SVI/netbird
1
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-06-10 01:12:51 -04:00
Code Issues 3.0k Packages Projects Releases 10 Wiki Activity

VPN before Windows logon #1382

New Issue
Open
opened 2025-11-20 05:29:21 -05:00 by saavagebueno · 7 comments
saavagebueno commented 2025-11-20 05:29:21 -05:00
Owner
Copy Link

Originally created by @LokoOn on GitHub (Oct 29, 2024).

Is your feature request related to a problem? Please describe.
It's not uncommon for a Windows domain-joined device to be located outside of its home network.

Often, such a device will have an internet connection before a user logs in. If a VPN connection could be established prior to user login, settings, updates, and other configurations from the domain controller could be synchronized directly from the LAN, even without an active user session on the Windows device.

Additionally, with an established VPN connection, login credentials could be verified directly against the central directory. This would also enable users to log in to a Windows client for the first time, even if they had never previously logged in on that particular device.

The pre-login VPN connection should ask for a NetBird user authentication. This ensures that only an authorized user can create a VPN connection.
Using a setup key is not a viable solution, as it authenticates the machine rather than the user, allowing any user on the device to establish a NetBird connection. This could pose a security risk in the case of device loss

Describe the solution you'd like
A pre-login VPN connection at the User logon screen with the option to fill in Netbird SSO credentials.
Such as OpenVPN has implemented: https://support.openvpn.com/hc/en-us/articles/25415580917019-Access-Server-Configure-Start-Before-Logon-SBL-Pre-Logon-Access-Provider-PLAP-using-OpenVPN-GUI

Originally created by @LokoOn on GitHub (Oct 29, 2024). **Is your feature request related to a problem? Please describe.** It's not uncommon for a Windows domain-joined device to be located outside of its home network. Often, such a device will have an internet connection before a user logs in. If a VPN connection could be established prior to user login, settings, updates, and other configurations from the domain controller could be synchronized directly from the LAN, even without an active user session on the Windows device. Additionally, with an established VPN connection, login credentials could be verified directly against the central directory. This would also enable users to log in to a Windows client for the first time, even if they had never previously logged in on that particular device. The pre-login VPN connection should ask for a NetBird user authentication. This ensures that only an authorized user can create a VPN connection. Using a setup key is not a viable solution, as it authenticates the machine rather than the user, allowing any user on the device to establish a NetBird connection. This could pose a security risk in the case of device loss **Describe the solution you'd like** A pre-login VPN connection at the User logon screen with the option to fill in Netbird SSO credentials. Such as OpenVPN has implemented: https://support.openvpn.com/hc/en-us/articles/25415580917019-Access-Server-Configure-Start-Before-Logon-SBL-Pre-Logon-Access-Provider-PLAP-using-OpenVPN-GUI
saavagebueno added the feature-requestwindows labels 2025-11-20 05:29:21 -05:00
saavagebueno commented 2025-11-20 05:29:22 -05:00
Author
Owner
Copy Link

@Lamera commented on GitHub (Oct 31, 2024):

@LokoOn Is this not actually the case when you deploy netbird with a setup key?

@Lamera commented on GitHub (Oct 31, 2024): @LokoOn Is this not actually the case when you deploy netbird with a setup key?
saavagebueno commented 2025-11-20 05:29:22 -05:00
Author
Owner
Copy Link

@LokoOn commented on GitHub (Oct 31, 2024):

@Lamera you are totally right. When using a setup key, than the VPN is established automatically on system start.
That's handy for container, server workloads.
I need to add some to the feature request.

There should be an option to establish a NetBird connection before the Windows login using user authentication. This ensures that only an authorized user can create a VPN connection. Using a setup key is not a viable solution, as it authenticates the machine rather than the user, allowing any user on the device to establish a NetBird connection. This could pose a security risk in the case of device loss

@LokoOn commented on GitHub (Oct 31, 2024): @Lamera you are totally right. When using a setup key, than the VPN is established automatically on system start. That's handy for container, server workloads. I need to add some to the feature request. There should be an option to establish a NetBird connection before the Windows login using user authentication. This ensures that only an authorized user can create a VPN connection. Using a setup key is not a viable solution, as it authenticates the machine rather than the user, allowing any user on the device to establish a NetBird connection. This could pose a security risk in the case of device loss
saavagebueno commented 2025-11-20 05:29:22 -05:00
Author
Owner
Copy Link

