SVI/netbird
1
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-05-13 19:52:13 -04:00
Code Issues 3.0k Packages Projects Releases 10 Wiki Activity

SearXNG opensearch.xml works through LAN, but not through NetBird #1452

New Issue
Open
opened 2025-11-20 05:30:46 -05:00 by saavagebueno · 5 comments
saavagebueno commented 2025-11-20 05:30:46 -05:00
Owner
Copy Link

Originally created by @MorsMortium on GitHub (Nov 25, 2024).

Describe the problem

I'm using the free tier of NetBird available from the website. I have set up an instance of the SearXNG search engine on one machine, that's added to my machines. I have set up SearXNG IP to be the one shown by NetBird. From another machine I can access the engine, search, save settings, etc., but if I try to add the engine to Firefox, which uses opensearch.xml, it fails to do so.
I have set the IP of SearXNG to the router provided IP, when the 2 machines were in the same LAN, and then adding the engine worked. I have tried both the AUR and the Docker image of SearXNG with the same results.

The error message is the following:

Firefox could not download the search plugin from: http://100.78.162.141:8888/opensearch.xml?method=GET&autocomplete=

To Reproduce

Steps to reproduce the behavior:

  1. Add 2 machines to NetBird
  2. Install and set up SearXNG on one machine, based on these docs: https://docs.searxng.org/admin/installation-docker.html or on an Arch Linux system through this package: https://aur.archlinux.org/packages/searxng-git
  3. Confirm that the engine is usable from the other machine
  4. Try to add the engine with right clicking into the address bar, when on the engines page and clicking Add "my-instance"
  5. See error

Expected behavior

That Firefox successfully adds the engine to it's engine list, as it does through the exact same setup, using the LAN IP.

Are you using NetBird Cloud?

I use the the version hosted by NetBird on https://app.netbird.io/

NetBird version

0.33.0 on both machines

NetBird status -dA output:

Client:

Peers detail:
 server.netbird.cloud:
  NetBird IP: 100.78.162.141
  Public key: JZP73b/7q82v6fD05jP8ArSc4dXFkv8QUWpgktW0PlU=
  Status: Connected
  -- detail --
  Connection type: P2P
  ICE candidate (Local/Remote): srflx/srflx
  ICE candidate endpoints (Local/Remote): 198.51.100.0:5838/198.51.100.1:51820
  Relay server address: rels://streamline-de-fra1-0.relay.netbird.io:443
  Last connection update: 21 seconds ago
  Last WireGuard handshake: 21 seconds ago
  Transfer status (received/sent) 37.5 KiB/15.0 KiB
  Quantum resistance: false
  Routes: -
  Latency: 38.338984ms

OS: linux/amd64
Daemon version: 0.33.0
CLI version: 0.33.0
Management: Connected to https://api.netbird.io:443
Signal: Connected to https://signal.netbird.io:443
Relays: 
  [stun:stun.netbird.io:5555] is Available
  [turns:turn.netbird.io:443?transport=tcp] is Unavailable, reason: dial: d.Dialer.DialContext: dial tcp 198.51.100.2:443: connect: no route to host
  [rels://streamline-de-fra1-0.relay.netbird.io:443] is Available
Nameservers: 
FQDN: phone.netbird.cloud
NetBird IP: 100.78.36.177/16
Interface type: Kernel
Quantum resistance: false
Routes: -
Peers count: 1/1 Connected

Server:
I'll add it soon, but they are the exact same distros with exact same package and NetBird versions and use the exact same router through a switch

Do you face any (non-mobile) client issues?

Client:
netbird.debug.3764821383.zip

Server:
I'll add it soon, but they are the exact same distros with exact same package and NetBird versions and use the exact same router through a switch

