Feature: support connecting to multiple networks/management instances simultaneously #178

@mlsmaycon commented on GitHub (Sep 1, 2022):

Hi @bj0, currently, we don't offer straight support for multiple Wireguard connections as you would need to set the daemon listening address, a custom config path, and the new interface name needs to be updated in the configuration file.

Let me know if you need a guide for it to try this out.

we will evaluate the options to make this possible in an easier manner and perhaps work on it in the next few days.

@mlsmaycon commented on GitHub (Sep 1, 2022): Hi @bj0, currently, we don't offer straight support for multiple Wireguard connections as you would need to set the daemon listening address, a custom config path, and the new interface name needs to be updated in the configuration file. Let me know if you need a guide for it to try this out. we will evaluate the options to make this possible in an easier manner and perhaps work on it in the next few days.

saavagebueno commented

@bj0 commented on GitHub (Sep 1, 2022):

A guide would be cool, but I can figure out those options pretty easy. My main question is how would you "manage" or "auth" this second network? Would you need a second oauth account (im currently just using a google account)?

@bj0 commented on GitHub (Sep 1, 2022): A guide would be cool, but I can figure out those options pretty easy. My main question is how would you "manage" or "auth" this second network? Would you need a second oauth account (im currently just using a google account)?

saavagebueno commented

@mlsmaycon commented on GitHub (Sep 5, 2022):

Hello @bj0 with the release v0.9.0 you are able to run the following steps to achieve that. Below are the steps:

For a 2 connection example on a single Linux with SystemD, the steps are:

stop and uninstall the daemon

sudo netbird service stop
sudo netbird service uninstall

Assuming we have two accounts, ACCOUNT-A and ACCOUNT-B:

netbird login --config ./config-wt1.json --log-file console --setup-key ACCOUNT-A-AAA...
netbird login --config ./config-wt2.json --log-file console --setup-key ACCOUNT-B-BBB...

Now, we need to edit each configuration file and change the WgIface, WgPort and update the IFaceBlackList:

# FROM
    "WgIface": "wt0",
    "WgPort": 51820,
    "IFaceBlackList": [
        "wt0",
        ...
        
# TO 
# interface wt1:       
        "WgIface": "wt1",
        "WgPort": 50001,
    "IFaceBlackList": [
        "wt",
        ...
# interface wt2:       
        "WgIface": "wt2",
        "WgPort": 50002,
    "IFaceBlackList": [
        "wt",
        ...

move the files to the default config location /etc/netbird

sudo mv  ./config-wt1.json /etc/netbird/config-wt1.json
sudo mv  ./config-wt2.json /etc/netbird/config-wt2.json

install the wt1 service pointing to the config location:

sudo netbird service install --config /etc/netbird/config-wt1.json

let's edit the systemd file /etc/systemd/system/netbird.service and update the ExecStart and rename it

# FROM
ExecStart=/usr/bin/netbird "service" "run" "--config" "/etc/netbird/config-wt1.json" "--log-level" "info"

# TO
ExecStart=/usr/bin/netbird "service" "run" "--config" "/etc/netbird/config-wt1.json" "--log-level" "info" "--daemon-addr" "unix:///var/run/netbird-wt1.sock" "--log-file" "/var/log/netbird/client-wt1.log"

# rename
sudo mv /etc/systemd/system/netbird.service /etc/systemd/system/netbird-wt1.service

make a copy of the service file for the interface wt2, then update its ExecStart

sudo cp /etc/systemd/system/netbird-wt1.service /etc/systemd/system/netbird-wt2.service 

# FROM
ExecStart=/usr/bin/netbird "service" "run" "--config" "/etc/netbird/config-wt1.json" "--log-level" "info" "--daemon-addr" "unix:///var/run/netbird-wt1.sock" "--log-file" "/var/log/netbird/client-wt1.log"
# TO
ExecStart=/usr/bin/netbird "service" "run" "--config" "/etc/netbird/config-wt2.json" "--log-level" "info" "--daemon-addr" "unix:///var/run/netbird-wt2.sock" "--log-file" "/var/log/netbird/client-wt2.log"

reload systemd

sudo systemctl daemon-reload

start each interface service

sudo systemctl start netbird-wt1
sudo systemctl start netbird-wt2

Note

For direct connection to work, you will need peers to be running the latest version

@mlsmaycon commented on GitHub (Sep 5, 2022): Hello @bj0 with the release v0.9.0 you are able to run the following steps to achieve that. Below are the steps: For a 2 connection example on a single Linux with SystemD, the steps are: #### stop and uninstall the daemon ```shell sudo netbird service stop sudo netbird service uninstall ``` #### Create custom login files and login: Assuming we have two accounts, ACCOUNT-A and ACCOUNT-B: ```shell netbird login --config ./config-wt1.json --log-file console --setup-key ACCOUNT-A-AAA... netbird login --config ./config-wt2.json --log-file console --setup-key ACCOUNT-B-BBB... ``` #### Now, we need to edit each configuration file and change the WgIface, WgPort and update the IFaceBlackList: ```shell # FROM "WgIface": "wt0", "WgPort": 51820, "IFaceBlackList": [ "wt0", ... # TO # interface wt1: "WgIface": "wt1", "WgPort": 50001, "IFaceBlackList": [ "wt", ... # interface wt2: "WgIface": "wt2", "WgPort": 50002, "IFaceBlackList": [ "wt", ... ``` #### move the files to the default config location /etc/netbird ```shell sudo mv ./config-wt1.json /etc/netbird/config-wt1.json sudo mv ./config-wt2.json /etc/netbird/config-wt2.json ``` #### install the wt1 service pointing to the config location: ```shell sudo netbird service install --config /etc/netbird/config-wt1.json ``` #### let's edit the systemd file /etc/systemd/system/netbird.service and update the ExecStart and rename it ```shell # FROM ExecStart=/usr/bin/netbird "service" "run" "--config" "/etc/netbird/config-wt1.json" "--log-level" "info" # TO ExecStart=/usr/bin/netbird "service" "run" "--config" "/etc/netbird/config-wt1.json" "--log-level" "info" "--daemon-addr" "unix:///var/run/netbird-wt1.sock" "--log-file" "/var/log/netbird/client-wt1.log" # rename sudo mv /etc/systemd/system/netbird.service /etc/systemd/system/netbird-wt1.service ``` #### make a copy of the service file for the interface wt2, then update its ExecStart ```shell sudo cp /etc/systemd/system/netbird-wt1.service /etc/systemd/system/netbird-wt2.service # FROM ExecStart=/usr/bin/netbird "service" "run" "--config" "/etc/netbird/config-wt1.json" "--log-level" "info" "--daemon-addr" "unix:///var/run/netbird-wt1.sock" "--log-file" "/var/log/netbird/client-wt1.log" # TO ExecStart=/usr/bin/netbird "service" "run" "--config" "/etc/netbird/config-wt2.json" "--log-level" "info" "--daemon-addr" "unix:///var/run/netbird-wt2.sock" "--log-file" "/var/log/netbird/client-wt2.log" ``` #### reload systemd ```shell sudo systemctl daemon-reload ``` #### start each interface service ```shell sudo systemctl start netbird-wt1 sudo systemctl start netbird-wt2 ``` > **Note** For direct connection to work, you will need peers to be running the latest version

saavagebueno commented

@fti7 commented on GitHub (Sep 7, 2022):

@mlsmaycon thx for the Tutorial
Please consider to implement this kind of multi- tenancy/instances in all of your components natively.
This might work for an Advanced Linux User, but its difficult for e.g. Windows GUI Client User

There will be enough use-cases for this in the future (Both, Client and UI/Management Side)
and it might be easier to design/implement this directly in the beginning 😀

Thx!

@fti7 commented on GitHub (Sep 7, 2022): @mlsmaycon thx for the Tutorial Please consider to implement this kind of multi- tenancy/instances in all of your components natively. This might work for an Advanced Linux User, but its difficult for e.g. Windows GUI Client User There will be enough use-cases for this in the future (Both, Client and UI/Management Side) and it might be easier to design/implement this directly in the beginning 😀 Thx!

saavagebueno commented

@bj0 commented on GitHub (Sep 7, 2022):

Thanks @mlsmaycon ! That's super helpful, I'll give it a try when I get a second oidp/network going.

