SVI/netbird
1
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-06-09 17:02:09 -04:00
Code Issues 3.0k Packages Projects Releases 10 Wiki Activity

NetBird fails to forward traffic from Oracle Cloud VM to internal peer, works fine with Tailscale #1162

New Issue
Open
opened 2025-11-20 05:25:06 -05:00 by saavagebueno · 6 comments
saavagebueno commented 2025-11-20 05:25:06 -05:00
Owner
Copy Link

Originally created by @fedeiglesias on GitHub (Aug 19, 2024).

Describe the problem

I'm facing an issue where NetBird does not properly forward traffic from an Oracle Cloud VM to a peer in my internal network. I followed the exact same steps with Tailscale, and everything works fine under the same conditions. However, with NetBird, the traffic does not reach its destination.

I have an Oracle Cloud VM running Ubuntu (Ampere ARM64, 4 cores, 24 GB RAM) with a static public IP. On this VM, I installed NetBird from scratch, logged into my cloud account, and have a policy that allows all peers to connect to each other.

In my homelab, I have an LXC container running uptimekuma service on port 3001. The internal NetBird IP of this peer is 100.88.192.94. If I run a curl command from the Oracle VM, I can retrieve the HTML response from the NGINX service, so the internal connection between peers is working.

The issue arises when I try to forward the traffic coming to the VM on port 80 to the internal NetBird peer. I configured traffic forwarding using iptables, but it doesn't seem to work with NetBird, whereas with Tailscale, the traffic is correctly forwarded without issues.

To Reproduce

Steps to reproduce the behavior:

  1. Create an Oracle Cloud VM (Ampere ARM64, Ubuntu minimal).
  2. Install NetBird and set up a peer in the internal network (in this case, an LXC container running an NGINX service).
  3. On the Oracle VM, enable traffic forwarding and configure iptables to forward traffic on port 80 to the NetBird peer on port 3001.
  4. Try to access the web service through the Oracle Cloud public IP.

Expected behavior

I expected the incoming traffic on port 80 of the Oracle Cloud VM to be correctly forwarded to the internal NetBird peer, as it happens with Tailscale under the same conditions.

Are you using NetBird Cloud?

Yes, I am using NetBird Cloud.

NetBird version

0.28.7

NetBird status -dA output

NetBird status -dA output
ubuntu@oracle:~$ netbird status -dA output
Peers detail:
iphone-fede.netbird.cloud:
NetBird IP: 100.88.5.103
Public key: WKZknsTPHEZQREt75Kmaz/HV2jwcNehnpt0S91PKH1c=
Status: Connected
-- detail --
Connection type: P2P
Direct: true
ICE candidate (Local/Remote): srflx/srflx
ICE candidate endpoints (Local/Remote): 198.51.100.0:51820/198.51.100.1:57557
Last connection update: 22 minutes, 50 seconds ago
Last WireGuard handshake: 1 minute, 48 seconds ago
Transfer status (received/sent) 3.8 KiB/1.6 KiB
Quantum resistance: false
Routes: -
Latency: 22.578577ms

oracle.netbird.cloud:
NetBird IP: 100.88.61.146
Public key: PGT03R1EDb1cAf+uZymgvGYFXKHnnOP3/0ccKPInfBI=
Status: Disconnected
-- detail --
Connection type:
Direct: false
ICE candidate (Local/Remote): -/-
ICE candidate endpoints (Local/Remote): -/-
Last connection update: -
Last WireGuard handshake: -
Transfer status (received/sent) 0 B/0 B
Quantum resistance: false
Routes: -
Latency: 0s

4da8810ea346.netbird.cloud:
NetBird IP: 100.88.110.131
Public key: +AawwZqEzKesGbPISiXgeU0yfTfmtkGKXGs0v7U152s=
Status: Disconnected
-- detail --
Connection type:
Direct: false
ICE candidate (Local/Remote): -/-
ICE candidate endpoints (Local/Remote): -/-
Last connection update: -
Last WireGuard handshake: -
Transfer status (received/sent) 0 B/0 B
Quantum resistance: false
Routes: -
Latency: 0s

macbook-fede.netbird.cloud:
NetBird IP: 100.88.180.38
Public key: bQZuQnpveGtcU45nr7DTJtlWbhqi6O7rj/UwkNcB1iA=
Status: Connected
-- detail --
Connection type: P2P
Direct: true
ICE candidate (Local/Remote): srflx/srflx
ICE candidate endpoints (Local/Remote): 198.51.100.0:51820/198.51.100.1:57431
Last connection update: 22 minutes, 53 seconds ago
Last WireGuard handshake: 2 minutes, 3 seconds ago
Transfer status (received/sent) 3.6 KiB/1.2 KiB
Quantum resistance: false
Routes: -
Latency: 14.533849ms

