SVI/netbird
1
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-06-01 04:52:53 -04:00
Code Issues 3.0k Packages Projects Releases 10 Wiki Activity

NetBird cannot add (connect) any peer #1586

New Issue
Open
opened 2025-11-20 05:33:20 -05:00 by saavagebueno · 0 comments
saavagebueno commented 2025-11-20 05:33:20 -05:00
Owner
Copy Link

Originally created by @CodeShellDev on GitHub (Jan 31, 2025).

Describe the problem

I cannot add any new peer (with and without setup-key)

To Reproduce

Steps to reproduce the behavior:

  1. Go create a new setup-key
  2. Open terminal on Linux (Mint) and paste : "netbird up --management-url https://vpn.mydomain.com --setup-key YOUR_KEY"
  3. See error
  4. In the logs see error

Expected behavior

NetBird should successfully add a new peer

Are you using NetBird Cloud?

No, I am selfhosting NetBird with traefik and authentik

NetBird version

latest as of creating this issue

NetBird status -dA output:

Previously:

Management: Connected to vpn.mydomain.com
Signal: Disconnected
...

After Account deletion (and recreation):

Daemon status: NeedsLogin
 
Run UP command to log in with SSO (interactive login):
 
 netbird up 
 
If you are running a self-hosted version and no SSO provider has been configured in your Management Server,
you can use a setup-key:
 
 netbird up --management-url <YOUR_MANAGEMENT_URL> --setup-key <YOUR_SETUP_KEY>
 
More info: https://docs.netbird.io/how-to/register-machines-using-setup-keys

Do you face any (non-mobile) client issues?

Now:

Error: login failed: rpc error: code = InvalidArgument desc = invalid setup-key or no sso information provided, err: invalid UUID length: 31

Previously it would just never show anything no "Connected" or "Disconnected" and no error.

Screenshots

Image

Additional context

I have a OPNsense firewall inbetween my raspberry pi 5
(inside of wich is a LXC Container with (Traefik & Authentik &) Netbird in Docker
and My Linux (Mint) vm is on another proxmox host.

docker-compose.yaml:

---
services:
  dashboard:
    image: netbirdio/dashboard:latest
    container_name: netbird-dashboard
    restart: unless-stopped
    environment:
      # Endpoints
      - NETBIRD_MGMT_API_ENDPOINT=https://vpn.mydomain.com:443
      - NETBIRD_MGMT_GRPC_API_ENDPOINT=https://vpn.mydomain.com:443
      # OIDC
      - AUTH_AUDIENCE=AUTHENTIK_PROVIDER_ID
      - AUTH_CLIENT_ID=AUTHENTIK_PROVIDER_ID
      - AUTH_CLIENT_SECRET=
      - AUTH_AUTHORITY=https://authentication.mydomain.com/application/o/netbird/
      - USE_AUTH0=false
      - AUTH_SUPPORTED_SCOPES=openid profile email offline_access api
      - AUTH_REDIRECT_URI=
      - AUTH_SILENT_REDIRECT_URI=
      - NETBIRD_TOKEN_SOURCE=accessToken
      # SSL
      - NGINX_SSL_PORT=443
      # Letsencrypt
      - LETSENCRYPT_DOMAIN=
      - LETSENCRYPT_EMAIL=
    volumes:
      - netbird-letsencrypt:/etc/letsencrypt/
    networks:
      - frontend
    labels:
    - traefik.enable=true
    - traefik.http.routers.netbird-dashboard.entrypoints=web, websecure
    - traefik.http.routers.netbird-dashboard.rule=Host(`vpn.mydomain.com`)
    - traefik.http.routers.netbird-dashboard.tls=true
    - traefik.http.routers.netbird-dashboard.tls.certresolver=cloudflare
    - traefik.http.routers.netbird-dashboard.service=netbird-dashboard-svc

