SVI/netbird
1
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-05-13 19:52:13 -04:00
Code Issues 3.0k Packages Projects Releases 10 Wiki Activity

DNS Queries Hijacked by Netbird Settings #1638

New Issue
Open
opened 2025-11-20 06:03:54 -05:00 by saavagebueno · 8 comments
saavagebueno commented 2025-11-20 06:03:54 -05:00
Owner
Copy Link

Originally created by @d-givens on GitHub (Feb 20, 2025).

Describe the problem
Trying to resolve active directory DNS names causes DNS Client to use Netbird DNS server instead of the configured DNS server. The setting persists even after uninstalling Netbird completely. Remnant left in HKLM\SYSTEM\ControlSet001\Services\DNScache\Parameters\DnsPolicyConfig that should likely be removed each time Netbird is disconnected, but either way, it should not override DNS settings. This is doubly-strange because we have Netbird set to push the AD DNS server as the higher priority anyway so there's really no case in which it should be using the Netbird DNS server.

Expected behavior
DNS lookups should always use the client's server first.

A clear and concise description of what you expected to happen.

NetBird version

0.35

I did not capture any of the other troubleshooting info, I simply blasted out that remnant regkey and disabled/enabled the adapter to get it to use the correct DNS server again.

Originally created by @d-givens on GitHub (Feb 20, 2025). **Describe the problem** Trying to resolve active directory DNS names causes DNS Client to use Netbird DNS server instead of the configured DNS server. The setting persists even after uninstalling Netbird completely. Remnant left in HKLM\SYSTEM\ControlSet001\Services\DNScache\Parameters\DnsPolicyConfig that should likely be removed each time Netbird is disconnected, but either way, it should not override DNS settings. This is doubly-strange because we have Netbird set to push the AD DNS server as the higher priority anyway so there's really no case in which it should be using the Netbird DNS server. **Expected behavior** DNS lookups should always use the client's server first. A clear and concise description of what you expected to happen. **NetBird version** 0.35 I did not capture any of the other troubleshooting info, I simply blasted out that remnant regkey and disabled/enabled the adapter to get it to use the correct DNS server again.
saavagebueno added the triage-needed label 2025-11-20 06:03:54 -05:00
saavagebueno commented 2025-11-20 06:03:56 -05:00
Author
Owner
Copy Link

@mlsmaycon commented on GitHub (Feb 21, 2025):

@d-givens can you please share the output from netbird debug for 1m -S?

@mlsmaycon commented on GitHub (Feb 21, 2025): @d-givens can you please share the output from `netbird debug for 1m -S`?
saavagebueno commented 2025-11-20 06:03:56 -05:00
Author
Owner
Copy Link

@d-givens commented on GitHub (Feb 24, 2025):

Sorry, I do not currently have access to the machine that had the issues. If/when I get another one (there's been four so far), I'll get that troubleshooting info for you.

Best Regards,

Don Givens

From: Maycon Santos @.>
Sent: Friday, February 21, 2025 4:22 AM
To: netbirdio/netbird @.>
Cc: Don Givens @.>; Mention @.>
Subject: Re: [netbirdio/netbird] DNS Queries Hijacked by Netbird Settings (Issue #3356)

@d-givenshttps://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_d-2Dgivens&d=DwMFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=Cg7ZbfqlCNZ5daQWHZ7AlOpOsUY-6fu2pBAZZQKg1Ks&m=ZoIZQuWSj_9rJTCzIPlUqOkHvScnRKyDP1Xa7o-9V36eBEIMn_sxNn0fN42yHlyS&s=QFwPk-6gw_ApMgpCnzhw3xLG2_jmmU_kyNGXycAOkW0&e= can you please share the output from netbird debug for 1m -S?

