Coturn coturn: image: coturn/coturn:latest restart: unless-stopped #domainname: vpn.domain.de # only needed when TLS is enabled volumes: - ./turnserver.conf:/etc/turnserver.conf:ro # - ./privkey.pem:/etc/coturn/private/privkey.pem:ro # - ./cert.pem:/etc/coturn/certs/cert.pem:ro network_mode: host command: - -c /etc/turnserver.conf logging: driver: "json-file" options: max-size: "500m" max-file: "2" volumes: netbird-mgmt: netbird-signal: netbird-letsencrypt: { "Stuns": [ { "Proto": "udp", "URI": "stun:vpn.domain.de:3478", "Username": "", "Password": "" } ], "TURNConfig": { "TimeBasedCredentials": false, "CredentialsTTL": "12h0m0s", "Secret": "secret", "Turns": [ { "Proto": "udp", "URI": "turn:vpn.domain.de:3478", "Username": "self", "Password": "xxx" } ] }, "Relay": { "Addresses": [ "rel://vpn.domain.de:33080" ], "CredentialsTTL": "24h0m0s", "Secret": "xxx" }, "Signal": { "Proto": "http", "URI": "vpn.domain.de:10000", "Username": "", "Password": "" }, "Datadir": "/var/lib/netbird/", "DataStoreEncryptionKey": "xxx", "HttpConfig": { "LetsEncryptDomain": "", "CertFile": "/etc/letsencrypt/live/vpn.domain.de/fullchain.pem", "CertKey": "/etc/letsencrypt/live/vpn.domain.de/privkey.pem", "AuthAudience": "xxx", "AuthIssuer": "https://auth.domain.de/application/o/netbird/", "AuthUserIDClaim": "", "AuthKeysLocation": "https://auth.domain.de/application/o/netbird/jwks/", "OIDCConfigEndpoint": "https://auth.domain.de/application/o/netbird/.well-known/openid-configuration", "IdpSignKeyRefreshEnabled": false, "ExtraAuthAudience": "" }, "IdpManagerConfig": { "ManagerType": "authentik", "ClientConfig": { "Issuer": "https://auth.domain.de/application/o/netbird/", "TokenEndpoint": "https://auth.domain.de/application/o/token/", "ClientID": "xxx", "ClientSecret": "", "GrantType": "client_credentials" }, "ExtraConfig": { "Password": "xxx", "Username": "netbird" }, "Auth0ClientCredentials": null, "AzureClientCredentials": null, "KeycloakClientCredentials": null, "ZitadelClientCredentials": null }, "DeviceAuthorizationFlow": { "Provider": "hosted", "ProviderConfig": { "ClientID": "xxx", "ClientSecret": "", "Domain": "auth.domain.de", "Audience": "xxx", "TokenEndpoint": "https://auth.domain.de/application/o/token/", "DeviceAuthEndpoint": "https://auth.domain.de/application/o/device/", "AuthorizationEndpoint": "", "Scope": "openid", "UseIDToken": false, "RedirectURLs": null, "DisablePromptLogin": false, "LoginFlag": 0 } }, "PKCEAuthorizationFlow": { "ProviderConfig": { "ClientID": "xxx", "ClientSecret": "", "Domain": "", "Audience": "xxx", "TokenEndpoint": "https://auth.domain.de/application/o/token/", "DeviceAuthEndpoint": "", "AuthorizationEndpoint": "https://auth.domain.de/application/o/authorize/", "Scope": "openid profile email offline_access api", "UseIDToken": false, "RedirectURLs": [ "http://localhost:53000" ], "DisablePromptLogin": true, "LoginFlag": 0 } }, "StoreConfig": { "Engine": "sqlite" }, "ReverseProxy": { "TrustedHTTPProxies": [], "TrustedHTTPProxiesCount": 0, "TrustedPeers": [ "0.0.0.0/0" ] }, "DisableDefaultPolicy": false } ``` </p> </details> **Have you tried these troubleshooting steps?** - [ ] Reviewed [client troubleshooting](https://docs.netbird.io/how-to/troubleshooting-client) (if applicable) - [X] Checked for newer NetBird versions - [X] Searched for similar issues on GitHub (including closed ones) - [X] Restarted the NetBird client - [X] Disabled other VPN software - [X] Checked firewall settings
saavagebueno added the triage-needed label 2026-08-05 01:24:04 -04:00
Sign in to join this conversation.
No Label triage-needed
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: DYNR/netbird#9940