    - traefik.http.services.netbird-dashboard-svc.loadbalancer.server.port=80
    - traefik.docker.network=frontend

  signal:
    image: netbirdio/signal:latest
    container_name: netbird-signal
    restart: unless-stopped
    volumes:
      - netbird-signal:/var/lib/netbird
    networks:
      - frontend
    labels:
    - traefik.enable=true
    - traefik.http.routers.netbird-signal.entrypoints=web, websecure
    - traefik.http.routers.netbird-signal.rule=Host(`vpn.mydomain.com`) && PathPrefix(`/signalexchange.SignalExchange/`)
    - traefik.http.routers.netbird-signal.tls=true
    - traefik.http.routers.netbird-signal.tls.certresolver=cloudflare
    - traefik.http.routers.netbird-signal.service=netbird-signal-svc

    - traefik.http.services.netbird-signal-svc.loadbalancer.server.port=80
    - traefik.http.services.netbird-signal-svc.loadbalancer.server.scheme=h2c
    - traefik.docker.network=frontend

  management:
    image: netbirdio/management:latest
    container_name: netbird-management
    restart: unless-stopped
    depends_on:
      - dashboard
    volumes:
      - netbird-mgmt:/var/lib/netbird
      - netbird-letsencrypt:/etc/letsencrypt:ro
      - ./management.json:/etc/netbird/management.json
    command: [
      "--port", "443",
      "--log-file", "console",
      "--disable-anonymous-metrics=false",
      "--single-account-mode-domain=vpn.mydomain.com",
      "--dns-domain=mydomain.com"
    ]
    networks:
      - frontend
    labels:
    - traefik.enable=true
    - traefik.http.routers.netbird-api.entrypoints=web, websecure
    - traefik.http.routers.netbird-api.rule=Host(`vpn.mydomain.com`) && PathPrefix(`/api`)
    - traefik.http.routers.netbird-api.tls=true
    - traefik.http.routers.netbird-api.tls.certresolver=cloudflare
    - traefik.http.routers.netbird-api.service=netbird-api-svc

    - traefik.http.services.netbird-api-svc.loadbalancer.server.port=443

    - traefik.http.routers.netbird-management.entrypoints=web, websecure
    - traefik.http.routers.netbird-management.rule=Host(`vpn.mydomain.com`) && PathPrefix(`/management.ManagementService/`)
    - traefik.http.routers.netbird-management.tls=true
    - traefik.http.routers.netbird-management.tls.certresolver=cloudflare
    - traefik.http.routers.netbird-management.service=netbird-management-svc

    - traefik.http.services.netbird-management-svc.loadbalancer.server.port=443
    - traefik.http.services.netbird-management-svc.loadbalancer.server.scheme=h2c

    - traefik.docker.network=frontend

  relay:
    image: netbirdio/relay:latest
    container_name: netbird-relay
    restart: unless-stopped
    environment:
    - NB_LOG_LEVEL=info
    - NB_LISTEN_ADDRESS=:33080
    - NB_EXPOSED_ADDRESS=vpn.mydomain.com:33080
    # todo: change to a secure secret
    - NB_AUTH_SECRET=KEY_FROM_MANAGEMENTJSON
    ports:
      - "33080:33080"

  coturn:
    image: coturn/coturn:latest
    container_name: netbird-coturn
    restart: unless-stopped
    hostname: vpn.mydomain.com 
    # domainname doesnt work for me failed to create shim task: OCI runtime create failed: runc create failed: unable 
    # to start container process: error during container init: open /proc/sys/kernel/domainname: permission denied: unknown
    volumes:
      - ./turnserver.conf:/etc/turnserver.conf:ro
    network_mode: host
    command:
      - -c /etc/turnserver.conf

volumes:
  netbird-mgmt:
  netbird-signal:
  netbird-letsencrypt:

networks:
  frontend:
    external: true

management.json:

{
    "Stuns": [
        {
            "Proto": "udp",
            "URI": "stun:vpn.mydomain.com:3478",
            "Username": "",
            "Password": ""
        }
    ],
    "TURNConfig": {
        "TimeBasedCredentials": false,
        "CredentialsTTL": "12h0m0s",
        "Secret": "secret",
        "Turns": [
            {
                "Proto": "udp",
                "URI": "turn:vpn.mydomain.com:3478",
                "Username": "self",
                "Password": "SOME_TURN_KEY"
            }
        ]
    },
    "Relay": {
        "Addresses": [
            "rel://vpn.mydomain.com:33080"
        ],
        "CredentialsTTL": "24h0m0s",
        "Secret": "SOME_RELAY_KEY"
    },
    "Signal": {
        "Proto": "https",
        "URI": "vpn.mydomain.com:80",
        "Username": "",
        "Password": ""
    },
    "Datadir": "/var/lib/netbird/",
    "DataStoreEncryptionKey": "SOME_ENCRYPT_KEY",
    "HttpConfig": {
        "LetsEncryptDomain": "",
        "CertFile": "",
        "CertKey": "",
        "AuthAudience": "AUTHENTIK_PROVIDER_ID",
        "AuthIssuer": "https://authentication.mydomain.com/application/o/netbird/",
        "AuthUserIDClaim": "",
        "AuthKeysLocation": "https://authentication.mydomain.com/application/o/netbird/jwks/",
        "OIDCConfigEndpoint": "https://authentication.mydomain.com/application/o/netbird/.well-known/openid-configuration",
        "IdpSignKeyRefreshEnabled": false,
        "ExtraAuthAudience": ""
    },
    "IdpManagerConfig": {
        "ManagerType": "authentik",
        "ClientConfig": {
            "Issuer": "https://authentication.mydomain.com/application/o/netbird",
            "TokenEndpoint": "https://authentication.mydomain.com/application/o/token/",
            "ClientID": "AUTHENTIK_PROVIDER_ID",
            "ClientSecret": "",
            "GrantType": "client_credentials"
        },
        "ExtraConfig": {
            "Password": "AUTHENTIK_NETBIRD_APP_PASSWORD",
            "Username": "netbird"
        },
        "Auth0ClientCredentials": null,
        "AzureClientCredentials": null,
        "KeycloakClientCredentials": null,
        "ZitadelClientCredentials": null
    },
    "DeviceAuthorizationFlow": {
        "Provider": "hosted",
        "ProviderConfig": {
            "ClientID": "AUTHENTIK_PROVIDER_ID"
            "ClientSecret": "",
            "Domain": "authentication.mydomain.com",
            "Audience": "AUTHENTIK_PROVIDER_ID",
            "TokenEndpoint": "https://authentication.mydomain.com/application/o/token/",
            "DeviceAuthEndpoint": "https://authentication.mydomain.com/application/o/device/",
            "AuthorizationEndpoint": "",
            "Scope": "openid",
            "UseIDToken": false,
            "RedirectURLs": null
        }
    },
    "PKCEAuthorizationFlow": {
        "ProviderConfig": {
            "ClientID": "AUTHENTIK_PROVIDER_ID",
            "ClientSecret": "",
            "Domain": "",
            "Audience": "AUTHENTIK_PROVIDER_ID",
            "TokenEndpoint": "https://authentication.mydomain.com/application/o/token/",
            "DeviceAuthEndpoint": "",
            "AuthorizationEndpoint": "https://authentication.mydomain.com/application/o/authorize/",
            "Scope": "openid profile email offline_access api",
            "UseIDToken": false,
            "RedirectURLs": [
                "http://localhost:53000"
            ]
        }
    },
    "StoreConfig": {