I was thinking about this while reading through the access control documentation. Another potential solution might be, instead of a separate network, a "shared" group where you could add peers from a different network (obviously on the same mediation server). That way you wouldn't need to run double everything, but it would rely on the mediation server much more.

@bj0 commented on GitHub (Sep 7, 2022): Thanks @mlsmaycon ! That's super helpful, I'll give it a try when I get a second oidp/network going. I was thinking about this while reading through the access control documentation. Another potential solution might be, instead of a separate network, a "shared" group where you could add peers from a different network (obviously on the same mediation server). That way you wouldn't need to run double everything, but it would rely on the mediation server much more.

saavagebueno commented

@mlsmaycon commented on GitHub (Sep 8, 2022):

@mlsmaycon thx for the Tutorial Please consider to implement this kind of multi- tenancy/instances in all of your components natively. This might work for an Advanced Linux User, but its difficult for e.g. Windows GUI Client User

There will be enough use-cases for this in the future (Both, Client and UI/Management Side) and it might be easier to design/implement this directly in the beginning 😀

Thx!

Thanks, @fti7 and @bj0 we are definitely thinking about improving that experience. We built the ground for it with smaller CGNAT and random networks.

Moving forward, maybe we can use a bit of input from you folks, how would you see a multi-tenancy setup? Would be more based on company/personal domain, accounts, or networks?

@mlsmaycon commented on GitHub (Sep 8, 2022): > @mlsmaycon thx for the Tutorial Please consider to implement this kind of multi- tenancy/instances in all of your components natively. This might work for an Advanced Linux User, but its difficult for e.g. Windows GUI Client User > > There will be enough use-cases for this in the future (Both, Client and UI/Management Side) and it might be easier to design/implement this directly in the beginning 😀 > > Thx! Thanks, @fti7 and @bj0 we are definitely thinking about improving that experience. We built the ground for it with smaller CGNAT and random networks. Moving forward, maybe we can use a bit of input from you folks, how would you see a multi-tenancy setup? Would be more based on company/personal domain, accounts, or networks?

saavagebueno commented

@fti7 commented on GitHub (Sep 8, 2022):

Sure, here is my POV:
Multi Tenancy for me means full Isolation.

The scenario what mostly like gonna happen is that in multiple Parties are using Netbird with either your shared Management Server or setting up an own one.
They are completely isolated and dont talk to each other. The only thing, what you already mentioned is the Collision of the CGNAT Subnet.
But i guess that shouldnt be an big issue if they are getting smaller and the reserved Subnet per "Management Server Tenant" gets randomized.
If this still happens, it should be possible to change this reserved Subnet as an Admin on one of the Servers

Scenario 1

Im a Freelancer and use Netbird for my private Network using app.netbird.io and working for 2 Companies which each have their own selfhosted Management Server.

In this Scenario only the Clients need some Modifications.
How it should look like (Example Windows GUI Client):

The Clients have a list where i can add/remove multiple "Profiles"
A Profile is basically some Config which i get from an Admin via a QR Code/File/Copy&Paste and contains

Tenant ID (I would use some UUID; Can help for further Scenarios where you uniquely need to identify tenants )
Tenant/Profile Name (Possible to overwrite by the User)
Management URL
Admin URL
Optionally: Setup Key
CGNAT Subnet, to directly see if there are Collisions... but that could also be checked after calling the Management Server; It should only allow one Enabled/Active Connection per Subnet... multiple Entries with the same Subnet in general should be allowed (Example: Your company has a Main VPN Mgmt Server and some Disaster Recovery Backup one in a different Datacenter; Both have the same CGNAT Subnet)

Each Profile List entry will have some ON/OFF Toggle for globally turning off the Connection (e.g. im Working for Company #2 only 1 Week per Month, and dont want to have this Connection open all the time)

For the Linux Client, you can implement some "Add/Delete/Enable/Disable Profile" command through the CLI

Scenario 2

Multi Tenancy for the Management Server
Scenario: I want to have multiple Isolated "Networks" for whatever reason. (e.g. one for my private Smarthome Network and one only for my Friends, sharing a Minecraft Server)

Just add an Dropdown Field on the upper left Navigation bar where the User can choose which Tenant is currently active in the UI
One User can belong to multiple Tenants with different Roles (Admin/Regular Peer)
You need also a "Superuser" Role which is able to manage the tenants per Management Server

I guess this two are the most Important Scenarios which is needed to build up complex Architectures

Later you could for example add an fancy Gateway function to connect two Tenants (Kind of Site2Site VPN) -> Example: You have two Companies which each use their own Netbird and want to share some Services Transparently (Without adding the opposite Profiles to all employees)....
But...., thats stuff for some advanced Use Cases in the Future..... 😀

@fti7 commented on GitHub (Sep 8, 2022): Sure, here is my POV: Multi Tenancy for me means full Isolation. The scenario what mostly like gonna happen is that in multiple Parties are using Netbird with either your shared Management Server or setting up an own one. They are completely isolated and dont talk to each other. The only thing, what you already mentioned is the Collision of the CGNAT Subnet. But i guess that shouldnt be an big issue if they are getting smaller and the reserved Subnet per "Management Server Tenant" gets randomized. If this still happens, it should be possible to change this reserved Subnet as an Admin on one of the Servers # Scenario 1 Im a Freelancer and use Netbird for my private Network using app.netbird.io and working for 2 Companies which each have their own selfhosted Management Server. In this Scenario only the Clients need some Modifications. How it should look like (Example Windows GUI Client): The Clients have a list where i can add/remove multiple "Profiles" A Profile is basically some Config which i get from an Admin via a QR Code/File/Copy&Paste and contains - Tenant ID (I would use some UUID; Can help for further Scenarios where you uniquely need to identify tenants ) - Tenant/Profile Name (Possible to overwrite by the User) - Management URL - Admin URL - Optionally: Setup Key - CGNAT Subnet, to directly see if there are Collisions... but that could also be checked after calling the Management Server; It should only allow one Enabled/Active Connection per Subnet... multiple Entries with the same Subnet in general should be allowed (Example: Your company has a Main VPN Mgmt Server and some Disaster Recovery Backup one in a different Datacenter; Both have the same CGNAT Subnet) Each Profile List entry will have some ON/OFF Toggle for globally turning off the Connection (e.g. im Working for Company #2 only 1 Week per Month, and dont want to have this Connection open all the time) For the Linux Client, you can implement some "Add/Delete/Enable/Disable Profile" command through the CLI # Scenario 2 Multi Tenancy for the Management Server Scenario: I want to have multiple Isolated "Networks" for whatever reason. (e.g. one for my private Smarthome Network and one only for my Friends, sharing a Minecraft Server) - Just add an Dropdown Field on the upper left Navigation bar where the User can choose which Tenant is currently active in the UI - One User can belong to multiple Tenants with different Roles (Admin/Regular Peer) - You need also a "Superuser" Role which is able to manage the tenants per Management Server I guess this two are the most Important Scenarios which is needed to build up complex Architectures Later you could for example add an fancy Gateway function to connect two Tenants (Kind of Site2Site VPN) -> Example: You have two Companies which each use their own Netbird and want to share some Services Transparently (Without adding the opposite Profiles to all employees).... But...., thats stuff for some advanced Use Cases in the Future..... 😀

saavagebueno commented

@mlsmaycon commented on GitHub (Sep 15, 2022):

@fti7 thank you so much for your suggestions and my apologies for not giving feedback earlier, we are aligned on the use cases, for the profile switching I think we can improve a bit more and make things more simpler, just by connecting and the app will handle the rest, and in case you are connecting to multiple self-hosted we can add a Add profile with custom manager.

We are looking at a major account refactor that will allow for better multi-tenancy and isolation. The same goes for the network range management.

Time wise, these changes might come in Q4 or early Q1/2023.

@mlsmaycon commented on GitHub (Sep 15, 2022): @fti7 thank you so much for your suggestions and my apologies for not giving feedback earlier, we are aligned on the use cases, for the profile switching I think we can improve a bit more and make things more simpler, just by connecting and the app will handle the rest, and in case you are connecting to multiple self-hosted we can add a Add profile with custom manager. We are looking at a major account refactor that will allow for better multi-tenancy and isolation. The same goes for the network range management. Time wise, these changes might come in Q4 or early Q1/2023.

saavagebueno commented

@alexlyee commented on GitHub (Mar 5, 2023):

@mlsmaycon This is great! It seems like this is a solution for combining meshnets of my friends' networks and my own? I came accross this because I opened a case for something very similar over on innernet here. If you wouldn't mind reading my use-case over there, would you mind clarifying if and how this would work for it?

