SVI/netbird
1
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-06-10 17:31:53 -04:00
Code Issues 3.0k Packages Projects Releases 10 Wiki Activity

[SOLVED] DNS resolver timeout #1534

New Issue
Closed
opened 2025-11-20 05:32:22 -05:00 by saavagebueno · 1 comment
saavagebueno commented 2025-11-20 05:32:22 -05:00
Owner
Copy Link

Originally created by @boardlord1 on GitHub (Dec 30, 2024).

Describe the problem

I've set up my self hosted Netbird instance, which is behind nginx. There is also another container running which is a peering route into my LAN, and an exit node. A nameserver with Adguard Home's IP (192.168.7.1) is set up as well, distributed to all peers. My Adguard server works perfectly for LAN clients and when I'm connected through vanilla wireguard to my router.

After logging in with my phone, browsing my LAN works and browsing the web seemingly works as well - I'm seeing my home IP while my phone is connected to 4G. This shouldn't be the case imho - if I connect with vanilla wireguard to my router, OR my Headscale network, during the same check only the resolvers set up in Adguard come up (cloudflare and quad9).

However, I've noticed that my DNS resolvers that are set up with Adguard Home running on my router, are not coming up most of the time when checking for DNS leaks with browserleaks.com - only the nameservers of my mobile providers show up. The logs of the container client
show:


2024-12-30T21:56:20Z WARN [error: read udp 192.168.7.102:56413->192.168.7.1:53: i/o timeout, upstream: 192.168.7.1:53] client/internal/dns/upstream.go:116: got an error while connecting to upstream

2024-12-30T21:56:20Z ERRO client/internal/dns/upstream.go:149: all queries to the upstream nameservers failed with timeout

My resolve.conf in the container:

# Generated by NetBird
# If needed you can restore the original file by copying back /etc/resolv.conf.original.netbird

options timeout:4 attempts:1
search netbird.selfhosted
nameserver 100.126.25.81
nameserver 192.168.7.1

To Reproduce

Steps to reproduce the behavior:

  1. Go to '...'
  2. Click on '....'
  3. Scroll down to '....'
  4. See error

Expected behavior

Have the client communicate with my chosen nameserver without timeout and only the set up resolvers should show up in a leak test - and not the mobile provider's ones.

Are you using NetBird Cloud?

Self-hosted

NetBird version

0.35.1

NetBird status -dA output:

Cannot get that inside the container

Originally created by @boardlord1 on GitHub (Dec 30, 2024). **Describe the problem** I've set up my self hosted Netbird instance, which is behind nginx. There is also another container running which is a peering route into my LAN, and an exit node. A nameserver with Adguard Home's IP (192.168.7.1) is set up as well, distributed to all peers. My Adguard server works perfectly for LAN clients and when I'm connected through vanilla wireguard to my router. After logging in with my phone, browsing my LAN works and browsing the web seemingly works as well - I'm seeing my home IP while my phone is connected to 4G. This shouldn't be the case imho - if I connect with vanilla wireguard to my router, OR my Headscale network, during the same check only the resolvers set up in Adguard come up (cloudflare and quad9). However, I've noticed that my DNS resolvers that are set up with Adguard Home running on my router, are not coming up most of the time when checking for DNS leaks with browserleaks.com - only the nameservers of my mobile providers show up. The logs of the container client show: ``` 2024-12-30T21:56:20Z WARN [error: read udp 192.168.7.102:56413->192.168.7.1:53: i/o timeout, upstream: 192.168.7.1:53] client/internal/dns/upstream.go:116: got an error while connecting to upstream 2024-12-30T21:56:20Z ERRO client/internal/dns/upstream.go:149: all queries to the upstream nameservers failed with timeout ``` My resolve.conf in the container: ``` # Generated by NetBird # If needed you can restore the original file by copying back /etc/resolv.conf.original.netbird options timeout:4 attempts:1 search netbird.selfhosted nameserver 100.126.25.81 nameserver 192.168.7.1 ``` **To Reproduce** Steps to reproduce the behavior: 1. Go to '...' 2. Click on '....' 3. Scroll down to '....' 4. See error **Expected behavior** Have the client communicate with my chosen nameserver without timeout and only the set up resolvers should show up in a leak test - and not the mobile provider's ones. **Are you using NetBird Cloud?** Self-hosted **NetBird version** 0.35.1 **NetBird status -dA output:** Cannot get that inside the container
saavagebueno added the triage-needed label 2025-11-20 05:32:22 -05:00
saavagebueno commented 2025-11-20 05:32:23 -05:00
Author
Owner
Copy Link

@boardlord1 commented on GitHub (Jan 3, 2025):

Found out the problem… After days of trial and error, and finally after using Wireshark to look at the traffic between the Netbird client and Adguard Home I stumbled upon the solution!

I had in the DNS settings in Adguard Home this: [//]192.168.7.1:54
This pointed back to dnsmasq used for internal name resolution, and what it does is this, based on the Adguard docs:

An empty domain specification, // has the special meaning of “unqualified names only”, i.e. names without any dots in them, like myhost or router. Those will only be used for resolving requests for unqualified domain names, but not their subdomains.

Once I commented out this line, and only left in [/local/]192.168.7.1:54 and [/lan/]192.168.7.1:54, the Netbird client started to work with my Adguard Home resolver :)

@boardlord1 commented on GitHub (Jan 3, 2025): Found out the problem… After days of trial and error, and finally after using Wireshark to look at the traffic between the Netbird client and Adguard Home I stumbled upon the solution! I had in the DNS settings in Adguard Home this: [//]192.168.7.1:54 This pointed back to dnsmasq used for internal name resolution, and what it does is this, based on the Adguard docs: `An empty domain specification, // has the special meaning of “unqualified names only”, i.e. names without any dots in them, like myhost or router. Those will only be used for resolving requests for unqualified domain names, but not their subdomains.` Once I commented out this line, and only left in [/local/]192.168.7.1:54 and [/lan/]192.168.7.1:54, the Netbird client started to work with my Adguard Home resolver :)
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
2021 Q4
2022 Q1
2022 Q1
accessibility
acl
agent
agent
Android
Android
api
authentik
automation
azure
battery-usage
bug
cache
client
client-ui
cloud
cloud-only
cloudflare
community
compatibility
config-idp
config-issue
connection
contribution
coturn
cross-vpn
dashboard
data-usage
distribution
dns
docker
documentation
duplicate
enhancement
enhancement
event-stream
feature-request
freebsd
getting-started
go
good first issue
gui
help wanted
home-assistant
idp
inconsistency
integration
integrations
ios
ipv6
jwt
k8s
keycloak
linux
login
macos
management-service
missing-docs
mobile
moved-internal
needs-review
netbird-ui
networking
new-platform
nginx
notification
okta
openwrt
packaging
peer-management
peer-management
peer-management
performance
postgres
posture-checks
psk
pull-request
Mirrored from GitHub Pull Request
 question
refactor
relay
release
rfc
routes
security
security-related
self-hosting
server
signal
sleep-issue
ssh
ssl
status
store
synology
system-compatibility-issue
test-suite
third-party-integration
triage
triage-needed
troubleshooting
UX
waiting-feedback
windows
wontfix
zitadel
No Label triage-needed
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
saavagebueno
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: SVI/netbird#1534
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?