uptimekuma.netbird.cloud:
NetBird IP: 100.88.192.94
Public key: hA3DLsvCah9Gz6YeWWWRGEBtCusBhadDopDOom0a2Qs=
Status: Connected
-- detail --
Connection type: P2P
Direct: true
ICE candidate (Local/Remote): srflx/srflx
ICE candidate endpoints (Local/Remote): 198.51.100.0:51820/198.51.100.1:58213
Last connection update: 22 minutes, 53 seconds ago
Last WireGuard handshake: 2 minutes, 25 seconds ago
Transfer status (received/sent) 3.0 KiB/2.1 KiB
Quantum resistance: false
Routes: -
Latency: 20.015482ms

nginx.netbird.cloud:
NetBird IP: 100.88.211.126
Public key: 9kpbqwyghDtjVPX92Ds0EF054+RzOMMw8/+efConO2I=
Status: Disconnected
-- detail --
Connection type: P2P
Direct: false
ICE candidate (Local/Remote): srflx/srflx
ICE candidate endpoints (Local/Remote): 198.51.100.0:51820/198.51.100.1:57104
Last connection update: -
Last WireGuard handshake: 1 minute, 48 seconds ago
Transfer status (received/sent) 3.8 KiB/1.3 KiB
Quantum resistance: false
Routes: -
Latency: 0s

pihole.netbird.cloud:
NetBird IP: 100.88.212.19
Public key: gmSdBrNEI2j5fNwAWHRGyYhMAJUjTizb2HVqHEhq20Y=
Status: Connected
-- detail --
Connection type: P2P
Direct: true
ICE candidate (Local/Remote): srflx/srflx
ICE candidate endpoints (Local/Remote): 198.51.100.0:51820/198.51.100.1:57104
Last connection update: 22 minutes, 53 seconds ago
Last WireGuard handshake: 1 minute, 48 seconds ago
Transfer status (received/sent) 3.8 KiB/1.3 KiB
Quantum resistance: false
Routes: -
Latency: 9.531658ms

OS: linux/arm64
Daemon version: 0.28.7
CLI version: 0.28.7
Management: Connected to https://api.netbird.io:443
Signal: Connected to https://signal.netbird.io:443
Relays:
[stun:stun.netbird.io:5555] is Available
[turns:turn.netbird.io:443?transport=tcp] is Available
Nameservers:
[100.88.212.19:53] for [local.anon-are26.domain] is Available
FQDN: oracle-1.netbird.cloud
NetBird IP: 100.88.223.175/16
Interface type: Kernel
Quantum resistance: false
Routes: -
Peers count: 4/7 Connected

Do you face any client issues on desktop?

No desktop client is involved, only the Oracle VM client and the peer in my homelab (LXC).

Screenshots

CleanShot 2024-08-19 at 11  29 13@2x

Additional context

Here are the commands I used to configure port forwarding:

  • enable port forwarding
    sudo sed -i 's/^#net.ipv4.ip_forward=1/net.ipv4.ip_forward=1/' /etc/sysctl.conf
    sudo sysctl -p

  • add iptables rules
    sudo iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination 100.88.192.94:3001
    sudo iptables -t nat -A POSTROUTING -j MASQUERADE

I have ensured that port 80 is open and accessible from the Oracle Cloud dashboard. As I mentioned before, this exact setup works fine with Tailscale, which makes me think this could either be a bug in NetBird or a misconfiguration on my side.