—
Reply to this email directly, view it on GitHubhttps://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_netbirdio_netbird_issues_3356-23issuecomment-2D2674153314&d=DwMFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=Cg7ZbfqlCNZ5daQWHZ7AlOpOsUY-6fu2pBAZZQKg1Ks&m=ZoIZQuWSj_9rJTCzIPlUqOkHvScnRKyDP1Xa7o-9V36eBEIMn_sxNn0fN42yHlyS&s=wLr5W0VroCdL-dSmbnshGz4mWfGKc4k0f_FObbOy8B0&e=, or unsubscribehttps://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_notifications_unsubscribe-2Dauth_BIVOUOS645C5QEZWX46XXFT2Q3453AVCNFSM6AAAAABXRIV75KVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDMNZUGE2TGMZRGQ&d=DwMFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=Cg7ZbfqlCNZ5daQWHZ7AlOpOsUY-6fu2pBAZZQKg1Ks&m=ZoIZQuWSj_9rJTCzIPlUqOkHvScnRKyDP1Xa7o-9V36eBEIMn_sxNn0fN42yHlyS&s=_RL4A4-ugGb3PSP3YK-zy2CeUmWaNoUiIuq7wjkpQKk&e=.
You are receiving this because you were mentioned.Message ID: @.***>

[mlsmaycon]mlsmaycon left a comment (netbirdio/netbird#3356)https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_netbirdio_netbird_issues_3356-23issuecomment-2D2674153314&d=DwMFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=Cg7ZbfqlCNZ5daQWHZ7AlOpOsUY-6fu2pBAZZQKg1Ks&m=ZoIZQuWSj_9rJTCzIPlUqOkHvScnRKyDP1Xa7o-9V36eBEIMn_sxNn0fN42yHlyS&s=wLr5W0VroCdL-dSmbnshGz4mWfGKc4k0f_FObbOy8B0&e=

@d-givenshttps://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_d-2Dgivens&d=DwMFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=Cg7ZbfqlCNZ5daQWHZ7AlOpOsUY-6fu2pBAZZQKg1Ks&m=ZoIZQuWSj_9rJTCzIPlUqOkHvScnRKyDP1Xa7o-9V36eBEIMn_sxNn0fN42yHlyS&s=QFwPk-6gw_ApMgpCnzhw3xLG2_jmmU_kyNGXycAOkW0&e= can you please share the output from netbird debug for 1m -S?

—
Reply to this email directly, view it on GitHubhttps://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_netbirdio_netbird_issues_3356-23issuecomment-2D2674153314&d=DwMFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=Cg7ZbfqlCNZ5daQWHZ7AlOpOsUY-6fu2pBAZZQKg1Ks&m=ZoIZQuWSj_9rJTCzIPlUqOkHvScnRKyDP1Xa7o-9V36eBEIMn_sxNn0fN42yHlyS&s=wLr5W0VroCdL-dSmbnshGz4mWfGKc4k0f_FObbOy8B0&e=, or unsubscribehttps://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_notifications_unsubscribe-2Dauth_BIVOUOS645C5QEZWX46XXFT2Q3453AVCNFSM6AAAAABXRIV75KVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDMNZUGE2TGMZRGQ&d=DwMFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=Cg7ZbfqlCNZ5daQWHZ7AlOpOsUY-6fu2pBAZZQKg1Ks&m=ZoIZQuWSj_9rJTCzIPlUqOkHvScnRKyDP1Xa7o-9V36eBEIMn_sxNn0fN42yHlyS&s=_RL4A4-ugGb3PSP3YK-zy2CeUmWaNoUiIuq7wjkpQKk&e=.
You are receiving this because you were mentioned.Message ID: @.***>

This email has been scanned for spam and viruses by Proofpoint Essentials. Click herehttps://us2.proofpointessentials.com/app/report_spam.php?mod_id=11&mod_option=logitem&report=1&type=easyspam&k=k1&payload=53616c7465645f5f1f90233a137ef368df097f977c16ce6fbc56786c7c5238b20be82230ebe8a661d131810581ba961cb50d7647d940e1c9b7c207dad4e8505908c721b30ccaadd485d488d1ecdb29701756e49615181e8cb726e00930141ec3854e2e5f2d5d9551f4c650782b57265fb6b64d8679dc9d970107411f1eb15cb48ced0c8931292f39d79826519bda3c4ce8383e0c427ccd01b65653c374ca83bd to report this email as spam.