        "Engine": "sqlite"
    },
    "ReverseProxy": {
        "TrustedHTTPProxies": [],
        "TrustedHTTPProxiesCount": 0,
        "TrustedPeers": [
            "0.0.0.0/0"
        ]
    }
}
Originally created by @CodeShellDev on GitHub (Jan 31, 2025). **Describe the problem** I cannot add any new peer (with and without setup-key) **To Reproduce** Steps to reproduce the behavior: 1. Go create a new setup-key 2. Open terminal on Linux (Mint) and paste : "netbird up --management-url https://vpn.mydomain.com --setup-key YOUR_KEY" 3. See error 4. In the logs see error **Expected behavior** NetBird should successfully add a new peer **Are you using NetBird Cloud?** No, I am selfhosting NetBird with traefik and authentik **NetBird version** `latest` as of creating this issue **NetBird status -dA output:** Previously: ``` Management: Connected to vpn.mydomain.com Signal: Disconnected ... ``` After Account deletion (and recreation): ``` Daemon status: NeedsLogin Run UP command to log in with SSO (interactive login): netbird up If you are running a self-hosted version and no SSO provider has been configured in your Management Server, you can use a setup-key: netbird up --management-url <YOUR_MANAGEMENT_URL> --setup-key <YOUR_SETUP_KEY> More info: https://docs.netbird.io/how-to/register-machines-using-setup-keys ``` **Do you face any (non-mobile) client issues?** Now: ``` Error: login failed: rpc error: code = InvalidArgument desc = invalid setup-key or no sso information provided, err: invalid UUID length: 31 ``` Previously it would just never show anything no "Connected" or "Disconnected" and no error. **Screenshots** ![Image](https://github.com/user-attachments/assets/815e600d-7895-4e66-8ecc-6408e67f1341) **Additional context** I have a OPNsense firewall inbetween my raspberry pi 5 (inside of wich is a LXC Container with (Traefik & Authentik &) Netbird in Docker and My Linux (Mint) vm is on another proxmox host. `docker-compose.yaml`: ```yaml --- services: dashboard: image: netbirdio/dashboard:latest container_name: netbird-dashboard restart: unless-stopped environment: # Endpoints - NETBIRD_MGMT_API_ENDPOINT=https://vpn.mydomain.com:443 - NETBIRD_MGMT_GRPC_API_ENDPOINT=https://vpn.mydomain.com:443 # OIDC - AUTH_AUDIENCE=AUTHENTIK_PROVIDER_ID - AUTH_CLIENT_ID=AUTHENTIK_PROVIDER_ID - AUTH_CLIENT_SECRET= - AUTH_AUTHORITY=https://authentication.mydomain.com/application/o/netbird/ - USE_AUTH0=false - AUTH_SUPPORTED_SCOPES=openid profile email offline_access api - AUTH_REDIRECT_URI= - AUTH_SILENT_REDIRECT_URI= - NETBIRD_TOKEN_SOURCE=accessToken # SSL - NGINX_SSL_PORT=443 # Letsencrypt - LETSENCRYPT_DOMAIN= - LETSENCRYPT_EMAIL= volumes: - netbird-letsencrypt:/etc/letsencrypt/ networks: - frontend labels: - traefik.enable=true - traefik.http.routers.netbird-dashboard.entrypoints=web, websecure - traefik.http.routers.netbird-dashboard.rule=Host(`vpn.mydomain.com`) - traefik.http.routers.netbird-dashboard.tls=true - traefik.http.routers.netbird-dashboard.tls.certresolver=cloudflare - traefik.http.routers.netbird-dashboard.service=netbird-dashboard-svc - traefik.http.services.netbird-dashboard-svc.loadbalancer.server.port=80 - traefik.docker.network=frontend signal: image: netbirdio/signal:latest container_name: netbird-signal restart: unless-stopped volumes: - netbird-signal:/var/lib/netbird networks: - frontend labels: - traefik.enable=true - traefik.http.routers.netbird-signal.entrypoints=web, websecure - traefik.http.routers.netbird-signal.rule=Host(`vpn.mydomain.com`) && PathPrefix(`/signalexchange.SignalExchange/`) - traefik.http.routers.netbird-signal.tls=true - traefik.http.routers.netbird-signal.tls.certresolver=cloudflare - traefik.http.routers.netbird-signal.service=netbird-signal-svc - traefik.http.services.netbird-signal-svc.loadbalancer.server.port=80 - traefik.http.services.netbird-signal-svc.loadbalancer.server.scheme=h2c - traefik.docker.network=frontend management: image: netbirdio/management:latest container_name: netbird-management restart: unless-stopped depends_on: - dashboard volumes: - netbird-mgmt:/var/lib/netbird - netbird-letsencrypt:/etc/letsencrypt:ro - ./management.json:/etc/netbird/management.json command: [ "--port", "443", "--log-file", "console", "--disable-anonymous-metrics=false", "--single-account-mode-domain=vpn.mydomain.com", "--dns-domain=mydomain.com" ] networks: - frontend labels: - traefik.enable=true - traefik.http.routers.netbird-api.entrypoints=web, websecure - traefik.http.routers.netbird-api.rule=Host(`vpn.mydomain.com`) && PathPrefix(`/api`) - traefik.http.routers.netbird-api.tls=true - traefik.http.routers.netbird-api.tls.certresolver=cloudflare - traefik.http.routers.netbird-api.service=netbird-api-svc - traefik.http.services.netbird-api-svc.loadbalancer.server.port=443 - traefik.http.routers.netbird-management.entrypoints=web, websecure - traefik.http.routers.netbird-management.rule=Host(`vpn.mydomain.com`) && PathPrefix(`/management.ManagementService/`) - traefik.http.routers.netbird-management.tls=true - traefik.http.routers.netbird-management.tls.certresolver=cloudflare - traefik.http.routers.netbird-management.service=netbird-management-svc - traefik.http.services.netbird-management-svc.loadbalancer.server.port=443 - traefik.http.services.netbird-management-svc.loadbalancer.server.scheme=h2c - traefik.docker.network=frontend relay: image: netbirdio/relay:latest container_name: netbird-relay restart: unless-stopped environment: - NB_LOG_LEVEL=info - NB_LISTEN_ADDRESS=:33080 - NB_EXPOSED_ADDRESS=vpn.mydomain.com:33080 # todo: change to a secure secret - NB_AUTH_SECRET=KEY_FROM_MANAGEMENTJSON ports: - "33080:33080" coturn: image: coturn/coturn:latest container_name: netbird-coturn restart: unless-stopped hostname: vpn.mydomain.com # domainname doesnt work for me failed to create shim task: OCI runtime create failed: runc create failed: unable # to start container process: error during container init: open /proc/sys/kernel/domainname: permission denied: unknown volumes: - ./turnserver.conf:/etc/turnserver.conf:ro network_mode: host command: - -c /etc/turnserver.conf volumes: netbird-mgmt: netbird-signal: netbird-letsencrypt: networks: frontend: external: true ``` `management.json`: ```json { "Stuns": [ { "Proto": "udp", "URI": "stun:vpn.mydomain.com:3478", "Username": "", "Password": "" } ], "TURNConfig": { "TimeBasedCredentials": false, "CredentialsTTL": "12h0m0s", "Secret": "secret", "Turns": [ { "Proto": "udp", "URI": "turn:vpn.mydomain.com:3478", "Username": "self", "Password": "SOME_TURN_KEY" } ] }, "Relay": { "Addresses": [ "rel://vpn.mydomain.com:33080" ], "CredentialsTTL": "24h0m0s", "Secret": "SOME_RELAY_KEY" }, "Signal": { "Proto": "https", "URI": "vpn.mydomain.com:80", "Username": "", "Password": "" }, "Datadir": "/var/lib/netbird/", "DataStoreEncryptionKey": "SOME_ENCRYPT_KEY", "HttpConfig": { "LetsEncryptDomain": "", "CertFile": "", "CertKey": "", "AuthAudience": "AUTHENTIK_PROVIDER_ID", "AuthIssuer": "https://authentication.mydomain.com/application/o/netbird/", "AuthUserIDClaim": "", "AuthKeysLocation": "https://authentication.mydomain.com/application/o/netbird/jwks/", "OIDCConfigEndpoint": "https://authentication.mydomain.com/application/o/netbird/.well-known/openid-configuration", "IdpSignKeyRefreshEnabled": false, "ExtraAuthAudience": "" }, "IdpManagerConfig": { "ManagerType": "authentik", "ClientConfig": { "Issuer": "https://authentication.mydomain.com/application/o/netbird", "TokenEndpoint": "https://authentication.mydomain.com/application/o/token/", "ClientID": "AUTHENTIK_PROVIDER_ID", "ClientSecret": "", "GrantType": "client_credentials" }, "ExtraConfig": { "Password": "AUTHENTIK_NETBIRD_APP_PASSWORD", "Username": "netbird" }, "Auth0ClientCredentials": null, "AzureClientCredentials": null, "KeycloakClientCredentials": null, "ZitadelClientCredentials": null }, "DeviceAuthorizationFlow": { "Provider": "hosted", "ProviderConfig": { "ClientID": "AUTHENTIK_PROVIDER_ID" "ClientSecret": "", "Domain": "authentication.mydomain.com", "Audience": "AUTHENTIK_PROVIDER_ID", "TokenEndpoint": "https://authentication.mydomain.com/application/o/token/", "DeviceAuthEndpoint": "https://authentication.mydomain.com/application/o/device/", "AuthorizationEndpoint": "", "Scope": "openid", "UseIDToken": false, "RedirectURLs": null } }, "PKCEAuthorizationFlow": { "ProviderConfig": { "ClientID": "AUTHENTIK_PROVIDER_ID", "ClientSecret": "", "Domain": "", "Audience": "AUTHENTIK_PROVIDER_ID", "TokenEndpoint": "https://authentication.mydomain.com/application/o/token/", "DeviceAuthEndpoint": "", "AuthorizationEndpoint": "https://authentication.mydomain.com/application/o/authorize/", "Scope": "openid profile email offline_access api", "UseIDToken": false, "RedirectURLs": [ "http://localhost:53000" ] } }, "StoreConfig": { "Engine": "sqlite" }, "ReverseProxy": { "TrustedHTTPProxies": [], "TrustedHTTPProxiesCount": 0, "TrustedPeers": [ "0.0.0.0/0" ] } } ```
saavagebueno added the triage-needed label 2025-11-20 05:33:20 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
2021 Q4
2022 Q1
2022 Q1
accessibility
acl
agent
agent
Android
Android
api
authentik
automation
azure
battery-usage
bug
cache
client
client-ui
cloud
cloud-only
cloudflare
community
compatibility
config-idp
config-issue
connection
contribution
coturn
cross-vpn
dashboard
data-usage
distribution
dns
docker
documentation
duplicate
enhancement
enhancement
event-stream
feature-request
freebsd
getting-started
go
good first issue
gui
help wanted
home-assistant
idp
inconsistency
integration
integrations
ios
ipv6
jwt
k8s
keycloak
linux
login
macos
management-service
missing-docs
mobile
moved-internal
needs-review
netbird-ui
networking
new-platform
nginx
notification
okta
openwrt
packaging
peer-management
peer-management
peer-management
performance
postgres
posture-checks
psk
pull-request
Mirrored from GitHub Pull Request
 question
refactor
relay
release
rfc
routes
security
security-related
self-hosting
server
signal
sleep-issue
ssh
ssl
status
store
synology
system-compatibility-issue
test-suite
third-party-integration
triage
triage-needed
troubleshooting
UX
waiting-feedback
windows
wontfix
zitadel
No Label triage-needed
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
saavagebueno
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: SVI/netbird#1586
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?