Originally created by @fedeiglesias on GitHub (Aug 19, 2024). ### Describe the problem I'm facing an issue where NetBird does not properly forward traffic from an Oracle Cloud VM to a peer in my internal network. I followed the exact same steps with Tailscale, and everything works fine under the same conditions. However, with NetBird, the traffic does not reach its destination. I have an Oracle Cloud VM running Ubuntu (Ampere ARM64, 4 cores, 24 GB RAM) with a static public IP. On this VM, I installed NetBird from scratch, logged into my cloud account, and have a policy that allows all peers to connect to each other. In my homelab, I have an LXC container running uptimekuma service on port 3001. The internal NetBird IP of this peer is 100.88.192.94. If I run a curl command from the Oracle VM, I can retrieve the HTML response from the NGINX service, so the internal connection between peers is working. The issue arises when I try to forward the traffic coming to the VM on port 80 to the internal NetBird peer. I configured traffic forwarding using iptables, but it doesn't seem to work with NetBird, whereas with Tailscale, the traffic is correctly forwarded without issues. ### To Reproduce Steps to reproduce the behavior: 1. Create an Oracle Cloud VM (Ampere ARM64, Ubuntu minimal). 2. Install NetBird and set up a peer in the internal network (in this case, an LXC container running an NGINX service). 3. On the Oracle VM, enable traffic forwarding and configure iptables to forward traffic on port 80 to the NetBird peer on port 3001. 4. Try to access the web service through the Oracle Cloud public IP. ### Expected behavior I expected the incoming traffic on port 80 of the Oracle Cloud VM to be correctly forwarded to the internal NetBird peer, as it happens with Tailscale under the same conditions. ### Are you using NetBird Cloud? Yes, I am using NetBird Cloud. ### NetBird version 0.28.7 ### NetBird status -dA output NetBird status -dA output ubuntu@oracle:~$ netbird status -dA output Peers detail: iphone-fede.netbird.cloud: NetBird IP: 100.88.5.103 Public key: WKZknsTPHEZQREt75Kmaz/HV2jwcNehnpt0S91PKH1c= Status: Connected -- detail -- Connection type: P2P Direct: true ICE candidate (Local/Remote): srflx/srflx ICE candidate endpoints (Local/Remote): 198.51.100.0:51820/198.51.100.1:57557 Last connection update: 22 minutes, 50 seconds ago Last WireGuard handshake: 1 minute, 48 seconds ago Transfer status (received/sent) 3.8 KiB/1.6 KiB Quantum resistance: false Routes: - Latency: 22.578577ms oracle.netbird.cloud: NetBird IP: 100.88.61.146 Public key: PGT03R1EDb1cAf+uZymgvGYFXKHnnOP3/0ccKPInfBI= Status: Disconnected -- detail -- Connection type: Direct: false ICE candidate (Local/Remote): -/- ICE candidate endpoints (Local/Remote): -/- Last connection update: - Last WireGuard handshake: - Transfer status (received/sent) 0 B/0 B Quantum resistance: false Routes: - Latency: 0s 4da8810ea346.netbird.cloud: NetBird IP: 100.88.110.131 Public key: +AawwZqEzKesGbPISiXgeU0yfTfmtkGKXGs0v7U152s= Status: Disconnected -- detail -- Connection type: Direct: false ICE candidate (Local/Remote): -/- ICE candidate endpoints (Local/Remote): -/- Last connection update: - Last WireGuard handshake: - Transfer status (received/sent) 0 B/0 B Quantum resistance: false Routes: - Latency: 0s macbook-fede.netbird.cloud: NetBird IP: 100.88.180.38 Public key: bQZuQnpveGtcU45nr7DTJtlWbhqi6O7rj/UwkNcB1iA= Status: Connected -- detail -- Connection type: P2P Direct: true ICE candidate (Local/Remote): srflx/srflx ICE candidate endpoints (Local/Remote): 198.51.100.0:51820/198.51.100.1:57431 Last connection update: 22 minutes, 53 seconds ago Last WireGuard handshake: 2 minutes, 3 seconds ago Transfer status (received/sent) 3.6 KiB/1.2 KiB Quantum resistance: false Routes: - Latency: 14.533849ms uptimekuma.netbird.cloud: NetBird IP: 100.88.192.94 Public key: hA3DLsvCah9Gz6YeWWWRGEBtCusBhadDopDOom0a2Qs= Status: Connected -- detail -- Connection type: P2P Direct: true ICE candidate (Local/Remote): srflx/srflx ICE candidate endpoints (Local/Remote): 198.51.100.0:51820/198.51.100.1:58213 Last connection update: 22 minutes, 53 seconds ago Last WireGuard handshake: 2 minutes, 25 seconds ago Transfer status (received/sent) 3.0 KiB/2.1 KiB Quantum resistance: false Routes: - Latency: 20.015482ms nginx.netbird.cloud: NetBird IP: 100.88.211.126 Public key: 9kpbqwyghDtjVPX92Ds0EF054+RzOMMw8/+efConO2I= Status: Disconnected -- detail -- Connection type: P2P Direct: false ICE candidate (Local/Remote): srflx/srflx ICE candidate endpoints (Local/Remote): 198.51.100.0:51820/198.51.100.1:57104 Last connection update: - Last WireGuard handshake: 1 minute, 48 seconds ago Transfer status (received/sent) 3.8 KiB/1.3 KiB Quantum resistance: false Routes: - Latency: 0s pihole.netbird.cloud: NetBird IP: 100.88.212.19 Public key: gmSdBrNEI2j5fNwAWHRGyYhMAJUjTizb2HVqHEhq20Y= Status: Connected -- detail -- Connection type: P2P Direct: true ICE candidate (Local/Remote): srflx/srflx ICE candidate endpoints (Local/Remote): 198.51.100.0:51820/198.51.100.1:57104 Last connection update: 22 minutes, 53 seconds ago Last WireGuard handshake: 1 minute, 48 seconds ago Transfer status (received/sent) 3.8 KiB/1.3 KiB Quantum resistance: false Routes: - Latency: 9.531658ms OS: linux/arm64 Daemon version: 0.28.7 CLI version: 0.28.7 Management: Connected to https://api.netbird.io:443 Signal: Connected to https://signal.netbird.io:443 Relays: [stun:stun.netbird.io:5555] is Available [turns:turn.netbird.io:443?transport=tcp] is Available Nameservers: [100.88.212.19:53] for [local.anon-are26.domain] is Available FQDN: oracle-1.netbird.cloud NetBird IP: 100.88.223.175/16 Interface type: Kernel Quantum resistance: false Routes: - Peers count: 4/7 Connected ### Do you face any client issues on desktop? No desktop client is involved, only the Oracle VM client and the peer in my homelab (LXC). ### Screenshots ![CleanShot 2024-08-19 at 11  29 13@2x](https://github.com/user-attachments/assets/0cc859f6-21cc-427e-b7e1-85e263c081bd) ### Additional context Here are the commands I used to configure port forwarding: - enable port forwarding `sudo sed -i 's/^#net.ipv4.ip_forward=1/net.ipv4.ip_forward=1/' /etc/sysctl.conf` `sudo sysctl -p` - add iptables rules `sudo iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination 100.88.192.94:3001` `sudo iptables -t nat -A POSTROUTING -j MASQUERADE` I have ensured that port 80 is open and accessible from the Oracle Cloud dashboard. As I mentioned before, this exact setup works fine with Tailscale, which makes me think this could either be a bug in NetBird or a misconfiguration on my side.
saavagebueno added the clientwaiting-feedbacknetworkingcloud labels 2025-11-20 05:25:06 -05:00
saavagebueno commented 2025-11-20 05:25:07 -05:00
Author
Owner
Copy Link