@alexlyee commented on GitHub (Mar 5, 2023): @mlsmaycon This is great! It seems like this is a solution for combining meshnets of my friends' networks and my own? I came accross this because I opened a case for something very similar over on innernet [here](https://github.com/tonarino/innernet/issues/250). If you wouldn't mind reading my use-case over there, would you mind clarifying if and how this would work for it?

saavagebueno commented

@helmut72 commented on GitHub (Mar 8, 2023):

We are looking at a major account refactor that will allow for better multi-tenancy and isolation. The same goes for the network range management.

Time wise, these changes might come in Q4 or early Q1/2023.

Are these features released or still in development? If in development, is there a new roadmap?

@helmut72 commented on GitHub (Mar 8, 2023): > We are looking at a major account refactor that will allow for better multi-tenancy and isolation. The same goes for the network range management. > > Time wise, these changes might come in Q4 or early Q1/2023. Are these features released or still in development? If in development, is there a new roadmap?

saavagebueno commented

@lfarkas commented on GitHub (Apr 20, 2023):

i think that one machine can be part of multiple network is a very basic requirements. even openvpn knows this feature from the very beginning. of course this should support multiple interface and multiple config file (or one config file support for multiple interface). imho multiple config file would be more robust. what's more with multiple config file we can use systemd's template services the same way as openvpn do it systemd.unit.html. in this case netbird@work, netbird@home service can be used. of course this requires different network interface and different CGNAT.

is there any progress with it?

@lfarkas commented on GitHub (Apr 20, 2023): i think that one machine can be part of multiple network is a very basic requirements. even openvpn knows this feature from the very beginning. of course this should support multiple interface and multiple config file (or one config file support for multiple interface). imho multiple config file would be more robust. what's more with multiple config file we can use systemd's template services the same way as openvpn do it [systemd.unit.html](https://www.freedesktop.org/software/systemd/man/systemd.unit). in this case netbird@work, netbird@home service can be used. of course this requires different network interface and different CGNAT. is there any progress with it?

saavagebueno commented

@nazarewk commented on GitHub (Apr 24, 2023):

I'm running multiple systemd services: 1 for each network I connect to, don't remember the exact reason, but I had trouble getting it to run using instantiated systemd.unit (I guess it boiled down to running Wireguard listener on different port for each instance)

https://github.com/netbirdio/netbird/pull/659 - to set ports on first start without editing later on

@nazarewk commented on GitHub (Apr 24, 2023): I'm running multiple systemd services: [1 for each network I connect to](https://github.com/nazarewk-iac/nix-configs/blob/09aaf33282bd5ca92c1c351c5229bc2fbdad8907/modules/networking/netbird/default.nix#L48-L72), don't remember the exact reason, but I had trouble getting it to run using instantiated systemd.unit (I guess it boiled down to running [Wireguard listener on different port for each instance](https://github.com/netbirdio/netbird/issues/566)) - https://github.com/netbirdio/netbird/pull/659 - to set ports on first start without editing later on

saavagebueno commented

@bc24fl commented on GitHub (Jul 13, 2023):

I'm evaluating Netbird and super impressed so far! Our use case requires key employees to have access to multiple client isolated networks from a single device. Any updates on this?

@bc24fl commented on GitHub (Jul 13, 2023): I'm evaluating Netbird and super impressed so far! Our use case requires key employees to have access to multiple client isolated networks from a single device. Any updates on this?

saavagebueno commented

@Fantu commented on GitHub (Oct 30, 2023):

one other thing that I see should be modified for support multiple netbird instance is windows firewall rule, actually the name of rule is fixed to "Netbird", I suppose is enough a simple change the rule name to "Netbird-"+$WgIface (for example "Netbird-wt0")

@Fantu commented on GitHub (Oct 30, 2023): one other thing that I see should be modified for support multiple netbird instance is windows firewall rule, actually the name of rule is fixed to "Netbird", I suppose is enough a simple change the rule name to "Netbird-"+$WgIface (for example "Netbird-wt0")

saavagebueno commented

@fti7 commented on GitHub (Mar 1, 2024):

Any update on this?

@fti7 commented on GitHub (Mar 1, 2024): Any update on this?

saavagebueno commented

@jyolo commented on GitHub (Mar 19, 2024):

Any update on this?

@jyolo commented on GitHub (Mar 19, 2024): Any update on this?

saavagebueno commented

@pete1019 commented on GitHub (May 2, 2024):

Multi Tenancy would be so nice. What are the current news on this? Thanks a lot.

@pete1019 commented on GitHub (May 2, 2024): Multi Tenancy would be so nice. What are the current news on this? Thanks a lot.

saavagebueno commented

@the-project-group commented on GitHub (Aug 9, 2024):

@mlsmaycon any update on this?
How would this work on macOS regarding the service?

@the-project-group commented on GitHub (Aug 9, 2024): @mlsmaycon any update on this? How would this work on macOS regarding the service?

saavagebueno commented

@sh00t3r commented on GitHub (Sep 3, 2024):

I converted the guide from @mlsmaycon to use it on windows with the help of nssm. only DNS is not working that well. you can find it on my wiki: link

@sh00t3r commented on GitHub (Sep 3, 2024): I converted the guide from @mlsmaycon to use it on windows with the help of nssm. only DNS is not working that well. you can find it on my wiki: [link](https://wiki.wouterhoorweg.com/en/VPN)

saavagebueno commented

@florian-obradovic commented on GitHub (Sep 6, 2024):

@mlsmaycon I would love to see both options.
I use Netbird for my HomeNetwork and plan to use it as a self hosted Tailscale-competitor option at my corp.
Additionally at the corp, I'd love to see multi tenancy, here an example use case:
Network 1 is for road warriors / remote access for all clients with their personal username (SSO)
Network 2 is for admin only stuff like remotely accessing these client machines and they're automatically onboarded via access key and always runs as a service. This would make managing these machines much easier. Example: rdp access, vnc from login screen via netbird-network2 only, etc.

Are there any plans for payed self-hosted enterprise plans incl. logging / reporting, support, etc?
We want to self host but are "blind" and don't have any access and traffic reports.
We want to support the project.
We want to get customer support if needed.

@florian-obradovic commented on GitHub (Sep 6, 2024): @mlsmaycon I would love to see both options. I use Netbird for my HomeNetwork and plan to use it as a self hosted Tailscale-competitor option at my corp. Additionally at the corp, I'd love to see multi tenancy, here an example use case: Network 1 is for road warriors / remote access for all clients with their personal username (SSO) Network 2 is for admin only stuff like remotely accessing these client machines and they're automatically onboarded via access key and always runs as a service. This would make managing these machines much easier. Example: rdp access, vnc from login screen via netbird-network2 only, etc. Are there any plans for payed self-hosted enterprise plans incl. logging / reporting, support, etc? We want to self host but are "blind" and don't have any access and traffic reports. We want to support the project. We want to get customer support if needed.

saavagebueno commented

@florian-obradovic commented on GitHub (Sep 6, 2024):

@mlsmaycon I would love to see both options.
I use Netbird for my HomeNetwork and plan to use it as a self hosted Tailscale-competitor option at my corp.
Additionally at the corp, I'd love to see multi tenancy, here an example use case:
Network 1 is for road warriors / remote access for all clients with their personal username (SSO)
Network 2 is for admin only stuff like remotely accessing these client machines and they're automatically onboarded via access key and always runs as a service. This would make managing these machines much easier. Example: rdp access, vnc from login screen via netbird-network2 only, etc.

Are there any plans for payed self-hosted enterprise plans incl. logging / reporting, support, etc?
We want to self host but are "blind" and don't have any access and traffic reports.
We want to support the project.
We want to get customer support if needed.