@d-givens commented on GitHub (Feb 24, 2025): Sorry, I do not currently have access to the machine that had the issues. If/when I get another one (there's been four so far), I'll get that troubleshooting info for you. Best Regards, Don Givens ________________________________ From: Maycon Santos ***@***.***> Sent: Friday, February 21, 2025 4:22 AM To: netbirdio/netbird ***@***.***> Cc: Don Givens ***@***.***>; Mention ***@***.***> Subject: Re: [netbirdio/netbird] DNS Queries Hijacked by Netbird Settings (Issue #3356) @d-givens<https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_d-2Dgivens&d=DwMFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=Cg7ZbfqlCNZ5daQWHZ7AlOpOsUY-6fu2pBAZZQKg1Ks&m=ZoIZQuWSj_9rJTCzIPlUqOkHvScnRKyDP1Xa7o-9V36eBEIMn_sxNn0fN42yHlyS&s=QFwPk-6gw_ApMgpCnzhw3xLG2_jmmU_kyNGXycAOkW0&e=> can you please share the output from netbird debug for 1m -S? — Reply to this email directly, view it on GitHub<https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_netbirdio_netbird_issues_3356-23issuecomment-2D2674153314&d=DwMFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=Cg7ZbfqlCNZ5daQWHZ7AlOpOsUY-6fu2pBAZZQKg1Ks&m=ZoIZQuWSj_9rJTCzIPlUqOkHvScnRKyDP1Xa7o-9V36eBEIMn_sxNn0fN42yHlyS&s=wLr5W0VroCdL-dSmbnshGz4mWfGKc4k0f_FObbOy8B0&e=>, or unsubscribe<https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_notifications_unsubscribe-2Dauth_BIVOUOS645C5QEZWX46XXFT2Q3453AVCNFSM6AAAAABXRIV75KVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDMNZUGE2TGMZRGQ&d=DwMFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=Cg7ZbfqlCNZ5daQWHZ7AlOpOsUY-6fu2pBAZZQKg1Ks&m=ZoIZQuWSj_9rJTCzIPlUqOkHvScnRKyDP1Xa7o-9V36eBEIMn_sxNn0fN42yHlyS&s=_RL4A4-ugGb3PSP3YK-zy2CeUmWaNoUiIuq7wjkpQKk&e=>. You are receiving this because you were mentioned.Message ID: ***@***.***> [mlsmaycon]mlsmaycon left a comment (netbirdio/netbird#3356)<https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_netbirdio_netbird_issues_3356-23issuecomment-2D2674153314&d=DwMFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=Cg7ZbfqlCNZ5daQWHZ7AlOpOsUY-6fu2pBAZZQKg1Ks&m=ZoIZQuWSj_9rJTCzIPlUqOkHvScnRKyDP1Xa7o-9V36eBEIMn_sxNn0fN42yHlyS&s=wLr5W0VroCdL-dSmbnshGz4mWfGKc4k0f_FObbOy8B0&e=> @d-givens<https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_d-2Dgivens&d=DwMFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=Cg7ZbfqlCNZ5daQWHZ7AlOpOsUY-6fu2pBAZZQKg1Ks&m=ZoIZQuWSj_9rJTCzIPlUqOkHvScnRKyDP1Xa7o-9V36eBEIMn_sxNn0fN42yHlyS&s=QFwPk-6gw_ApMgpCnzhw3xLG2_jmmU_kyNGXycAOkW0&e=> can you please share the output from netbird debug for 1m -S? — Reply to this email directly, view it on GitHub<https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_netbirdio_netbird_issues_3356-23issuecomment-2D2674153314&d=DwMFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=Cg7ZbfqlCNZ5daQWHZ7AlOpOsUY-6fu2pBAZZQKg1Ks&m=ZoIZQuWSj_9rJTCzIPlUqOkHvScnRKyDP1Xa7o-9V36eBEIMn_sxNn0fN42yHlyS&s=wLr5W0VroCdL-dSmbnshGz4mWfGKc4k0f_FObbOy8B0&e=>, or unsubscribe<https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_notifications_unsubscribe-2Dauth_BIVOUOS645C5QEZWX46XXFT2Q3453AVCNFSM6AAAAABXRIV75KVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDMNZUGE2TGMZRGQ&d=DwMFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=Cg7ZbfqlCNZ5daQWHZ7AlOpOsUY-6fu2pBAZZQKg1Ks&m=ZoIZQuWSj_9rJTCzIPlUqOkHvScnRKyDP1Xa7o-9V36eBEIMn_sxNn0fN42yHlyS&s=_RL4A4-ugGb3PSP3YK-zy2CeUmWaNoUiIuq7wjkpQKk&e=>. You are receiving this because you were mentioned.Message ID: ***@***.***> ________________________________ This email has been scanned for spam and viruses by Proofpoint Essentials. Click here<https://us2.proofpointessentials.com/app/report_spam.php?mod_id=11&mod_option=logitem&report=1&type=easyspam&k=k1&payload=53616c7465645f5f1f90233a137ef368df097f977c16ce6fbc56786c7c5238b20be82230ebe8a661d131810581ba961cb50d7647d940e1c9b7c207dad4e8505908c721b30ccaadd485d488d1ecdb29701756e49615181e8cb726e00930141ec3854e2e5f2d5d9551f4c650782b57265fb6b64d8679dc9d970107411f1eb15cb48ced0c8931292f39d79826519bda3c4ce8383e0c427ccd01b65653c374ca83bd> to report this email as spam.
saavagebueno commented 2025-11-20 06:03:56 -05:00
Author
Owner
Copy Link