@lixmal commented on GitHub (Aug 21, 2024):

Hi @fedeiglesias,

could you test if this build fixes the issue? https://github.com/netbirdio/netbird/actions/runs/10419607061/artifacts/1836477728

You can replace /usr/bin/netbird with the new binary on the oracle VM

@lixmal commented on GitHub (Aug 21, 2024): Hi @fedeiglesias, could you test if this build fixes the issue? https://github.com/netbirdio/netbird/actions/runs/10419607061/artifacts/1836477728 You can replace `/usr/bin/netbird` with the new binary on the oracle VM
saavagebueno commented 2025-11-20 05:25:07 -05:00
Author
Owner
Copy Link

@ghaisasadvait commented on GitHub (Aug 22, 2024):

I'm having the same issue. As soon as the peer is connected, i cannot access the web server hosted on it via the public IP

@fedeiglesias did you find any solution to this?

@ghaisasadvait commented on GitHub (Aug 22, 2024): I'm having the same issue. As soon as the peer is connected, i cannot access the web server hosted on it via the public IP @fedeiglesias did you find any solution to this?
saavagebueno commented 2025-11-20 05:25:07 -05:00
Author
Owner
Copy Link

@raegedoc commented on GitHub (Sep 25, 2024):

Same problem here with Netbird but working with Tailscale on same setup (Oracle Cloud VM and a VM on my local network)

@raegedoc commented on GitHub (Sep 25, 2024): Same problem here with Netbird but working with Tailscale on same setup (Oracle Cloud VM and a VM on my local network)
saavagebueno commented 2025-11-20 05:25:07 -05:00
Author
Owner
Copy Link

@nazarewk commented on GitHub (Apr 28, 2025):

Hello @fedeiglesias,

We're currently reviewing our open issues and would like to verify if this problem still exists in the latest NetBird version.

Could you please confirm if the issue is still there?

We may close this issue temporarily if we don't hear back from you within 2 weeks, but feel free to reopen it with updated information.

Thanks for your contribution to improving the project!

@nazarewk commented on GitHub (Apr 28, 2025): Hello @fedeiglesias, We're currently reviewing our open issues and would like to verify if this problem still exists in the [latest NetBird version](https://github.com/netbirdio/netbird/releases). Could you please confirm if the issue is still there? We may close this issue temporarily if we don't hear back from you within **2 weeks**, but feel free to reopen it with updated information. Thanks for your contribution to improving the project!
saavagebueno commented 2025-11-20 05:25:07 -05:00
Author
Owner
Copy Link

@jainrahul0311 commented on GitHub (Aug 12, 2025):

@nazarewk i am using latest netbird and still facing this issue, as described in original post. This issue is replicable on Oracle Cloud VM

@jainrahul0311 commented on GitHub (Aug 12, 2025): @nazarewk i am using latest netbird and still facing this issue, as described in original post. This issue is replicable on Oracle Cloud VM
saavagebueno commented 2025-11-20 05:25:08 -05:00
Author
Owner
Copy Link

@gyrocoptic commented on GitHub (Sep 22, 2025):

Root cause

On Oracle Cloud VMs, OCI injects its own iptables rules that REJECT or DROP inbound packets before UFW’s chains are evaluated. This means UFW “allow” rules for NetBird‑forwarded ports never match — traffic is killed before DNAT/MASQUERADE can happen.