@florian-obradovic commented on GitHub (Sep 6, 2024): @mlsmaycon I would love to see both options. I use Netbird for my HomeNetwork and plan to use it as a self hosted Tailscale-competitor option at my corp. Additionally at the corp, I'd love to see multi tenancy, here an example use case: Network 1 is for road warriors / remote access for all clients with their personal username (SSO) Network 2 is for admin only stuff like remotely accessing these client machines and they're automatically onboarded via access key and always runs as a service. This would make managing these machines much easier. Example: rdp access, vnc from login screen via netbird-network2 only, etc. Are there any plans for payed self-hosted enterprise plans incl. logging / reporting, support, etc? We want to self host but are "blind" and don't have any access and traffic reports. We want to support the project. We want to get customer support if needed.

saavagebueno commented

@florian-obradovic commented on GitHub (Sep 6, 2024):

Trying to figure out the steps on macOS:
WgIface must use inteface prefix utun, Example: utun90 for home and utun91 for work (check if free with ifconfig).
Otherwise you get this:
2024-09-06T16:01:47+02:00 ERRO client/internal/connect.go:263: error while starting Netbird Connection Engine: create wg interface: Interface name must be utun[0-9]

sudo launchctl load -w /Library/LaunchDaemons/netbird-home.plist
sudo launchctl load -w /Library/LaunchDaemons/netbird-work.plist

To check status

netbird status --config /etc/netbird/config-home.json --log-level info --daemon-addr unix:///var/run/netbird-home.sock
netbird status --config /etc/netbird/config-work.json --log-level info --daemon-addr unix:///var/run/netbird-tpg.sock

Currently I still struggle a bit...
They are connected successfully but even can't ping their own address if both tunnels are connected...
I checked for subnet overlap > No (100.116.0.0/16 & 100.102.0.0/16)

Could this due to the link local addresses being the same?

@florian-obradovic commented on GitHub (Sep 6, 2024): Trying to figure out the steps on macOS: WgIface must use inteface prefix **utun**, Example: **utun90** for home and **utun91** for work (check if free with ifconfig). Otherwise you get this: `2024-09-06T16:01:47+02:00 ERRO client/internal/connect.go:263: error while starting Netbird Connection Engine: create wg interface: Interface name must be utun[0-9] ` ![CleanShot 2024-09-06 at 15 43 31@2x](https://github.com/user-attachments/assets/1033a63c-b15a-4b68-b54b-cfe5bb44c562) ``` sudo launchctl load -w /Library/LaunchDaemons/netbird-home.plist sudo launchctl load -w /Library/LaunchDaemons/netbird-work.plist ``` To check status ``` netbird status --config /etc/netbird/config-home.json --log-level info --daemon-addr unix:///var/run/netbird-home.sock netbird status --config /etc/netbird/config-work.json --log-level info --daemon-addr unix:///var/run/netbird-tpg.sock ``` Currently I still struggle a bit... They are connected successfully but even can't ping their own address if both tunnels are connected... I checked for subnet overlap > No (100.116.0.0/16 & 100.102.0.0/16) Could this due to the link local addresses being the same? ![CleanShot 2024-09-06 at 16 42 31@2x](https://github.com/user-attachments/assets/e102097f-ae0d-4d25-a879-fe0789ecd0fd)

saavagebueno commented

@GhaziTriki commented on GitHub (Sep 7, 2024):

Hello,

I have successfuly working 2 netbird on 2 networks for Windows guest. The DNS remains a problem. I am using a DNS proxy, Acrylic, however it is possible to start a single netbird instance with 127.0.0.1 as a custom DNS. The second netbird instance fails then. What is blocking pultiple netbird instances to use the same DNS server?

@GhaziTriki commented on GitHub (Sep 7, 2024): Hello, I have successfuly working 2 netbird on 2 networks for Windows guest. The DNS remains a problem. I am using a DNS proxy, Acrylic, however it is possible to start a single netbird instance with 127.0.0.1 as a custom DNS. The second netbird instance fails then. What is blocking pultiple netbird instances to use the same DNS server?

saavagebueno commented

@tgutzler commented on GitHub (Sep 18, 2024):

@mlsmaycon, you seemed quite motivated to push this along 2 years ago but I cannot see an option for switching profiles in the latest client for windows. Has this been shelved?

@tgutzler commented on GitHub (Sep 18, 2024): @mlsmaycon, you seemed quite motivated to push this along 2 years ago but I cannot see an option for switching profiles in the latest client for windows. Has this been shelved?

saavagebueno commented

@Echutaa commented on GitHub (Sep 25, 2024):

@mlsmaycon, you seemed quite motivated to push this along 2 years ago but I cannot see an option for switching profiles in the latest client for windows. Has this been shelved?

Its in the roadmap and there is at least one draft. The roadmap called for it to come in Q3 '24 so status is unknown but seems like its at least still in the plan and being worked on at some level.

@Echutaa commented on GitHub (Sep 25, 2024): > @mlsmaycon, you seemed quite motivated to push this along 2 years ago but I cannot see an option for switching profiles in the latest client for windows. Has this been shelved? Its in the roadmap and there is at least one draft. The roadmap called for it to come in Q3 '24 so status is unknown but seems like its at least still in the plan and being worked on at some level.

saavagebueno commented

@EdouardVanbelle commented on GitHub (Sep 29, 2024):

Hello I am correctly using 2 netbird instances on my Mac:

/Library/LaunchDaemons/netbird-work.plist with a configuration file mapped to /var/run/netbird-work.sock
/Library/LaunchDaemons/netbird-home.plist with a configuration file mapped to /var/run/netbird-home.sock

I saw that DNS configuration is set via the latest daemon started.
which is logic, seeing the source code you are dealing with scutil on Darwin systems and using uniq keys State:/Network/Service/NetBird-Match/DNS & State:/Network/Service/NetBird-Search/DNS

How do you plan to deal with multiple tenancy ?
I think it can be possible to use namespaced keys to permit multitennancy
for example:
State:/Network/Service/NetBird-Work-Match/DNS vs State:/Network/Service/NetBird-Home-Match/DNS
but I guess it will be different on Windows & Linux (I saw your trick with eBPF)

While waiting a solution on a Darwin system, I did this very simple override:

# cat /etc/resolver/<NETBIRD DOMAIN FOR WORK>
nameserver 100.120.255.254

# cat /etc/resolver/<NETBIRD DOMAIN FOR HOME>
nameserver 100.101.255.254

@EdouardVanbelle commented on GitHub (Sep 29, 2024): Hello I am correctly using 2 netbird instances on my Mac: `/Library/LaunchDaemons/netbird-work.plist` with a configuration file mapped to `/var/run/netbird-work.sock` `/Library/LaunchDaemons/netbird-home.plist` with a configuration file mapped to `/var/run/netbird-home.sock ` I saw that DNS configuration is set via the latest daemon started. which is logic, seeing the source code you are dealing with scutil on Darwin systems and using uniq keys `State:/Network/Service/NetBird-Match/DNS` & `State:/Network/Service/NetBird-Search/DNS` How do you plan to deal with multiple tenancy ? I think it can be possible to use namespaced keys to permit multitennancy for example: `State:/Network/Service/NetBird-Work-Match/DNS` vs `State:/Network/Service/NetBird-Home-Match/DNS` but I guess it will be different on Windows & Linux (I saw your trick with eBPF) While waiting a solution on a Darwin system, I did this very simple override: ``` # cat /etc/resolver/<NETBIRD DOMAIN FOR WORK> nameserver 100.120.255.254 ``` ``` # cat /etc/resolver/<NETBIRD DOMAIN FOR HOME> nameserver 100.101.255.254 ```

saavagebueno commented

@TrentCorrill commented on GitHub (Feb 13, 2025):

Multi-tenancy is also a feature I would love to have - or being able to connect two separate networks together. For my usecase I want to be able to connect my Home NetBird network to my work NetBird network, but not have my work NetBird network be able to access anything in my home network.

@TrentCorrill commented on GitHub (Feb 13, 2025): Multi-tenancy is also a feature I would love to have - or being able to connect two separate networks together. For my usecase I want to be able to connect my Home NetBird network to my work NetBird network, but not have my work NetBird network be able to access anything in my home network.

saavagebueno commented

@netandreus commented on GitHub (Feb 17, 2025):

@TrentCorrill this is my use case too.