Originally created by @MorsMortium on GitHub (Nov 25, 2024). **Describe the problem** I'm using the free tier of NetBird available from the website. I have set up an instance of the SearXNG search engine on one machine, that's added to my machines. I have set up SearXNG IP to be the one shown by NetBird. From another machine I can access the engine, search, save settings, etc., but if I try to add the engine to Firefox, which uses opensearch.xml, it fails to do so. I have set the IP of SearXNG to the router provided IP, when the 2 machines were in the same LAN, and then adding the engine worked. I have tried both the AUR and the Docker image of SearXNG with the same results. The error message is the following: ``` Firefox could not download the search plugin from: http://100.78.162.141:8888/opensearch.xml?method=GET&autocomplete= ``` **To Reproduce** Steps to reproduce the behavior: 1. Add 2 machines to NetBird 2. Install and set up SearXNG on one machine, based on these docs: https://docs.searxng.org/admin/installation-docker.html or on an Arch Linux system through this package: https://aur.archlinux.org/packages/searxng-git 4. Confirm that the engine is usable from the other machine 5. Try to add the engine with right clicking into the address bar, when on the engines page and clicking Add "my-instance" 6. See error **Expected behavior** That Firefox successfully adds the engine to it's engine list, as it does through the exact same setup, using the LAN IP. **Are you using NetBird Cloud?** I use the the version hosted by NetBird on https://app.netbird.io/ **NetBird version** 0.33.0 on both machines **NetBird status -dA output:** Client: ``` Peers detail: server.netbird.cloud: NetBird IP: 100.78.162.141 Public key: JZP73b/7q82v6fD05jP8ArSc4dXFkv8QUWpgktW0PlU= Status: Connected -- detail -- Connection type: P2P ICE candidate (Local/Remote): srflx/srflx ICE candidate endpoints (Local/Remote): 198.51.100.0:5838/198.51.100.1:51820 Relay server address: rels://streamline-de-fra1-0.relay.netbird.io:443 Last connection update: 21 seconds ago Last WireGuard handshake: 21 seconds ago Transfer status (received/sent) 37.5 KiB/15.0 KiB Quantum resistance: false Routes: - Latency: 38.338984ms OS: linux/amd64 Daemon version: 0.33.0 CLI version: 0.33.0 Management: Connected to https://api.netbird.io:443 Signal: Connected to https://signal.netbird.io:443 Relays: [stun:stun.netbird.io:5555] is Available [turns:turn.netbird.io:443?transport=tcp] is Unavailable, reason: dial: d.Dialer.DialContext: dial tcp 198.51.100.2:443: connect: no route to host [rels://streamline-de-fra1-0.relay.netbird.io:443] is Available Nameservers: FQDN: phone.netbird.cloud NetBird IP: 100.78.36.177/16 Interface type: Kernel Quantum resistance: false Routes: - Peers count: 1/1 Connected ``` Server: I'll add it soon, but they are the exact same distros with exact same package and NetBird versions and use the exact same router through a switch **Do you face any (non-mobile) client issues?** Client: [netbird.debug.3764821383.zip](https://github.com/user-attachments/files/17898104/netbird.debug.3764821383.zip) Server: I'll add it soon, but they are the exact same distros with exact same package and NetBird versions and use the exact same router through a switch
saavagebueno added the waiting-feedbackdockerlinux labels 2025-11-20 05:30:47 -05:00
saavagebueno commented 2025-11-20 05:30:47 -05:00
Author
Owner
Copy Link

@mgarces commented on GitHub (Nov 29, 2024):

Hi there, can you please show a screenshot of the error? I've tested the scenario you suggest, but I did not receive the error on Firefox; however when I do add the search engine and set it as default, when I do a search, I'm sent to http://localhost:8080/search ; but in general I can use SearXNG both via internal LAN IP address and with NetBird IP address

@mgarces commented on GitHub (Nov 29, 2024): Hi there, can you please show a screenshot of the error? I've tested the scenario you suggest, but I did not receive the error on Firefox; however when I do add the search engine and set it as default, when I do a search, I'm sent to `http://localhost:8080/search` ; but in general I can use `SearXNG` both via internal LAN IP address and with NetBird IP address
saavagebueno commented 2025-11-20 05:30:47 -05:00
Author
Owner
Copy Link

@mgarces commented on GitHub (Nov 29, 2024):

I'm guessing that the localhost issue is some setting inside SearXNG, but this is beyond our tests.
Could you please attach also your iptables-save and nft list ruleset.