Solution

Bypass UFW and insert explicit ACCEPT rules for the required ports above OCI’s default REJECT in the INPUT chain. For example:

bash
sudo iptables -I INPUT 1 -m state --state RELATED,ESTABLISHED -j ACCEPT
sudo iptables -I INPUT 2 -p icmp -j ACCEPT
sudo iptables -I INPUT 3 -i lo -j ACCEPT
sudo iptables -I INPUT 4 -p udp --dport 3478 -j ACCEPT   # NetBird TURN
sudo iptables -I INPUT 5 -p tcp --dport 3000 -j ACCEPT   # Your service port
sudo iptables -I INPUT 6 -p tcp --dport 22 -j ACCEPT     # SSH

Then save the rules so they persist across reboots (example using iptables-persistent):

bash
sudo netfilter-persistent save

Result

  • NetBird traffic reaches the DNAT target.

  • Services become reachable from outside.

  • UFW can be removed entirely to avoid confusion.

@gyrocoptic commented on GitHub (Sep 22, 2025): <div class="relative pb-6 w-full after:border-b after:border-stroke-300 after:w-full after:absolute after:mt-3"></div><h3 class="text-lg-medium pb-1 [&amp;:not(:first-child)]:pt-3.5"><strong>Root cause</strong></h3><p><span class="font-ligatures-none whitespace-pre-wrap">On Oracle Cloud VMs, OCI injects its own <code class="font-ligatures-none mx-0.5 rounded-[4px] border border-stroke-300 bg-accent-200/60 px-1 py-px font-mono text-foreground-800 text-sm dark:bg-accent-200" style="opacity: 1;">iptables</code> rules that <strong>REJECT</strong> or <strong>DROP</strong> inbound packets <em>before</em> UFW’s chains are evaluated. This means UFW “allow” rules for NetBird‑forwarded ports never match — traffic is killed before DNAT/MASQUERADE can happen.</span></p><div class="relative pb-6 w-full after:border-b after:border-stroke-300 after:w-full after:absolute after:mt-3"></div><h3 class="text-lg-medium pb-1 [&amp;:not(:first-child)]:pt-3.5"><strong>Solution</strong></h3><p><span class="font-ligatures-none whitespace-pre-wrap">Bypass UFW and insert explicit <code class="font-ligatures-none mx-0.5 rounded-[4px] border border-stroke-300 bg-accent-200/60 px-1 py-px font-mono text-foreground-800 text-sm dark:bg-accent-200" style="opacity: 1;">ACCEPT</code> rules for the required ports <strong>above</strong> OCI’s default REJECT in the <code class="font-ligatures-none mx-0.5 rounded-[4px] border border-stroke-300 bg-accent-200/60 px-1 py-px font-mono text-foreground-800 text-sm dark:bg-accent-200" style="opacity: 1;">INPUT</code> chain. For example:</span></p><div class="rounded-xl dark:border dark:border-stroke-250" style="opacity: 1;"><div class="flex w-full items-center justify-between border-b border-white/20 bg-background-static-850 py-2 pe-2.5 ps-4 text-foreground-static-250 text-sm dark:border-stroke-250 dark:bg-background-static-900 rounded-t-xl"><div class="flex items-center gap-2"><span class="capitalize">bash</span><button class="relative min-h-9 min-w-9 rounded-xl bg-transparent p-2 hover:bg-white/8 active:bg-white/5" type="button" title="Collapse code snippet" aria-expanded="true"><svg viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg" class="size-4 transition-transform -rotate-90"><g id="Chevron"><path id="Shape" d="M8.46967 4.21967C8.17678 4.51256 8.17678 4.98744 8.46967 5.28033L15.1893 12L8.46967 18.7197C8.17678 19.0126 8.17678 19.4874 8.46967 19.7803C8.76256 20.0732 9.23744 20.0732 9.53033 19.7803L16.7803 12.5303C17.0732 12.2374 17.0732 11.7626 16.7803 11.4697L9.53033 4.21967C9.23744 3.92678 8.76256 3.92678 8.46967 4.21967Z" fill="currentColor"></path></g></svg></button></div><button class="relative min-h-9 min-w-9 gap-1.5 rounded-xl bg-transparent p-2 hover:bg-white/8 active:bg-white/5" type="button" title="Copy code" data-copy="false"><div class="flex items-center justify-center gap-2" aria-hidden="true"><svg viewBox="0 0 21 20" fill="none" xmlns="http://www.w3.org/2000/svg" class="w-5"><mask id="mask0_25413_62234" style="mask-type: alpha;" maskUnits="userSpaceOnUse" x="0" y="0" width="21" height="20"><path d="M8.5 2C7.39543 2 6.5 2.89543 6.5 4V14C6.5 15.1046 7.39543 16 8.5 16H14.5C15.6046 16 16.5 15.1046 16.5 14V4C16.5 2.89543 15.6046 2 14.5 2H8.5ZM7.5 4C7.5 3.44772 7.94772 3 8.5 3H14.5C15.0523 3 15.5 3.44772 15.5 4V14C15.5 14.5523 15.0523 15 14.5 15H8.5C7.94772 15 7.5 14.5523 7.5 14V4ZM4.5 6.00001C4.5 5.25973 4.9022 4.61339 5.5 4.26758V14.5C5.5 15.8807 6.61929 