@netandreus commented on GitHub (Feb 17, 2025): @TrentCorrill this is my use case too.

saavagebueno commented

@netandreus commented on GitHub (Feb 17, 2025):

I converted the guide from @mlsmaycon to use it on windows with the help of nssm. only DNS is not working that well. you can find it on my wiki: link

@sh00t3r if I will install and run both services and for these two peers I will have exit nodes (for the default route) which of them will be used?

@netandreus commented on GitHub (Feb 17, 2025): > I converted the guide from [@mlsmaycon](https://github.com/mlsmaycon) to use it on windows with the help of nssm. only DNS is not working that well. you can find it on my wiki: [link](https://wiki.wouterhoorweg.com/en/VPN) @sh00t3r if I will install and run both services and for these two peers I will have exit nodes (for the default route) which of them will be used?

saavagebueno commented

@sh00t3r commented on GitHub (Feb 20, 2025):

Thats a good one @netandreus I dont know. You should test it and find out what works for you.It is always possible to select one of the exit nodes in the client and deselect the other one. That will work. i dont think you can activate them at the same time. I hope the devs will look into this whole concept of multiple networks, so we can all use it for work and home! The situation of @TrentCorrill is also my use case.

@sh00t3r commented on GitHub (Feb 20, 2025): Thats a good one @netandreus I dont know. You should test it and find out what works for you.It is always possible to select one of the exit nodes in the client and deselect the other one. That will work. i dont think you can activate them at the same time. I hope the devs will look into this whole concept of multiple networks, so we can all use it for work and home! The situation of @TrentCorrill is also my use case.

saavagebueno commented

@prankos commented on GitHub (Mar 6, 2025):

This will be a great option/feature to have, runnning two seperate Netbird instances at the same time.

my current use case is that i already use Netbird with SSO for all my clients as the primary VPN/Remote access solution, each instance is hosted at their premises and isolated to their network resources.

I also use Wireguard tunnels on each endpoint back to a managed instance where i have some monitoring and security tools hosted, it will be great to migrate the Wireguard solution to Netbird.

@prankos commented on GitHub (Mar 6, 2025): This will be a great option/feature to have, runnning two seperate Netbird instances at the same time. my current use case is that i already use Netbird with SSO for all my clients as the primary VPN/Remote access solution, each instance is hosted at their premises and isolated to their network resources. I also use Wireguard tunnels on each endpoint back to a managed instance where i have some monitoring and security tools hosted, it will be great to migrate the Wireguard solution to Netbird.

saavagebueno commented

@nazarewk commented on GitHub (Mar 11, 2025):

As part of clarifying whether https://github.com/netbirdio/netbird/issues/3273 is related (it is not) I have an official update regarding supporting multiple networks at once.

As it stands now: the feature requires a significant rework of the codebase and our small team is too resource constrained to pick it up until a large customer/partner asks for it specifically.

@nazarewk commented on GitHub (Mar 11, 2025): As part of clarifying whether https://github.com/netbirdio/netbird/issues/3273 is related (it is not) I have an official update regarding supporting multiple networks at once. As it stands now: the feature requires a significant rework of the codebase and our small team is too resource constrained to pick it up until a large customer/partner asks for it specifically.

saavagebueno commented

@nazarewk commented on GitHub (May 6, 2025):

note: watch out for running multiple UI processes deduplication logic https://github.com/netbirdio/netbird/issues/3784

@nazarewk commented on GitHub (May 6, 2025): note: watch out for running multiple UI processes deduplication logic https://github.com/netbirdio/netbird/issues/3784

saavagebueno commented

@fxandrei commented on GitHub (Jun 10, 2025):

Having the ability to connect to multiple coordination server would be a MASSIVE feature for netbird.
I use openvpn daily to connect to multiple vpn servers (4-5 at least, at the same time).
Of course each have their own subnets so they dont overlap or anything.
Ideally i could do the same in netbird.
Each coordination server would have a different public domain, a different subnet, different internal dns domain (ex: peer.internal-domain, etc ). Also i should be able to connect to a peer on the connected coordination servers via fqdn (peer1.internal-domain1, peer1.internal-domain2, etc).

This would just be a killer feature.

Its the only thing that is keeping me from quitting openvpn :)

@fxandrei commented on GitHub (Jun 10, 2025): Having the ability to connect to multiple coordination server would be a MASSIVE feature for netbird. I use openvpn daily to connect to multiple vpn servers (4-5 at least, at the same time). Of course each have their own subnets so they dont overlap or anything. Ideally i could do the same in netbird. Each coordination server would have a different public domain, a different subnet, different internal dns domain (ex: peer.internal-domain, etc ). Also i should be able to connect to a peer on the connected coordination servers via fqdn (peer1.internal-domain1, peer1.internal-domain2, etc). This would just be a killer feature. Its the only thing that is keeping me from quitting openvpn :)

saavagebueno commented

@ordovice commented on GitHub (Jun 11, 2025):

I posted this on 1661 as well, which is in regard to creating an always on vpn tunnel and then authenticating (similar idea to multiple connections as well)

Solutions such as Enclave (also wireguard based) accomplish this by registering the device via a registration key (Enclave technically runs as a system service and then there's a userspace component for login/management). When registered via device key, you can assign policy tags to the registration key and then use those tags in the policies. authentication is also allowed as a secondary set of trust requirements and you can assign the authentication as a trust requirement for the registered device and use sso groups to assign other routes/policies/peer pairs to the device.

@ordovice commented on GitHub (Jun 11, 2025): I posted this on 1661 as well, which is in regard to creating an always on vpn tunnel and then authenticating (similar idea to multiple connections as well) Solutions such as Enclave (also wireguard based) accomplish this by registering the device via a registration key (Enclave technically runs as a system service and then there's a userspace component for login/management). When registered via device key, you can assign policy tags to the registration key and then use those tags in the policies. authentication is also allowed as a secondary set of trust requirements and you can assign the authentication as a trust requirement for the registered device and use sso groups to assign other routes/policies/peer pairs to the device.

saavagebueno commented

@nazarewk commented on GitHub (Jun 12, 2025):

also answer for #1661 comment
@ordovice

Enclave technically runs as a system service and then there's a userspace component for login/management

This is exactly the same as NetBird.

When registered via device key, you can assign policy tags to the registration key and then use those tags in the policies.

Unless I misunderstand something, Enclave Tags work like NetBird Groups assigned to Setup Key (initially) and later propagated as Peer Groups (for modifications after initial login). Then the Groups can be used in regular Access Policies

authentication is also allowed as a secondary set of trust requirements and you can assign the authentication as a trust requirement for the registered device and use sso groups to assign other routes/policies/peer pairs to the device.

sounds like use case a user mentioned on the Slack that we might look into when implementing this PR:

automatically enrolled Setup Key login with a minimal set of permissions to be able to connect to the device
SSO login to the same account with a full set of permissions

@nazarewk commented on GitHub (Jun 12, 2025): also answer for #1661 comment @ordovice > Enclave technically runs as a system service and then there's a userspace component for login/management This is exactly the same as NetBird. > When registered via device key, you can assign policy tags to the registration key and then use those tags in the policies. Unless I misunderstand something, Enclave Tags work like NetBird Groups assigned to Setup Key (initially) and later propagated as Peer Groups (for modifications after initial login). Then the Groups can be used in regular Access Policies > authentication is also allowed as a secondary set of trust requirements and you can assign the authentication as a trust requirement for the registered device and use sso groups to assign other routes/policies/peer pairs to the device. sounds like use case a [user mentioned on the Slack](https://netbirdio.slack.com/archives/C02KHAE8VLZ/p1749554827236599) that we might look into when implementing this PR: 1. automatically enrolled Setup Key login with a minimal set of permissions to be able to connect to the device 2. SSO login to the same account with a full set of permissions

saavagebueno commented

@nazarewk commented on GitHub (Jun 12, 2025):

More use cases mentioned

repeated from the upper post

Support logging in with multiple credentials to the same NetBird control plane & the same account for gradually granting higher permissions. For example:

Setup Key login baked into the base system for access to minimal set of resources required to access the machine
subsequent user SSO login for all privileges of the user account
subsequent Setup Key login for temporary elevated privileges

mentioned in email
I don't see how that could be technically achieved

Support (or explicitly deny in docs/warnings) some form of running on a shared system (Microsoft AVD aka Azure Virtual Desktop) that can be simultaneously used by multiple users.