@mgarces commented on GitHub (Nov 29, 2024): I'm guessing that the `localhost` issue is some setting inside `SearXNG`, but this is beyond our tests. Could you please attach also your `iptables-save` and `nft list ruleset`.
saavagebueno commented 2025-11-20 05:30:48 -05:00
Author
Owner
Copy Link

@MorsMortium commented on GitHub (Nov 29, 2024):

@mgarces Thank you for looking into it!

image

Client:

# Generated by iptables-save v1.8.10 on Fri Nov 29 17:41:57 2024
*mangle
:PREROUTING ACCEPT [1797199:2475581372]
:INPUT ACCEPT [1792488:2475164535]
:FORWARD ACCEPT [636:177788]
:OUTPUT ACCEPT [1041725:251262584]
:POSTROUTING ACCEPT [1044441:251896997]
:NETBIRD-RT-PRE - [0:0]
-A PREROUTING -i wt0 -m addrtype --dst-type LOCAL -j MARK --set-xmark 0x1bd01/0xffffffff
-A PREROUTING -j NETBIRD-RT-PRE
COMMIT
# Completed on Fri Nov 29 17:41:57 2024
# Generated by iptables-save v1.8.10 on Fri Nov 29 17:41:57 2024
*nat
:PREROUTING ACCEPT [4355:252619]
:INPUT ACCEPT [723:107238]
:OUTPUT ACCEPT [232186:17574911]
:POSTROUTING ACCEPT [232186:17574911]
:NETBIRD-RT-NAT - [0:0]
-A POSTROUTING -j NETBIRD-RT-NAT
-A NETBIRD-RT-NAT ! -o lo -m mark --mark 0x1bd11 -j MASQUERADE
-A NETBIRD-RT-NAT -o wt0 -m mark --mark 0x1bd12 -j MASQUERADE
COMMIT
# Completed on Fri Nov 29 17:41:57 2024
# Generated by iptables-save v1.8.10 on Fri Nov 29 17:41:57 2024
*filter
:INPUT ACCEPT [1772204:2463317357]
:FORWARD ACCEPT [636:177788]
:OUTPUT ACCEPT [1015434:246374587]
:NETBIRD-ACL-INPUT - [0:0]
:NETBIRD-ACL-OUTPUT - [0:0]
:NETBIRD-RT-FWD - [0:0]
-A INPUT -i wt0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i wt0 -j NETBIRD-ACL-INPUT
-A INPUT -i wt0 -j DROP
-A FORWARD -o wt0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -m mark --mark 0x1bd01 -j NETBIRD-ACL-INPUT
-A FORWARD -i wt0 -j NETBIRD-RT-FWD
-A FORWARD -i wt0 -j DROP
-A OUTPUT -o wt0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT ! -d 100.78.0.0/16 -o wt0 -j ACCEPT
-A OUTPUT -o wt0 -j NETBIRD-ACL-OUTPUT
-A OUTPUT -o wt0 -j DROP
-A NETBIRD-ACL-INPUT -j ACCEPT
-A NETBIRD-ACL-OUTPUT -j ACCEPT
-A NETBIRD-RT-FWD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
COMMIT
# Completed on Fri Nov 29 17:41:57 2024

table ip libvirt_network {
        chain forward {
                type filter hook forward priority filter; policy accept;
                counter packets 636 bytes 177788 jump guest_cross
                counter packets 636 bytes 177788 jump guest_input
                counter packets 636 bytes 177788 jump guest_output
        }

        chain guest_output {
                ip saddr 192.168.122.0/24 iif "virbr0" counter packets 0 bytes 0 accept
                iif "virbr0" counter packets 0 bytes 0 reject
        }

        chain guest_input {
                oif "virbr0" ip daddr 192.168.122.0/24 ct state established,related counter packets 0 bytes 0 accept
                oif "virbr0" counter packets 0 bytes 0 reject
        }

        chain guest_cross {
                iif "virbr0" oif "virbr0" counter packets 0 bytes 0 accept
        }