@snailzrus commented on GitHub (Nov 2, 2024):

100% agree, this would be a really great addition for using Netbird for corporate devices so that they can auth the windows login against an Active Directory server elsewhere on Earth

@snailzrus commented on GitHub (Nov 2, 2024): 100% agree, this would be a really great addition for using Netbird for corporate devices so that they can auth the windows login against an Active Directory server elsewhere on Earth
saavagebueno commented 2025-11-20 05:29:22 -05:00
Author
Owner
Copy Link

@mlsmaycon commented on GitHub (Nov 5, 2024):

Is this a limited connection mode where netbird would connect and give access to the AD for authentication only? What would be the security risk of that?

@mlsmaycon commented on GitHub (Nov 5, 2024): Is this a limited connection mode where netbird would connect and give access to the AD for authentication only? What would be the security risk of that?
saavagebueno commented 2025-11-20 05:29:22 -05:00
Author
Owner
Copy Link

@snailzrus commented on GitHub (Nov 5, 2024):

So Windows makes it possible to establish a VPN connection before Windows login has been completed. It presents authentication to the user, so there shouldn't be any additional risk. I think the biggest problem I can think of is how Windows allows that auth, which is that Windows likely won't allow a browser SSO auth before the user has logged in.

Here is the doc that Palo Alto has for this feature, though it's not using SSO auth:
https://docs.paloaltonetworks.com/globalprotect/5-2/globalprotect-app-user-guide/globalprotect-app-for-windows/use-connect-before-logon-followed-by-the-authentication-method

@snailzrus commented on GitHub (Nov 5, 2024): So Windows makes it possible to establish a VPN connection before Windows login has been completed. It presents authentication to the user, so there shouldn't be any additional risk. I think the biggest problem I can think of is how Windows allows that auth, which is that Windows likely won't allow a browser SSO auth before the user has logged in. Here is the doc that Palo Alto has for this feature, though it's not using SSO auth: https://docs.paloaltonetworks.com/globalprotect/5-2/globalprotect-app-user-guide/globalprotect-app-for-windows/use-connect-before-logon-followed-by-the-authentication-method
saavagebueno commented 2025-11-20 05:29:22 -05:00
Author
Owner
Copy Link

@Gauss23 commented on GitHub (Nov 15, 2024):

I think using a setup key in combination with Bitlocker and a pre-boot password would be also an option. In case of device loss the the new owner is not able to do very much.

@Gauss23 commented on GitHub (Nov 15, 2024): I think using a setup key in combination with Bitlocker and a pre-boot password would be also an option. In case of device loss the the new owner is not able to do very much.
saavagebueno commented 2025-11-20 05:29:23 -05:00
Author
Owner
Copy Link

@Matt0550 commented on GitHub (Oct 21, 2025):

Any news/workaround?

@Matt0550 commented on GitHub (Oct 21, 2025): Any news/workaround?
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
2021 Q4
2022 Q1
2022 Q1
accessibility
acl
agent
agent
Android
Android
api
authentik
automation
azure
battery-usage
bug
cache
client
client-ui
cloud
cloud-only
cloudflare
community
compatibility
config-idp
config-issue
connection
contribution
coturn
cross-vpn
dashboard
data-usage
distribution
dns
docker
documentation
duplicate
enhancement
enhancement
event-stream
feature-request
freebsd
getting-started
go
good first issue
gui
help wanted
home-assistant
idp
inconsistency
integration
integrations
ios
ipv6
jwt
k8s
keycloak
linux
login
macos
management-service
missing-docs
mobile
moved-internal
needs-review
netbird-ui
networking
new-platform
nginx
notification
okta
openwrt
packaging
peer-management
peer-management
peer-management
performance
postgres
posture-checks
psk
pull-request
Mirrored from GitHub Pull Request
 question
refactor
relay
release
rfc
routes
security
security-related
self-hosting
server
signal
sleep-issue
ssh
ssl
status
store
synology
system-compatibility-issue
test-suite
third-party-integration
triage
triage-needed
troubleshooting
UX
waiting-feedback
windows
wontfix
zitadel
No Label feature-request windows
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
saavagebueno
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: SVI/netbird#1382
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?