SVI/netbird
1
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-08-04 19:55:09 -04:00
Code Issues 3.0k Packages Projects Releases 10 Wiki Activity

NetBird Relay Connection Fails with Nginx Proxy Manager and Cloudflare #1717

New Issue
Open
opened 2025-11-20 06:05:20 -05:00 by saavagebueno · 1 comment
saavagebueno commented 2025-11-20 06:05:20 -05:00
Owner
Copy Link

Originally created by @IannnnnW on GitHub (Mar 17, 2025).

Description
I'm experiencing issues with NetBird's relay connection when using Nginx Proxy Manager (NPM) behind Cloudflare. The relay client fails to connect via both QUIC and WebSocket protocols.

NPM Configuration
Here is my NPM configuration for the VPN:

location / {
    proxy_pass http://artifacts-dashboard-1:80;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
}

location /api {
    proxy_pass http://artifacts-management-1:443;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_ssl_verify off;
}

location /signalexchange.SignalExchange/ {
    grpc_pass grpc://artifacts-signal-1:10000;
    grpc_ssl_verify off;
    grpc_read_timeout 1d;
    grpc_send_timeout 1d;
    grpc_socket_keepalive on;
    grpc_set_header Host $host;
    grpc_set_header Content-Type "application/grpc";
    grpc_set_header X-Real-IP $remote_addr;
    grpc_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    grpc_set_header X-Forwarded-Proto $scheme;
}

location /management.ManagementService/ {
    grpc_pass grpc://artifacts-management-1:443;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    #proxy_ssl_verify off;
}

location /relay {
    proxy_pass http://artifacts-relay-1:33080;
    proxy_http_version 1.1;
    proxy_ssl_verify off;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header Host $http_host;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header X-Forwarded-For $remote_addr;
    proxy_set_header X-Forwarded-Host $http_host;
    proxy_cache_bypass $http_upgrade;
}

Client Log Errors
The client logs show the following errors:

Logs (client.log)

2025-03-17T21:32:37+01:00 INFO [relay: rels://vpn.domain.com:443] relay/client/client.go:164: create new relay connection: local peerID: O5NjF4Y8gbDtBqyxw5CQddzfcwtGh/SrPHfCqBkzJlU=, local peer hashedID: sha-wSDF2MzdHgbCtAlhvcsqQGCuHT7eESclscVPeMqxDUM=
2025-03-17T21:32:37+01:00 INFO [relay: rels://vpn.domain.com:443] relay/client/client.go:170: connecting to relay server
2025-03-17T21:32:37+01:00 INFO [relay: rels://vpn.domain.com:443] relay/client/dialer/race_dialer.go:64: dialing Relay server via quic
2025-03-17T21:32:37+01:00 INFO [relay: rels://vpn.domain.com:443] relay/client/dialer/race_dialer.go:64: dialing Relay server via WS
2025-03-17T21:32:37+01:00 ERRO relay/client/dialer/quic/quic.go:55: failed to dial to Relay server via QUIC 'vpn.domain.com:443': CRYPTO_ERROR 0x128 (remote): tls: handshake failure
2025-03-17T21:32:37+01:00 ERRO [relay: rels://vpn.domain.com:443] relay/client/dialer/race_dialer.go:77: failed to dial via quic: CRYPTO_ERROR 0x128 (remote): tls: handshake failure
2025-03-17T21:32:37+01:00 ERRO relay/client/dialer/ws/ws.go:50: failed to dial to Relay server 'wss://vpn.domain.com:443': failed to WebSocket dial: expected handshake response status code 101 but got 502
2025-03-17T21:32:37+01:00 ERRO [relay: rels://vpn.domain.com:443] relay/client/dialer/race_dialer.go:77: failed to dial via WS: failed to WebSocket dial: expected handshake response status code 101 but got 502
2025-03-17T21:32:37+01:00 ERRO relay/client/guard.go:58: failed to pick new Relay server: failed to connect to any relay server: all attempts failed

Environment
Nginx Proxy Manager Version: 2.12.3

NetBird Version: latest

Cloudflare Configuration: Using Cloudflare as DNS proxied. Allowed gRPC and websocket

TURN Server: Using Cloudflare's TURN server API instead of a self-hosted TURN server.

Steps to Reproduce
Configure NPM with the provided configuration.

Set up Cloudflare as a reverse proxy.

Attempt to connect to the relay server.

Expected Behavior
The relay connection should establish successfully via either QUIC or WebSocket protocols.

Actual Behavior
The relay connection fails with TLS handshake errors for QUIC and WebSocket handshake errors.