I am not aware of any operating system mechanism that could tell apart traffic originating from different users, so I don't see any technical way of creating a VPN with user-scoped sessions. If anybody knows that it would be nice to hear.

The closest thing I have found would be running Linux user sessions in their own namespaces https://github.com/systemd/systemd/issues/30512

@nazarewk commented on GitHub (Jun 12, 2025): More use cases mentioned --- _repeated from the upper post_ Support logging in with multiple credentials to the same NetBird control plane & the same account for gradually granting higher permissions. For example: 1. Setup Key login baked into the base system for access to minimal set of resources required to access the machine 2. subsequent user SSO login for all privileges of the user account 3. subsequent Setup Key login for temporary elevated privileges --- _mentioned in email_ _I don't see how that could be technically achieved_ Support (or explicitly deny in docs/warnings) some form of running on a shared system (Microsoft AVD aka Azure Virtual Desktop) that can be simultaneously used by multiple users. I am not aware of any operating system mechanism that could tell apart traffic originating from different users, so I don't see any technical way of creating a VPN with user-scoped sessions. If anybody knows that it would be nice to hear. The closest thing I have found would be running Linux user sessions in their own namespaces https://github.com/systemd/systemd/issues/30512

saavagebueno commented

@nazarewk commented on GitHub (Jun 13, 2025):

Might want to take a look at https://github.com/netbirdio/netbird/issues/1569 as part of the profile switching feature.

@nazarewk commented on GitHub (Jun 13, 2025): Might want to take a look at https://github.com/netbirdio/netbird/issues/1569 as part of the profile switching feature.

saavagebueno commented

@buzzard10 commented on GitHub (Jul 10, 2025):

I would like to have one connection to my personal netbird + another connection in the same time to company netbird.

@buzzard10 commented on GitHub (Jul 10, 2025): I would like to have one connection to my personal netbird + another connection in the same time to company netbird.

saavagebueno commented

@fxandrei commented on GitHub (Jul 10, 2025):

I would like to have one connection to my personal netbird + another connection in the same time to company netbird.

Yes, this would be a killer feature. For now you can switch connections with a script, and connect one or the other.

@fxandrei commented on GitHub (Jul 10, 2025): > I would like to have one connection to my personal netbird + another connection in the same time to company netbird. Yes, this would be a killer feature. For now you can switch connections with a script, and connect one or the other.

saavagebueno commented

@jakob1379 commented on GitHub (Jul 14, 2025):

Running NixOS this is already possible, though still needing 1 netbird account for each connection..

  services = {
    netbird = {
      enable = true;
      clients = {
        home.port = 51822;
        shed.port = 51823;
      };
    };
  };

This will make two separate netbird clients netbird-home and netbird-shed which is just a wrapped process of the netbird cli itself. Main downside is that you cannot have indicators for the connections without some tweaking.

@jakob1379 commented on GitHub (Jul 14, 2025): Running NixOS this is already possible, though still needing 1 netbird account for each connection.. ```nix services = { netbird = { enable = true; clients = { home.port = 51822; shed.port = 51823; }; }; }; ``` This will make two separate netbird clients `netbird-home` and `netbird-shed` which is just a wrapped process of the `netbird` cli itself. Main downside is that you cannot have indicators for the connections without some tweaking.

saavagebueno commented

@nazarewk commented on GitHub (Jul 14, 2025):

Running NixOS this is already possible

It is only partially possible; the DNS and some other features won't work and might otherwise interfere with each other.

@nazarewk commented on GitHub (Jul 14, 2025): > Running NixOS this is already possible It is only partially possible; the DNS and some other features won't work and might otherwise interfere with each other.

saavagebueno commented

@fxandrei commented on GitHub (Jul 14, 2025):

What is NixOS ? And how is it related to this situation (running netbird client on windows\linux and having the ability to connect to multiple networks).

@fxandrei commented on GitHub (Jul 14, 2025): What is NixOS ? And how is it related to this situation (running netbird client on windows\linux and having the ability to connect to multiple networks).

saavagebueno commented

@nazarewk commented on GitHub (Jul 14, 2025):

What is NixOS?

It is a Linux distribution configured fully declaratively using purpose-built functional configuration language (Nix), you can think of it as a giant Ansible playbook that supports proper rollbacks and continuous & atomic configuration updates. NixOS modules make it relatively easy to abstract away very elaborate operating system setups behind only a few configuration knobs.

how is it related to this situation

In theory, it proves that running multiple clients at the same time might be possible to configure externally to NetBird itself.
In practice, not much: those setups might be too complex to execute on more traditional operating systems without elaborate automation (or writing app dedicated to this).

PS: I am the author of a large chunk of the NixOS module. I didn't do any significant work on it for at least a year, but as far as I remember the biggest issues to solve to run multiple instances at once on Linux were:

running an external DNS resolver (CoreDNS, kresd or something similar) to aggregate the results from all the active clients
parametrizing the routing table ID currently hardcoded as 7120

Of course MacOS, Windows and other operating systems would require an entirely different custom-tailored approaches.

@nazarewk commented on GitHub (Jul 14, 2025): > What is NixOS? It is a Linux distribution configured fully declaratively using purpose-built functional configuration language (Nix), you can think of it as a giant Ansible playbook that supports proper rollbacks and continuous & atomic configuration updates. NixOS modules make it relatively easy to abstract away very elaborate operating system setups behind only a few configuration knobs. > how is it related to this situation In theory, it proves that running multiple clients at the same time might be possible to configure externally to NetBird itself. In practice, not much: those setups might be too complex to execute on more traditional operating systems without elaborate automation (or writing app dedicated to this). --- PS: I am the author of a large chunk of the NixOS module. I didn't do any significant work on it for at least a year, but as far as I remember the biggest issues to solve to run multiple instances at once on **Linux** were: 1. running an external DNS resolver (CoreDNS, kresd or something similar) to aggregate the results from all the active clients 2. parametrizing the routing table ID [currently hardcoded as `7120`](https://github.com/netbirdio/netbird/blob/9fbad7dbade7683a907af173546699a8ae765ac2/client/internal/routemanager/systemops/systemops_linux.go#L26-L29) Of course MacOS, Windows and other operating systems would require an entirely different custom-tailored approaches.

saavagebueno commented

@fxandrei commented on GitHub (Jul 14, 2025):

What you are describing seems to be leaning more to the server side of things.
I think its fine to have a netbird server instance completely separate.
The main problem here seems to be related to the client (i think).
Im not actually sure what it involves (in detail) in order to achieve this with netbird, but right now im able to run multiple openvpn connections on my windows machine, each with its own adapter.
Ideally i could do the same with netbird in the future, and then i quite openvpn :)

@fxandrei commented on GitHub (Jul 14, 2025): What you are describing seems to be leaning more to the server side of things. I think its fine to have a netbird server instance completely separate. The main problem here seems to be related to the client (i think). Im not actually sure what it involves (in detail) in order to achieve this with netbird, but right now im able to run multiple openvpn connections on my windows machine, each with its own adapter. Ideally i could do the same with netbird in the future, and then i quite openvpn :)

saavagebueno commented

@nazarewk commented on GitHub (Jul 14, 2025):

What you are describing seems to be leaning more to the server side of things.

Not at all, I'm talking Linux (which a lot of servers run on), but it's all about running the local client on a PC. I don't think there would be much (or anything at all) to adjust on the NetBird server side of things.

Im not actually sure what it involves (in detail) in order to achieve this with netbird, but right now im able to run multiple openvpn connections on my windows machine, each with its own adapter.
Ideally i could do the same with netbird in the future, and then i quite openvpn :)

It is very specific to both VPN implementation and the operating systems supported. Even OpenVPN doesn't support it uniformly across all systems/clients.

With the growing popularity of NetBird and therefore growing demand for running clients for multiple environments at once, we do plan to support it, but I can't give any concrete timelines yet.