@d-givens commented on GitHub (Feb 26, 2025):

This thing is back. On a brand new computer. the debug says Netbird is down but it's still trying to use a Netbird DNS server (I don't want it to EVER use a Netbird DNS server). DNS Query sent to DNS Server 100.110.255.254 for name netbird.ourdomainnamehere.com and type 1, client PID 7600

@d-givens commented on GitHub (Feb 26, 2025): This thing is back. On a brand new computer. the debug says Netbird is down but it's still trying to use a Netbird DNS server (I don't want it to EVER use a Netbird DNS server). DNS Query sent to DNS Server 100.110.255.254 for name netbird.ourdomainnamehere.com and type 1, client PID 7600
saavagebueno commented 2025-11-20 06:03:56 -05:00
Author
Owner
Copy Link

@d-givens commented on GitHub (Feb 26, 2025):

It's breaking all domain connectivity to anything on ourdomainnamehere.com because Netbird is hijacking all the requests. I've uninstalled Netbird, I've purged the folder from %programdata% still the DNS queries to 100.110.255.254 persist. I've searched the registry for this value and can't find it. Right now, I freaking hate Netbird.

@d-givens commented on GitHub (Feb 26, 2025): It's breaking all domain connectivity to anything on ourdomainnamehere.com because Netbird is hijacking all the requests. I've uninstalled Netbird, I've purged the folder from %programdata% still the DNS queries to 100.110.255.254 persist. I've searched the registry for this value and can't find it. Right now, I freaking hate Netbird.
saavagebueno commented 2025-11-20 06:03:56 -05:00
Author
Owner
Copy Link

@d-givens commented on GitHub (Feb 27, 2025):

I was able to resolve this in this case by deleting the network adapter from Device manager then scanning for hardware changes so that the network adapter was found again. I did need to remove both the wired and wireless adapters to get this setting cleared.

@d-givens commented on GitHub (Feb 27, 2025): I was able to resolve this in this case by deleting the network adapter from Device manager then scanning for hardware changes so that the network adapter was found again. I did need to remove both the wired and wireless adapters to get this setting cleared.
saavagebueno commented 2025-11-20 06:03:56 -05:00
Author
Owner
Copy Link

@d-givens commented on GitHub (Mar 11, 2025):

This problem persists. I have another machine using netbird DNS instead of the configured DNS. Uninstalling Netbird leaves the DNS server intact. The registry key mentioned earlier did not exist in this system. Removing the network adapters, as my previous post did not resolve the problem. Resetting the network stack with netsh interface ip reset did not resolve the problem. Nothing resolved the problem; the Netbird DNS server was just intransigent and would not be removed. This is a significant problem and has left me no choice but to pull Netbird from this client altogether. I cannot have my VPN breaking DNS resolution.