Originally created by @IannnnnW on GitHub (Mar 17, 2025). **Description** I'm experiencing issues with NetBird's relay connection when using Nginx Proxy Manager (NPM) behind Cloudflare. The relay client fails to connect via both QUIC and WebSocket protocols. **NPM Configuration** Here is my NPM configuration for the VPN: ``` location / { proxy_pass http://artifacts-dashboard-1:80; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; } location /api { proxy_pass http://artifacts-management-1:443; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; proxy_ssl_verify off; } location /signalexchange.SignalExchange/ { grpc_pass grpc://artifacts-signal-1:10000; grpc_ssl_verify off; grpc_read_timeout 1d; grpc_send_timeout 1d; grpc_socket_keepalive on; grpc_set_header Host $host; grpc_set_header Content-Type "application/grpc"; grpc_set_header X-Real-IP $remote_addr; grpc_set_header X-Forwarded-For $proxy_add_x_forwarded_for; grpc_set_header X-Forwarded-Proto $scheme; } location /management.ManagementService/ { grpc_pass grpc://artifacts-management-1:443; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; #proxy_ssl_verify off; } location /relay { proxy_pass http://artifacts-relay-1:33080; proxy_http_version 1.1; proxy_ssl_verify off; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $http_host; proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header X-Forwarded-For $remote_addr; proxy_set_header X-Forwarded-Host $http_host; proxy_cache_bypass $http_upgrade; } ``` **Client Log Errors** The client logs show the following errors: Logs (client.log) ``` 2025-03-17T21:32:37+01:00 INFO [relay: rels://vpn.domain.com:443] relay/client/client.go:164: create new relay connection: local peerID: O5NjF4Y8gbDtBqyxw5CQddzfcwtGh/SrPHfCqBkzJlU=, local peer hashedID: sha-wSDF2MzdHgbCtAlhvcsqQGCuHT7eESclscVPeMqxDUM= 2025-03-17T21:32:37+01:00 INFO [relay: rels://vpn.domain.com:443] relay/client/client.go:170: connecting to relay server 2025-03-17T21:32:37+01:00 INFO [relay: rels://vpn.domain.com:443] relay/client/dialer/race_dialer.go:64: dialing Relay server via quic 2025-03-17T21:32:37+01:00 INFO [relay: rels://vpn.domain.com:443] relay/client/dialer/race_dialer.go:64: dialing Relay server via WS 2025-03-17T21:32:37+01:00 ERRO relay/client/dialer/quic/quic.go:55: failed to dial to Relay server via QUIC 'vpn.domain.com:443': CRYPTO_ERROR 0x128 (remote): tls: handshake failure 2025-03-17T21:32:37+01:00 ERRO [relay: rels://vpn.domain.com:443] relay/client/dialer/race_dialer.go:77: failed to dial via quic: CRYPTO_ERROR 0x128 (remote): tls: handshake failure 2025-03-17T21:32:37+01:00 ERRO relay/client/dialer/ws/ws.go:50: failed to dial to Relay server 'wss://vpn.domain.com:443': failed to WebSocket dial: expected handshake response status code 101 but got 502 2025-03-17T21:32:37+01:00 ERRO [relay: rels://vpn.domain.com:443] relay/client/dialer/race_dialer.go:77: failed to dial via WS: failed to WebSocket dial: expected handshake response status code 101 but got 502 2025-03-17T21:32:37+01:00 ERRO relay/client/guard.go:58: failed to pick new Relay server: failed to connect to any relay server: all attempts failed ``` **Environment** Nginx Proxy Manager Version: 2.12.3 NetBird Version: latest Cloudflare Configuration: Using Cloudflare as DNS proxied. Allowed gRPC and websocket TURN Server: Using Cloudflare's TURN server API instead of a self-hosted TURN server. **Steps to Reproduce** Configure NPM with the provided configuration. Set up Cloudflare as a reverse proxy. Attempt to connect to the relay server. **Expected Behavior** The relay connection should establish successfully via either QUIC or WebSocket protocols. **Actual Behavior** The relay connection fails with TLS handshake errors for QUIC and WebSocket handshake errors.
saavagebueno added the triage-needed label 2025-11-20 06:05:20 -05:00
saavagebueno commented 2025-11-20 06:05:21 -05:00
Author
Owner
Copy Link

@1nerdyguy commented on GitHub (Mar 27, 2025):

My guess on this is...Nginx proxy manager is doing something it shouldnt.

I've had more trouble with that app than any other 'gui for reverse proxy' tools, once you go beyond the basics.

@1nerdyguy commented on GitHub (Mar 27, 2025): My guess on this is...Nginx proxy manager is doing something it shouldnt. I've had more trouble with that app than any other 'gui for reverse proxy' tools, once you go beyond the basics.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
2021 Q4
2022 Q1
2022 Q1
accessibility
acl
agent
agent
Android
Android
api
authentik
automation
azure
battery-usage
bug
cache
client
client-ui
cloud
cloud-only
cloudflare
community
compatibility
config-idp
config-issue
connection
contribution
coturn
cross-vpn
dashboard
data-usage
distribution
dns
docker
documentation
duplicate
enhancement
enhancement
event-stream
feature-request
freebsd
getting-started
go
good first issue
gui
help wanted
home-assistant
idp
inconsistency
integration
integrations
ios
ipv6
jwt
k8s
keycloak
linux
login
macos
management-service
missing-docs
mobile
moved-internal
needs-review
netbird-ui
networking
new-platform
nginx
notification
okta
openwrt
packaging
peer-management
peer-management
peer-management
performance
postgres
posture-checks
psk
pull-request
Mirrored from GitHub Pull Request
 question
refactor
relay
release
rfc
routes
security
security-related
self-hosting
server
signal
sleep-issue
ssh
ssl
status
store
synology
system-compatibility-issue
test-suite
third-party-integration
triage
triage-needed
troubleshooting
UX
waiting-feedback
windows
wontfix
zitadel
No Label triage-needed
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
saavagebueno
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: SVI/netbird#1717
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?