@nazarewk commented on GitHub (Jul 14, 2025): > What you are describing seems to be leaning more to the server side of things. Not at all, I'm talking Linux (which a lot of servers run on), but it's all about running the local client on a PC. I don't think there would be much (or anything at all) to adjust on the NetBird server side of things. > Im not actually sure what it involves (in detail) in order to achieve this with netbird, but right now im able to run multiple openvpn connections on my windows machine, each with its own adapter. > Ideally i could do the same with netbird in the future, and then i quite openvpn :) It is very specific to both VPN implementation and the operating systems supported. Even [OpenVPN doesn't support it uniformly](https://openvpn.net/as-docs/faq-simultaneous-openvpn-server-connections.html) across all systems/clients. With the growing popularity of NetBird and therefore growing demand for running clients for multiple environments at once, we do plan to support it, but I can't give any concrete timelines yet.

saavagebueno commented

@jakob1379 commented on GitHub (Jul 14, 2025):

Running NixOS this is already possible

It is only partially possible; the DNS and some other features won't work and might otherwise interfere with each other.

DNS works fine (I use systemd-resolved which may influence whether DNS works correctly or not)

@jakob1379 commented on GitHub (Jul 14, 2025): > > Running NixOS this is already possible > > It is only partially possible; the DNS and some other features won't work and might otherwise interfere with each other. DNS works fine (I use systemd-resolved which may influence whether DNS works correctly or not)

saavagebueno commented

@nazarewk commented on GitHub (Jul 14, 2025):

DNS works fine (I use systemd-resolved which may influence whether DNS works correctly or not)

You'll probably notice only one of the instances replies with the correct names when you try to access instance-specific records. As far as I remember, the one with the correct answers would be the last one that started up.

Unless something has changed since I last looked into it. I was also running systemd-resolved.

@nazarewk commented on GitHub (Jul 14, 2025): > DNS works fine (I use systemd-resolved which may influence whether DNS works correctly or not) You'll probably notice only one of the instances replies with the correct names when you try to access instance-specific records. As far as I remember, the one with the correct answers would be the last one that started up. Unless something has changed since I last looked into it. I was also running `systemd-resolved`.

saavagebueno commented

@jakob1379 commented on GitHub (Jul 14, 2025):

I notice that all my instances replies with the correct names. So something must have changed or has always been inconsistent 😅

@jakob1379 commented on GitHub (Jul 14, 2025): I notice that all my instances replies with the correct names. So something must have changed or has always been inconsistent 😅

saavagebueno commented

@nazarewk commented on GitHub (Jul 14, 2025):

@jakob1379 it indeed seems to be the case, I can access all of: 2x Cloud & 1x self-hosted instance at the same time without issues on NixOS with systemd-resolved:

root@brys ~# netbird-priv status --filter-by-status=connected --json | jq '.peers.details | map(select(.status == "Connected") | {fqdn, netbirdIp})'
error: Error when renaming history file: Device or resource busy
[
  {
    "fqdn": "moss.netbird.cloud",
    "netbirdIp": "100.79.63.47"
  },
  {
    "fqdn": "etra.netbird.cloud",
    "netbirdIp": "100.79.187.16"
  }
]
root@brys ~# netbird-nbt status --filter-by-status=connected --json | jq '.peers.details | map(select(.status == "Connected") | {fqdn, netbirdIp})'
[
  {
    "fqdn": "brys-vm-nbt-ubuntu-isolated-01.netbird.cloud",
    "netbirdIp": "100.83.143.153"
  },
  {
    "fqdn": "brys-vm-nbt-ubuntu-isolated-02.netbird.cloud",
    "netbirdIp": "100.83.181.171"
  }
]
root@brys ~# netbird-nbs status --filter-by-status=connected --json | jq '.peers.details | map(select(.status == "Connected") | {fqdn, netbirdIp})'
[
  {
    "fqdn": "<REDACTED>.netbird.selfhosted",
    "netbirdIp": "100.75.177.214"
  }
]
root@brys ~# ping -c 1 moss.netbird.cloud
PING moss.netbird.cloud (100.79.63.47) 56(84) bytes of data.
64 bytes from moss.netbird.cloud (100.79.63.47): icmp_seq=1 ttl=64 time=48.5 ms

--- moss.netbird.cloud ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 48.488/48.488/48.488/0.000 ms
root@brys ~# ping -c1 brys-vm-nbt-ubuntu-isolated-01.netbird.cloud
PING brys-vm-nbt-ubuntu-isolated-01.netbird.cloud (100.83.143.153) 56(84) bytes of data.
64 bytes from brys-vm-nbt-ubuntu-isolated-01.netbird.cloud (100.83.143.153): icmp_seq=1 ttl=64 time=0.312 ms

--- brys-vm-nbt-ubuntu-isolated-01.netbird.cloud ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.312/0.312/0.312/0.000 ms
root@brys ~# curl -v <REDACTED>.netbird.selfhosted >/dev/null
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0* Host <REDACTED>.netbird.selfhosted:80 was resolved.
* IPv6: (none)
* IPv4: 100.75.177.214
*   Trying 100.75.177.214:80...
* Connected to <REDACTED>.netbird.selfhosted (100.75.177.214) port 80
* using HTTP/1.x
> GET / HTTP/1.1
> Host: <REDACTED>.netbird.selfhosted
> User-Agent: curl/8.14.1
> Accept: */*
> 
* Request completely sent off
< HTTP/1.1 404 Not Found
< Content-Type: text/plain; charset=utf-8
< X-Content-Type-Options: nosniff
< Date: Mon, 14 Jul 2025 11:51:30 GMT
< Content-Length: 19
< 
{ [19 bytes data]
100    19  100    19    0     0    458      0 --:--:-- --:--:-- --:--:--   463
* Connection #0 to host <REDACTED>.netbird.selfhosted left intact

I'll try to find out more details on it from the team.

@nazarewk commented on GitHub (Jul 14, 2025): @jakob1379 it indeed seems to be the case, I can access all of: 2x Cloud & 1x self-hosted instance at the same time without issues on NixOS with `systemd-resolved`: ``` root@brys ~# netbird-priv status --filter-by-status=connected --json | jq '.peers.details | map(select(.status == "Connected") | {fqdn, netbirdIp})' error: Error when renaming history file: Device or resource busy [ { "fqdn": "moss.netbird.cloud", "netbirdIp": "100.79.63.47" }, { "fqdn": "etra.netbird.cloud", "netbirdIp": "100.79.187.16" } ] root@brys ~# netbird-nbt status --filter-by-status=connected --json | jq '.peers.details | map(select(.status == "Connected") | {fqdn, netbirdIp})' [ { "fqdn": "brys-vm-nbt-ubuntu-isolated-01.netbird.cloud", "netbirdIp": "100.83.143.153" }, { "fqdn": "brys-vm-nbt-ubuntu-isolated-02.netbird.cloud", "netbirdIp": "100.83.181.171" } ] root@brys ~# netbird-nbs status --filter-by-status=connected --json | jq '.peers.details | map(select(.status == "Connected") | {fqdn, netbirdIp})' [ { "fqdn": "<REDACTED>.netbird.selfhosted", "netbirdIp": "100.75.177.214" } ] root@brys ~# ping -c 1 moss.netbird.cloud PING moss.netbird.cloud (100.79.63.47) 56(84) bytes of data. 64 bytes from moss.netbird.cloud (100.79.63.47): icmp_seq=1 ttl=64 time=48.5 ms --- moss.netbird.cloud ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 48.488/48.488/48.488/0.000 ms root@brys ~# ping -c1 brys-vm-nbt-ubuntu-isolated-01.netbird.cloud PING brys-vm-nbt-ubuntu-isolated-01.netbird.cloud (100.83.143.153) 56(84) bytes of data. 64 bytes from brys-vm-nbt-ubuntu-isolated-01.netbird.cloud (100.83.143.153): icmp_seq=1 ttl=64 time=0.312 ms --- brys-vm-nbt-ubuntu-isolated-01.netbird.cloud ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.312/0.312/0.312/0.000 ms root@brys ~# curl -v <REDACTED>.netbird.selfhosted >/dev/null % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0* Host <REDACTED>.netbird.selfhosted:80 was resolved. * IPv6: (none) * IPv4: 100.75.177.214 * Trying 100.75.177.214:80... * Connected to <REDACTED>.netbird.selfhosted (100.75.177.214) port 80 * using HTTP/1.x > GET / HTTP/1.1 > Host: <REDACTED>.netbird.selfhosted > User-Agent: curl/8.14.1 > Accept: */* > * Request completely sent off < HTTP/1.1 404 Not Found < Content-Type: text/plain; charset=utf-8 < X-Content-Type-Options: nosniff < Date: Mon, 14 Jul 2025 11:51:30 GMT < Content-Length: 19 < { [19 bytes data] 100 19 100 19 0 0 458 0 --:--:-- --:--:-- --:--:-- 463 * Connection #0 to host <REDACTED>.netbird.selfhosted left intact ``` I'll try to find out more details on it from the team.