17 8 17H14.2324C13.8866 17.5978 13.2403 18 12.5 18H8C6.067 18 4.5 16.433 4.5 14.5V6.00001Z" fill="currentColor"></path></mask><g mask="url(#mask0_25413_62234)"><rect width="24" height="24" transform="translate(-1.5 -2)" fill="currentColor"></rect></g></svg> Copy</div></button></div><div class="rounded-b-xl bg-background-static-850 px-4 pb-1.5 dark:bg-background-static-900"><div class="horizontal-scrollbar overflow-x-auto whitespace-pre pb-3 pt-4 text-sm"><pre><code class="font-ligatures-none text-sm"><span initial="start" animate="end" variants="[object Object]" custom="0.594"><span class="hljs-built_in">sudo</span></span><span initial="start" animate="end" variants="[object Object]" custom="0.6"> </span><span initial="start" animate="end" variants="[object Object]" custom="0.606">iptables </span><span initial="start" animate="end" variants="[object Object]" custom="0.612">-I </span><span initial="start" animate="end" variants="[object Object]" custom="0.618">INPUT </span><span initial="start" animate="end" variants="[object Object]" custom="0.624">1 </span><span initial="start" animate="end" variants="[object Object]" custom="0.63">-m </span><span initial="start" animate="end" variants="[object Object]" custom="0.636">state </span><span initial="start" animate="end" variants="[object Object]" custom="0.642">--state </span><span initial="start" animate="end" variants="[object Object]" custom="0.648">RELATED,ESTABLISHED </span><span initial="start" animate="end" variants="[object Object]" custom="0.654">-j </span><span initial="start" animate="end" variants="[object Object]" custom="0.66">ACCEPT </span><span initial="start" animate="end" variants="[object Object]" custom="0.666"><span class="hljs-built_in">sudo</span></span><span initial="start" animate="end" variants="[object Object]" custom="0.672"> </span><span initial="start" animate="end" variants="[object Object]" custom="0.678">iptables </span><span initial="start" animate="end" variants="[object Object]" custom="0.684">-I </span><span initial="start" animate="end" variants="[object Object]" custom="0.69">INPUT </span><span initial="start" animate="end" variants="[object Object]" custom="0.696">2 </span><span initial="start" animate="end" variants="[object Object]" custom="0.702">-p </span><span initial="start" animate="end" variants="[object Object]" custom="0.708">icmp </span><span initial="start" animate="end" variants="[object Object]" custom="0.714">-j </span><span initial="start" animate="end" variants="[object Object]" custom="0.72">ACCEPT </span><span initial="start" animate="end" variants="[object Object]" custom="0.726"><span class="hljs-built_in">sudo</span></span><span initial="start" animate="end" variants="[object Object]" custom="0.732"> </span><span initial="start" animate="end" variants="[object Object]" custom="0.738">iptables </span><span initial="start" animate="end" variants="[object Object]" custom="0.744">-I </span><span initial="start" animate="end" variants="[object Object]" custom="0.75">INPUT </span><span initial="start" animate="end" variants="[object Object]" custom="0.756">3 </span><span initial="start" animate="end" variants="[object Object]" custom="0.762">-i </span><span initial="start" animate="end" variants="[object Object]" custom="0.768">lo </span><span initial="start" animate="end" variants="[object Object]" custom="0.774">-j </span><span initial="start" animate="end" variants="[object Object]" custom="0.78">ACCEPT </span><span initial="start" animate="end" variants="[object Object]" custom="0.786"><span class="hljs-built_in">sudo</span></span><span initial="start" animate="end" variants="[object Object]" custom="0.792"> </span><span initial="start" animate="end" variants="[object Object]" custom="0.798">iptables </span><span initial="start" animate="end" variants="[object Object]" custom="0.804">-I </span><span initial="start" animate="end" variants="[object Object]" custom="0.81">INPUT </span><span initial="start" animate="end" variants="[object Object]" custom="0.816">4 </span><span initial="start" animate="end" variants="[object Object]" custom="0.822">-p </span><span initial="start" animate="end" variants="[object Object]" custom="0.828">udp </span><span initial="start" animate="end" variants="[object