@d-givens commented on GitHub (Mar 11, 2025): This problem persists. I have another machine using netbird DNS instead of the configured DNS. Uninstalling Netbird leaves the DNS server intact. The registry key mentioned earlier did not exist in this system. Removing the network adapters, as my previous post did not resolve the problem. Resetting the network stack with netsh interface ip reset did not resolve the problem. Nothing resolved the problem; the Netbird DNS server was just intransigent and would not be removed. This is a significant problem and has left me no choice but to pull Netbird from this client altogether. I cannot have my VPN breaking DNS resolution.
saavagebueno commented 2025-11-20 06:03:57 -05:00
Author
Owner
Copy Link

@jwoodard80 commented on GitHub (Oct 19, 2025):

I would like to confirm this. After struggling with Netbird for several days and much downtime, I finally deleted the client. However, specific domains still were not resolving. Finally had to resort to a wireshark trace to find out that the Netbird "100.94.254.254" is still being queried. It times out and the domain is not resolved.

This is on the latest 0.59.6 version and I have included screenshots of the regedit and information.

Please resolve this issue quickly as this is going to be a HUGE burden on us to purge from our users when the client is removed.

Image Image
@jwoodard80 commented on GitHub (Oct 19, 2025): I would like to confirm this. After struggling with Netbird for several days and much downtime, I finally deleted the client. However, specific domains still were not resolving. Finally had to resort to a wireshark trace to find out that the Netbird "100.94.254.254" is still being queried. It times out and the domain is not resolved. This is on the latest 0.59.6 version and I have included screenshots of the regedit and information. Please resolve this issue quickly as this is going to be a HUGE burden on us to purge from our users when the client is removed. <img width="833" height="465" alt="Image" src="https://github.com/user-attachments/assets/61123ada-578f-402c-8a18-5fb9f05edbe4" /> <img width="920" height="588" alt="Image" src="https://github.com/user-attachments/assets/a2a85da7-fb1c-4703-bdb0-f8e62295ab4c" />
saavagebueno commented 2025-11-20 06:03:57 -05:00
Author
Owner
Copy Link

@mlsmaycon commented on GitHub (Oct 21, 2025):

Can you guys try the latest release?

@mlsmaycon commented on GitHub (Oct 21, 2025): Can you guys try the latest release?
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
2021 Q4
2022 Q1
2022 Q1
accessibility
acl
agent
agent
Android
Android
api
authentik
automation
azure
battery-usage
bug
cache
client
client-ui
cloud
cloud-only
cloudflare
community
compatibility
config-idp
config-issue
connection
contribution
coturn
cross-vpn
dashboard
data-usage
distribution
dns
docker
documentation
duplicate
enhancement
enhancement
event-stream
feature-request
freebsd
getting-started
go
good first issue
gui
help wanted
home-assistant
idp
inconsistency
integration
integrations
ios
ipv6
jwt
k8s
keycloak
linux
login
macos
management-service
missing-docs
mobile
moved-internal
needs-review
netbird-ui
networking
new-platform
nginx
notification
okta
openwrt
packaging
peer-management
peer-management
peer-management
performance
postgres
posture-checks
psk
pull-request
Mirrored from GitHub Pull Request
 question
refactor
relay
release
rfc
routes
security
security-related
self-hosting
server
signal
sleep-issue
ssh
ssl
status
store
synology
system-compatibility-issue
test-suite
third-party-integration
triage
triage-needed
troubleshooting
UX
waiting-feedback
windows
wontfix
zitadel
No Label triage-needed
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
saavagebueno
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: SVI/netbird#1638
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?