saavagebueno commented

@fxandrei commented on GitHub (Jul 14, 2025):

Im not sure i follow this. Can anything from nixos be used to achive this on other machines ? Lets say i have a debian machine somewhere, or (more likely) my own windows machine.
What does this mean for a windows machine that would need to access multiple netbird instances at the same time (ideally)

@fxandrei commented on GitHub (Jul 14, 2025): Im not sure i follow this. Can anything from nixos be used to achive this on other machines ? Lets say i have a debian machine somewhere, or (more likely) my own windows machine. What does this mean for a windows machine that would need to access multiple netbird instances at the same time (ideally)

saavagebueno commented

@nazarewk commented on GitHub (Jul 14, 2025):

I have heard back from the dev team, they're saying there can still be some conflicts, inconsistencies and race conditions within firewall and routing table management on Linux. I guess the most obvious thing to observe would be wiping some of those (fw/routing rules) completely whenever ANY client exits.

It is definitely doable, but is expected to take at least a few workdays to clean up. We might be able to squeeze it in sooner (a few months) rather than later (end of this or early next year).

Im not sure i follow this. Can anything from nixos be used to achive this on other machines ? Lets say i have a debian machine somewhere, or (more likely) my own windows machine.

The NixOS module provides a blueprint for what would need to be configured on most of the Linux systems:

configuring a few envvars
- some of those are required to be set on the CLI to control the daemon,
marking interfaces as unmanaged in various systems (networkd, dhcpcd etc.)
opening up firewall for the DNS forwarder
opening up a polkit rules to allow systemd-resolved modifications,

Those should be applicable to most of Linux distributions running systemd, resolved & polkit.

What does this mean for a windows machine that would need to access multiple netbird instances at the same time (ideally)

This does not mean much for other operating systems; each has a different networking/firewall stack and needs to be treated individually.

@nazarewk commented on GitHub (Jul 14, 2025): I have heard back from the dev team, they're saying there can still be some conflicts, inconsistencies and race conditions within firewall and routing table management on Linux. I guess the most obvious thing to observe would be wiping some of those (fw/routing rules) completely whenever ANY client exits. It is definitely doable, but is expected to take at least a few workdays to clean up. We might be able to squeeze it in sooner (a few months) rather than later (end of this or early next year). --- > Im not sure i follow this. Can anything from nixos be used to achive this on other machines ? Lets say i have a debian machine somewhere, or (more likely) my own windows machine. The NixOS module provides a blueprint for what would need to be configured on most of the Linux systems: - [configuring a few envvars](https://github.com/NixOS/nixpkgs/blob/9807714d6944a957c2e036f84b0ff8caf9930bc0/nixos/modules/services/networking/netbird.nix#L391-L404) - some of those are required to be set on the CLI to control the daemon, - marking interfaces as unmanaged in various systems (networkd, dhcpcd etc.) - opening up firewall for the DNS forwarder - opening up a polkit rules to allow `systemd-resolved` modifications, Those should be applicable to most of Linux distributions running `systemd`, `resolved` & `polkit`. > What does this mean for a windows machine that would need to access multiple netbird instances at the same time (ideally) This does not mean much for other operating systems; each has a different networking/firewall stack and needs to be treated individually.

saavagebueno commented

@fxandrei commented on GitHub (Jul 14, 2025):

Could the wsl2 of windows be used ? Anyway, looking forward to updates on this subject.

@fxandrei commented on GitHub (Jul 14, 2025): Could the wsl2 of windows be used ? Anyway, looking forward to updates on this subject.

saavagebueno commented

@x7ryan commented on GitHub (Jul 14, 2025):

I ended up here trying to see if this were possible. I am setting up two seperate netbird networks, one for home, and one for my work.

I do wonder if as a workaround if I could not create a bridge or gateway from say my personal network to my work network, with say a VM on my home network with the netbird client logged into my work network and sharing those routes? I feel like if I could restrict the IP ranges each netbird network could assign to their machines I could give both work and home different non-overlapping ranges and it could work? But I'm no network engineer so I may be wrong. But I'd be interested in knowing if this could be a workaround at least until the clients are able to natively support multiple simultaneous connections?

@x7ryan commented on GitHub (Jul 14, 2025): I ended up here trying to see if this were possible. I am setting up two seperate netbird networks, one for home, and one for my work. I do wonder if as a workaround if I could not create a bridge or gateway from say my personal network to my work network, with say a VM on my home network with the netbird client logged into my work network and sharing those routes? I feel like if I could restrict the IP ranges each netbird network could assign to their machines I could give both work and home different non-overlapping ranges and it could work? But I'm no network engineer so I may be wrong. But I'd be interested in knowing if this could be a workaround at least until the clients are able to natively support multiple simultaneous connections?

saavagebueno commented

@tgutzler commented on GitHub (Jul 15, 2025):

I do wonder if as a workaround if I could not create a bridge or gateway from say my personal network to my work network, with say a VM on my home network with the netbird client logged into my work network and sharing those routes?

Your workaround is technically clever but not recommended from a cyber security perspective. Your company's requirement to use a VPN is a security measure designed to create a secure, controlled environment for accessing internal resources. By creating a permanent tunnel from your personal network to the work network, you would essentially be creating a new, unsanctioned bridge between two distinct security zones. This introduces a potential attack vector through your personal network, which may have different and potentially less stringent security controls than your company's network.

@tgutzler commented on GitHub (Jul 15, 2025): > I do wonder if as a workaround if I could not create a bridge or gateway from say my personal network to my work network, with say a VM on my home network with the netbird client logged into my work network and sharing those routes? Your workaround is technically clever but not recommended from a cyber security perspective. Your company's requirement to use a VPN is a security measure designed to create a secure, controlled environment for accessing internal resources. By creating a permanent tunnel from your personal network to the work network, you would essentially be creating a new, unsanctioned bridge between two distinct security zones. This introduces a potential attack vector through your personal network, which may have different and potentially less stringent security controls than your company's network.

saavagebueno commented

@x7ryan commented on GitHub (Jul 16, 2025):

I do wonder if as a workaround if I could not create a bridge or gateway from say my personal network to my work network, with say a VM on my home network with the netbird client logged into my work network and sharing those routes?

Your workaround is technically clever but not recommended from a cyber security perspective. Your company's requirement to use a VPN is a security measure designed to create a secure, controlled environment for accessing internal resources. By creating a permanent tunnel from your personal network to the work network, you would essentially be creating a new, unsanctioned bridge between two distinct security zones. This introduces a potential attack vector through your personal network, which may have different and potentially less stringent security controls than your company's network.

To meke it clear I own the company, I am in charge of both the security controls of my company and my personal network, so I agree not ideal if you work for someone else who happens to use netbird for their company VPN. But in my specific case that's not applicable.

@x7ryan commented on GitHub (Jul 16, 2025): > > I do wonder if as a workaround if I could not create a bridge or gateway from say my personal network to my work network, with say a VM on my home network with the netbird client logged into my work network and sharing those routes? > > Your workaround is technically clever but not recommended from a cyber security perspective. Your company's requirement to use a VPN is a security measure designed to create a secure, controlled environment for accessing internal resources. By creating a permanent tunnel from your personal network to the work network, you would essentially be creating a new, unsanctioned bridge between two distinct security zones. This introduces a potential attack vector through your personal network, which may have different and potentially less stringent security controls than your company's network. To meke it clear I own the company, I am in charge of both the security controls of my company and my personal network, so I agree not ideal if you work for someone else who happens to use netbird for their company VPN. But in my specific case that's not applicable.

saavagebueno commented

@nazarewk commented on GitHub (Jul 18, 2025):

noting use case mentioned in https://github.com/netbirdio/netbird/issues/4170

@nazarewk commented on GitHub (Jul 18, 2025): noting use case mentioned in https://github.com/netbirdio/netbird/issues/4170

saavagebueno commented