        chain guest_nat {
                type nat hook postrouting priority srcnat; policy accept;
                ip saddr 192.168.122.0/24 ip daddr 224.0.0.0/24 counter packets 0 bytes 0 return
                ip saddr 192.168.122.0/24 ip daddr 255.255.255.255 counter packets 0 bytes 0 return
                meta l4proto tcp ip saddr 192.168.122.0/24 ip daddr != 192.168.122.0/24 counter packets 0 bytes 0 masquerade to :1024-65535
                meta l4proto udp ip saddr 192.168.122.0/24 ip daddr != 192.168.122.0/24 counter packets 0 bytes 0 masquerade to :1024-65535
                ip saddr 192.168.122.0/24 ip daddr != 192.168.122.0/24 counter packets 0 bytes 0 masquerade
        }
}
table ip6 libvirt_network {
        chain forward {
                type filter hook forward priority filter; policy accept;
                counter packets 0 bytes 0 jump guest_cross
                counter packets 0 bytes 0 jump guest_input
                counter packets 0 bytes 0 jump guest_output
        }

        chain guest_output {
        }

        chain guest_input {
        }

        chain guest_cross {
        }

        chain guest_nat {
                type nat hook postrouting priority srcnat; policy accept;
        }
}

Server:

# Generated by iptables-save v1.8.10 on Fri Nov 29 17:56:57 2024
*mangle
:PREROUTING ACCEPT [2620:1719206]
:INPUT ACCEPT [2269:1606018]
:FORWARD ACCEPT [351:113188]
:OUTPUT ACCEPT [2151:549022]
:POSTROUTING ACCEPT [2537:669346]
:NETBIRD-RT-PRE - [0:0]
-A PREROUTING -i wt0 -m addrtype --dst-type LOCAL -j MARK --set-xmark 0x1bd01/0xffffffff
-A PREROUTING -j NETBIRD-RT-PRE
COMMIT
# Completed on Fri Nov 29 17:56:57 2024
# Generated by iptables-save v1.8.10 on Fri Nov 29 17:56:57 2024
*nat
:PREROUTING ACCEPT [43:6129]
:INPUT ACCEPT [43:6129]
:OUTPUT ACCEPT [170:16389]
:POSTROUTING ACCEPT [200:18189]
:DOCKER - [0:0]
:NETBIRD-RT-NAT - [0:0]
-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER
-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER
-A POSTROUTING -s 172.17.0.0/16 ! -o docker0 -j MASQUERADE
-A POSTROUTING -j NETBIRD-RT-NAT
-A POSTROUTING -s 172.17.0.2/32 -d 172.17.0.2/32 -p tcp -m tcp --dport 80 -j MASQUERADE
-A DOCKER -i docker0 -j RETURN
-A DOCKER ! -i docker0 -p tcp -m tcp --dport 8080 -j DNAT --to-destination 172.17.0.2:80
-A NETBIRD-RT-NAT ! -o lo -m mark --mark 0x1bd11 -j MASQUERADE
-A NETBIRD-RT-NAT -o wt0 -m mark --mark 0x1bd12 -j MASQUERADE
COMMIT
# Completed on Fri Nov 29 17:56:57 2024
# Generated by iptables-save v1.8.10 on Fri Nov 29 17:56:57 2024
*filter
:INPUT ACCEPT [2094:1577487]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [2048:420229]
:DOCKER - [0:0]
:DOCKER-ISOLATION-STAGE-1 - [0:0]
:DOCKER-ISOLATION-STAGE-2 - [0:0]
:DOCKER-USER - [0:0]
:NETBIRD-ACL-INPUT - [0:0]
:NETBIRD-ACL-OUTPUT - [0:0]
:NETBIRD-RT-FWD - [0:0]
-A INPUT -i wt0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i wt0 -j NETBIRD-ACL-INPUT
-A INPUT -i wt0 -j DROP
-A FORWARD -j DOCKER-USER
-A FORWARD -j DOCKER-ISOLATION-STAGE-1
-A FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -o docker0 -j DOCKER
-A FORWARD -i docker0 ! -o docker0 -j ACCEPT
-A FORWARD -i docker0 -o docker0 -j ACCEPT
-A FORWARD -o wt0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -m mark --mark 0x1bd01 -j NETBIRD-ACL-INPUT
-A FORWARD -i wt0 -j NETBIRD-RT-FWD
-A FORWARD -i wt0 -j DROP
-A OUTPUT -o wt0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT ! -d 100.78.0.0/16 -o wt0 -j ACCEPT
-A OUTPUT -o wt0 -j NETBIRD-ACL-OUTPUT
-A OUTPUT -o wt0 -j DROP
-A DOCKER -d 172.17.0.2/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 80 -j ACCEPT
-A DOCKER-ISOLATION-STAGE-1 -i docker0 ! -o docker0 -j DOCKER-ISOLATION-STAGE-2
-A DOCKER-ISOLATION-STAGE-1 -j RETURN
-A DOCKER-ISOLATION-STAGE-2 -o docker0 -j DROP
-A DOCKER-ISOLATION-STAGE-2 -j RETURN
-A DOCKER-USER -j RETURN
-A NETBIRD-ACL-INPUT -j ACCEPT
-A NETBIRD-ACL-OUTPUT -j ACCEPT
-A NETBIRD-RT-FWD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
COMMIT
# Completed on Fri Nov 29 17:56:57 2024