Object]" custom="0.834">--dport </span><span initial="start" animate="end" variants="[object Object]" custom="0.84">3478 </span><span initial="start" animate="end" variants="[object Object]" custom="0.846">-j </span><span initial="start" animate="end" variants="[object Object]" custom="0.852">ACCEPT </span><span initial="start" animate="end" variants="[object Object]" custom="0.858"><span class="hljs-comment"># NetBird TURN</span></span><span initial="start" animate="end" variants="[object Object]" custom="0.864"> </span><span initial="start" animate="end" variants="[object Object]" custom="0.87"><span class="hljs-built_in">sudo</span></span><span initial="start" animate="end" variants="[object Object]" custom="0.876"> </span><span initial="start" animate="end" variants="[object Object]" custom="0.882">iptables </span><span initial="start" animate="end" variants="[object Object]" custom="0.888">-I </span><span initial="start" animate="end" variants="[object Object]" custom="0.894">INPUT </span><span initial="start" animate="end" variants="[object Object]" custom="0.9">5 </span><span initial="start" animate="end" variants="[object Object]" custom="0.906">-p </span><span initial="start" animate="end" variants="[object Object]" custom="0.912">tcp </span><span initial="start" animate="end" variants="[object Object]" custom="0.918">--dport </span><span initial="start" animate="end" variants="[object Object]" custom="0.924">3000 </span><span initial="start" animate="end" variants="[object Object]" custom="0.93">-j </span><span initial="start" animate="end" variants="[object Object]" custom="0.936">ACCEPT </span><span initial="start" animate="end" variants="[object Object]" custom="0.942"><span class="hljs-comment"># Your service port</span></span><span initial="start" animate="end" variants="[object Object]" custom="0.948"> </span><span initial="start" animate="end" variants="[object Object]" custom="0.954"><span class="hljs-built_in">sudo</span></span><span initial="start" animate="end" variants="[object Object]" custom="0.96"> </span><span initial="start" animate="end" variants="[object Object]" custom="0.966">iptables </span><span initial="start" animate="end" variants="[object Object]" custom="0.972">-I </span><span initial="start" animate="end" variants="[object Object]" custom="0.978">INPUT </span><span initial="start" animate="end" variants="[object Object]" custom="0.984">6 </span><span initial="start" animate="end" variants="[object Object]" custom="0.99">-p </span><span initial="start" animate="end" variants="[object Object]" custom="0.996">tcp </span><span initial="start" animate="end" variants="[object Object]" custom="1.002">--dport </span><span initial="start" animate="end" variants="[object Object]" custom="1.008">22 </span><span initial="start" animate="end" variants="[object Object]" custom="1.014">-j </span><span initial="start" animate="end" variants="[object Object]" custom="1.02">ACCEPT </span><span initial="start" animate="end" variants="[object Object]" custom="1.026"><span class="hljs-comment"># SSH</span></span><span initial="start" animate="end" variants="[object Object]" custom="1.032"> </span></code></pre></div></div></div><p><span class="font-ligatures-none whitespace-pre-wrap">Then save the rules so they persist across reboots (example using <code class="font-ligatures-none mx-0.5 rounded-[4px] border border-stroke-300 bg-accent-200/60 px-1 py-px font-mono text-foreground-800 text-sm dark:bg-accent-200" style="opacity: 1;">iptables-persistent</code>):</span></p><div class="rounded-xl dark:border dark:border-stroke-250" style="opacity: 1;"><div class="flex w-full items-center justify-between border-b border-white/20 bg-background-static-850 py-2 pe-2.5 ps-4 text-foreground-static-250 text-sm dark:border-stroke-250 dark:bg-background-static-900 rounded-t-xl"><div class="flex items-center gap-2"><span class="capitalize">bash</span><button class="relative min-h-9 min-w-9 rounded-xl bg-transparent p-2 hover:bg-white/8 active:bg-white/5" type="button" title="Collapse code snippet" aria-expanded="true"><svg viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg" class="size-4 transition-transform -rotate-90"><g id="Chevron"><path id="Shape" d="M8.46967 4.21967C8.17678 4.51256 8.17678 4.98744 8.46967 5.28033L15.1893 12L8.46967 18.7197C8.17678 19.0126 8.17678 19.4874 8.46967 19.7803C8.76256 20.0732 9.23744 20.0732 9.53033 19.7803L16.7803 12.5303C17.0732 12.2374 17.0732 11.7626 16.7803 11.4697L9.53033 4.21967C9.23744 3.92678 8.76256 3.92678 8.46967 4.21967Z" fill="currentColor"></path></g></svg></button></div><button class="relative min-h-9 min-w-9 gap-1.5 rounded-xl bg-transparent p-2 hover:bg-white/8 active:bg-white/5" type="button" title="Copy code" data-copy="false"><div class="flex items-center justify-center gap-2" aria-hidden="true"><svg viewBox="0 0 21 20" fill="none" xmlns="http://www.w3.org/2000/svg" class="w-5"><mask id="mask0_25413_62234" style="mask-type: alpha;" maskUnits="userSpaceOnUse" x="0" y="0" width="21" height="20"><path d="M8.5 2C7.39543 2 6.5 2.89543 6.5 4V14C6.5 15.1046 7.39543 16 8.5 16H14.5C15.6046 16 16.5 15.1046 16.5 14V4C16.5 2.89543 15.6046 2 14.5 2H8.5ZM7.5 4C7.5 3.44772 7.94772 3 8.5 3H14.5C15.0523 3 15.5 3.44772 15.5 4V14C15.5 14.5523 15.0523 15 14.5 15H8.5C7.94772 15 7.5 14.5523 7.5 14V4ZM4.5 6.00001C4.5 5.25973 4.9022 4.61339 5.5 4.26758V14.5C5.5 15.8807 6.61929 17 8 17H14.2324C13.8866 17.5978 13.2403 18 12.5 18H8C6.067 18 4.5 16.433 4.5 14.5V6.00001Z" fill="currentColor"></path></mask><g mask="url(#mask0_25413_62234)"><rect width="24" height="24" transform="translate(-1.5 -2)" fill="currentColor"></rect></g></svg> Copy</div></button></div><div class="rounded-b-xl bg-background-static-850 px-4 pb-1.5 dark:bg-background-static-900"><div class="horizontal-scrollbar overflow-x-auto whitespace-pre pb-3 pt-4 text-sm"><pre><code class="font-ligatures-none text-sm"><span initial="start" animate="end" variants="[object Object]" custom="1.122"><span class="hljs-built_in">sudo</span></span><span initial="start" animate="end" variants="[object Object]" custom="1.128"> </span><span initial="start" animate="end" variants="[object Object]" custom="1.134">netfilter-persistent </span><span initial="start" animate="end" variants="[object Object]" custom="1.14">save </span></code></pre></div></div></div><div class="relative pb-6 w-full after:border-b after:border-stroke-300 after:w-full after:absolute after:mt-3"></div><h3 class="text-lg-medium pb-1 [&amp;:not(:first-child)]:pt-3.5"><strong>Result</strong></h3><ul class="relative list-outside marker:text-foreground-750 dark:marker:text-foreground-600 flex flex-col ms-4 px-1"><li class="ps-2" style="opacity: 1;"><p><span class="font-ligatures-none whitespace-pre-wrap">NetBird traffic reaches the DNAT target.</span></p></li><li class="ps-2" style="opacity: 1;"><p><span class="font-ligatures-none whitespace-pre-wrap">Services become reachable from outside.</span></p></li><li class="ps-2" style="opacity: 1;"><p><span class="font-ligatures-none whitespace-pre-wrap">UFW can be removed entirely to avoid confusion.</span></p></li></ul>
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
2021 Q4
2022 Q1
2022 Q1
accessibility
acl
agent
agent
Android
Android
api
authentik
automation
azure
battery-usage
bug
cache
client
client-ui
cloud
cloud-only
cloudflare
community
compatibility
config-idp
config-issue
connection
contribution
coturn
cross-vpn
dashboard
data-usage
distribution
dns
docker
documentation
duplicate
enhancement
enhancement
event-stream
feature-request
freebsd
getting-started
go
good first issue
gui
help wanted
home-assistant
idp
inconsistency
integration
integrations
ios
ipv6
jwt
k8s
keycloak
linux
login
macos
management-service
missing-docs
mobile
moved-internal
needs-review
netbird-ui
networking
new-platform
nginx
notification
okta
openwrt
packaging
peer-management
peer-management
peer-management
performance
postgres
posture-checks
psk
pull-request
Mirrored from GitHub Pull Request
 question
refactor
relay
release
rfc
routes
security
security-related
self-hosting
server
signal
sleep-issue
ssh
ssl
status
store
synology
system-compatibility-issue
test-suite
third-party-integration
triage
triage-needed
troubleshooting
UX
waiting-feedback
windows
wontfix
zitadel
No Label client cloud networking waiting-feedback
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
saavagebueno
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: SVI/netbird#1162
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?