On the server nft list ruleset returns nothing (it was ran with sudo there too)

@MorsMortium commented on GitHub (Nov 29, 2024): @mgarces Thank you for looking into it! ![image](https://github.com/user-attachments/assets/57933383-3dd0-4258-9e08-1ef5025a6ae4) Client: ``` # Generated by iptables-save v1.8.10 on Fri Nov 29 17:41:57 2024 *mangle :PREROUTING ACCEPT [1797199:2475581372] :INPUT ACCEPT [1792488:2475164535] :FORWARD ACCEPT [636:177788] :OUTPUT ACCEPT [1041725:251262584] :POSTROUTING ACCEPT [1044441:251896997] :NETBIRD-RT-PRE - [0:0] -A PREROUTING -i wt0 -m addrtype --dst-type LOCAL -j MARK --set-xmark 0x1bd01/0xffffffff -A PREROUTING -j NETBIRD-RT-PRE COMMIT # Completed on Fri Nov 29 17:41:57 2024 # Generated by iptables-save v1.8.10 on Fri Nov 29 17:41:57 2024 *nat :PREROUTING ACCEPT [4355:252619] :INPUT ACCEPT [723:107238] :OUTPUT ACCEPT [232186:17574911] :POSTROUTING ACCEPT [232186:17574911] :NETBIRD-RT-NAT - [0:0] -A POSTROUTING -j NETBIRD-RT-NAT -A NETBIRD-RT-NAT ! -o lo -m mark --mark 0x1bd11 -j MASQUERADE -A NETBIRD-RT-NAT -o wt0 -m mark --mark 0x1bd12 -j MASQUERADE COMMIT # Completed on Fri Nov 29 17:41:57 2024 # Generated by iptables-save v1.8.10 on Fri Nov 29 17:41:57 2024 *filter :INPUT ACCEPT [1772204:2463317357] :FORWARD ACCEPT [636:177788] :OUTPUT ACCEPT [1015434:246374587] :NETBIRD-ACL-INPUT - [0:0] :NETBIRD-ACL-OUTPUT - [0:0] :NETBIRD-RT-FWD - [0:0] -A INPUT -i wt0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT -A INPUT -i wt0 -j NETBIRD-ACL-INPUT -A INPUT -i wt0 -j DROP -A FORWARD -o wt0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT -A FORWARD -m mark --mark 0x1bd01 -j NETBIRD-ACL-INPUT -A FORWARD -i wt0 -j NETBIRD-RT-FWD -A FORWARD -i wt0 -j DROP -A OUTPUT -o wt0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT -A OUTPUT ! -d 100.78.0.0/16 -o wt0 -j ACCEPT -A OUTPUT -o wt0 -j NETBIRD-ACL-OUTPUT -A OUTPUT -o wt0 -j DROP -A NETBIRD-ACL-INPUT -j ACCEPT -A NETBIRD-ACL-OUTPUT -j ACCEPT -A NETBIRD-RT-FWD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT COMMIT # Completed on Fri Nov 29 17:41:57 2024 ``` ``` table ip libvirt_network { chain forward { type filter hook forward priority filter; policy accept; counter packets 636 bytes 177788 jump guest_cross counter packets 636 bytes 177788 jump guest_input counter packets 636 bytes 177788 jump guest_output } chain guest_output { ip saddr 192.168.122.0/24 iif "virbr0" counter packets 0 bytes 0 accept iif "virbr0" counter packets 0 bytes 0 reject } chain guest_input { oif "virbr0" ip daddr 192.168.122.0/24 ct state established,related counter packets 0 bytes 0 accept oif "virbr0" counter packets 0 bytes 0 reject } chain guest_cross { iif "virbr0" oif "virbr0" counter packets 0 bytes 0 accept } chain guest_nat { type nat hook postrouting priority srcnat; policy accept; ip saddr 192.168.122.0/24 ip daddr 224.0.0.0/24 counter packets 0 bytes 0 return ip saddr 192.168.122.0/24 ip daddr 255.255.255.255 counter packets 0 bytes 0 return meta l4proto tcp ip saddr 192.168.122.0/24 ip daddr != 192.168.122.0/24 counter packets 0 bytes 0 masquerade to :1024-65535 meta l4proto udp ip saddr 192.168.122.0/24 ip daddr != 192.168.122.0/24 counter packets 0 bytes 0 masquerade to :1024-65535 ip saddr 192.168.122.0/24 ip daddr != 192.168.122.0/24 counter packets 0 bytes 0 masquerade } } table ip6 libvirt_network { chain forward { type filter hook forward priority filter; policy accept; counter packets 0 bytes 0 jump guest_cross counter packets 0 bytes 0 jump guest_input counter packets 0 bytes 0 jump guest_output } chain guest_output { } chain guest_input { } chain guest_cross { } chain guest_nat { type nat hook postrouting priority srcnat; policy accept; } } ``` Server: ``` # Generated by iptables-save v1.8.10 on Fri Nov 29 17:56:57 2024 *mangle :PREROUTING ACCEPT [2620:1719206] :INPUT ACCEPT [2269:1606018] :FORWARD ACCEPT [351:113188] :OUTPUT ACCEPT [2151:549022] :POSTROUTING ACCEPT [2537:669346] :NETBIRD-RT-PRE - [0:0] -A PREROUTING -i wt0 -m addrtype --dst-type LOCAL -j MARK --set-xmark 0x1bd01/0xffffffff -A PREROUTING -j NETBIRD-RT-PRE COMMIT # Completed on Fri Nov 29 17:56:57 2024 # Generated by iptables-save v1.8.10 on Fri Nov 29 17:56:57 2024 *nat :PREROUTING ACCEPT [43:6129] :INPUT ACCEPT [43:6129] :OUTPUT ACCEPT [170:16389] :POSTROUTING ACCEPT [200:18189] :DOCKER - [0:0] :NETBIRD-RT-NAT - [0:0] -A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER -A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER -A POSTROUTING -s 172.17.0.0/16 ! -o docker0 -j MASQUERADE -A POSTROUTING -j NETBIRD-RT-NAT -A POSTROUTING -s 172.17.0.2/32 -d 172.17.0.2/32 -p tcp -m tcp --dport 80 -j MASQUERADE -A DOCKER -i docker0 -j RETURN -A DOCKER ! -i docker0 -p tcp -m tcp --dport 8080 -j DNAT --to-destination 172.17.0.2:80 -A NETBIRD-RT-NAT ! -o lo -m mark --mark 0x1bd11 -j MASQUERADE -A NETBIRD-RT-NAT -o wt0 -m mark --mark 0x1bd12 -j MASQUERADE COMMIT # Completed on Fri Nov 29 17:56:57 2024 # Generated by iptables-save v1.8.10 on Fri Nov 29 17:56:57 2024 *filter :INPUT ACCEPT [2094:1577487] :FORWARD DROP [0:0] :OUTPUT ACCEPT [2048:420229] :DOCKER - [0:0] :DOCKER-ISOLATION-STAGE-1 - [0:0] :DOCKER-ISOLATION-STAGE-2 - [0:0] :DOCKER-USER - [0:0] :NETBIRD-ACL-INPUT - [0:0] :NETBIRD-ACL-OUTPUT - [0:0] :NETBIRD-RT-FWD - [0:0] -A INPUT -i wt0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT -A INPUT -i wt0 -j NETBIRD-ACL-INPUT -A INPUT -i wt0 -j DROP -A FORWARD -j DOCKER-USER -A FORWARD -j DOCKER-ISOLATION-STAGE-1 -A FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT -A FORWARD -o docker0 -j DOCKER -A FORWARD -i docker0 ! -o docker0 -j ACCEPT -A FORWARD -i docker0 -o docker0 -j ACCEPT -A FORWARD -o wt0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT -A FORWARD -m mark --mark 0x1bd01 -j NETBIRD-ACL-INPUT -A FORWARD -i wt0 -j NETBIRD-RT-FWD -A FORWARD -i wt0 -j DROP -A OUTPUT -o wt0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT -A OUTPUT ! -d 100.78.0.0/16 -o wt0 -j ACCEPT -A OUTPUT -o wt0 -j NETBIRD-ACL-OUTPUT -A OUTPUT -o wt0 -j DROP -A DOCKER -d 172.17.0.2/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 80 -j ACCEPT -A DOCKER-ISOLATION-STAGE-1 -i docker0 ! -o docker0 -j DOCKER-ISOLATION-STAGE-2 -A DOCKER-ISOLATION-STAGE-1 -j RETURN -A DOCKER-ISOLATION-STAGE-2 -o docker0 -j DROP -A DOCKER-ISOLATION-STAGE-2 -j RETURN -A DOCKER-USER -j RETURN -A NETBIRD-ACL-INPUT -j ACCEPT -A NETBIRD-ACL-OUTPUT -j ACCEPT -A NETBIRD-RT-FWD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT COMMIT # Completed on Fri Nov 29 17:56:57 2024 ``` On the server `nft list ruleset` returns nothing (it was ran with sudo there too)
saavagebueno commented 2025-11-20 05:30:48 -05:00
Author
Owner
Copy Link

@nazarewk commented on GitHub (Apr 28, 2025):

Hello @MorsMortium,

We're currently reviewing our open issues and would like to verify if this problem still exists in the latest NetBird version.

Could you please confirm if the issue is still there?

We may close this issue temporarily if we don't hear back from you within 2 weeks, but feel free to reopen it with updated information.

Thanks for your contribution to improving the project!

@nazarewk commented on GitHub (Apr 28, 2025): Hello @MorsMortium, We're currently reviewing our open issues and would like to verify if this problem still exists in the [latest NetBird version](https://github.com/netbirdio/netbird/releases). Could you please confirm if the issue is still there? We may close this issue temporarily if we don't hear back from you within **2 weeks**, but feel free to reopen it with updated information. Thanks for your contribution to improving the project!
saavagebueno commented 2025-11-20 05:30:48 -05:00
Author
Owner
Copy Link

@MorsMortium commented on GitHub (Apr 28, 2025):

Hi!
Yes, I just update the server to netbird 0.43.0 too, restarted it, the desktop was already that version and tried to set up searxng docker according to the same docs. The version of both docker and the searxng image also increased since, but the issue remains the same

@MorsMortium commented on GitHub (Apr 28, 2025): Hi! Yes, I just update the server to netbird 0.43.0 too, restarted it, the desktop was already that version and tried to set up searxng docker according to the same docs. The version of both docker and the searxng image also increased since, but the issue remains the same
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
2021 Q4
2022 Q1
2022 Q1
accessibility
acl
agent
agent
Android
Android
api
authentik
automation
azure
battery-usage
bug
cache
client
client-ui
cloud
cloud-only
cloudflare
community
compatibility
config-idp
config-issue
connection
contribution
coturn
cross-vpn
dashboard
data-usage
distribution
dns
docker
documentation
duplicate
enhancement
enhancement
event-stream
feature-request
freebsd
getting-started
go
good first issue
gui
help wanted
home-assistant
idp
inconsistency
integration
integrations
ios
ipv6
jwt
k8s
keycloak
linux
login
macos
management-service
missing-docs
mobile
moved-internal
needs-review
netbird-ui
networking
new-platform
nginx
notification
okta
openwrt
packaging
peer-management
peer-management
peer-management
performance
postgres
posture-checks
psk
pull-request
Mirrored from GitHub Pull Request
 question
refactor
relay
release
rfc
routes
security
security-related
self-hosting
server
signal
sleep-issue
ssh
ssl
status
store
synology
system-compatibility-issue
test-suite
third-party-integration
triage
triage-needed
troubleshooting
UX
waiting-feedback
windows
wontfix
zitadel
No Label docker linux waiting-feedback
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
saavagebueno
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: SVI/netbird#1452
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?