SVI/netbird
1
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-07-27 16:32:34 -04:00
Code Issues 3.0k Packages Projects Releases 10 Wiki Activity

support web proxy for https traffic to establish connection? #1861

New Issue
Open
opened 2025-11-20 06:08:09 -05:00 by saavagebueno · 7 comments
saavagebueno commented 2025-11-20 06:08:09 -05:00
Owner
Copy Link

Originally created by @juju4 on GitHub (May 4, 2025).

Is your feature request related to a problem? Please describe.
currently, it does not seem possible to establish a vpn connection without a proxy exception.
direct https traffic must be allowed in the same way than turn/stun/relays.
Else, when doing netbird up, only seeing access to http://169.254.169.254/opc/v2/instance/, http://169.254.169.254/latest/ and similar with ua Go-http-client/1.1 (a netbird ua would be better too) and ending with "Error: login backoff cycle failed: rpc error: code = DeadlineExceeded desc = context deadline exceeded".
Only pkgs.netbird.io seems "compatible" with web proxy.
Tested with netbird 0.40.0 on ubuntu 24.04 LTS

Other tool like bigbluebutton allows http(s) traffic to be proxied while coturn/stun has direct access.

Describe the solution you'd like
if a proxy is defined (like http(s)_proxy environment in linux), the web traffic should go through it and not require direct access.

Describe alternatives you've considered
Only alternative is to open web direct access which is depending on environments.

Originally created by @juju4 on GitHub (May 4, 2025). **Is your feature request related to a problem? Please describe.** currently, it does not seem possible to establish a vpn connection without a proxy exception. direct https traffic must be allowed in the same way than turn/stun/relays. Else, when doing `netbird up`, only seeing access to http://169.254.169.254/opc/v2/instance/, http://169.254.169.254/latest/ and similar with ua Go-http-client/1.1 (a netbird ua would be better too) and ending with "Error: login backoff cycle failed: rpc error: code = DeadlineExceeded desc = context deadline exceeded". Only pkgs.netbird.io seems "compatible" with web proxy. Tested with netbird 0.40.0 on ubuntu 24.04 LTS Other tool like bigbluebutton allows http(s) traffic to be proxied while coturn/stun has direct access. **Describe the solution you'd like** if a proxy is defined (like http(s)_proxy environment in linux), the web traffic should go through it and not require direct access. **Describe alternatives you've considered** Only alternative is to open web direct access which is depending on environments.
saavagebueno added the feature-request label 2025-11-20 06:08:09 -05:00
saavagebueno commented 2025-11-20 06:08:10 -05:00
Author
Owner
Copy Link

@lixmal commented on GitHub (May 5, 2025):

Does your proxy support http/2 and grpc?

@lixmal commented on GitHub (May 5, 2025): Does your proxy support http/2 and grpc?
saavagebueno commented 2025-11-20 06:08:10 -05:00
Author
Owner
Copy Link

@juju4 commented on GitHub (May 11, 2025):

Test was with squid which seems to have http/2+grpc support (if sslbump and extra config) and also direct connect (no sslbump) should work per
https://docs.spectrocloud.com/architecture/grps-proxy/#grpc-and-proxies

Quick check some other web proxies
Squid: https://wiki.squid-cache.org/Features/HTTP2
Tinyproxy: no http/2 https://github.com/tinyproxy/tinyproxy/issues/139
Envoy: http/2 and grpc https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/other_protocols/grpc#grpc
Nginx: http/2 and grpc https://blog.nginx.org/blog/nginx-1-13-10-grpc, https://github.com/chobits/ngx_http_proxy_connect_module

Tested with Squid 6.10, no sslbump

@juju4 commented on GitHub (May 11, 2025): Test was with squid which seems to have http/2+grpc support (if sslbump and extra config) and also direct connect (no sslbump) should work per https://docs.spectrocloud.com/architecture/grps-proxy/#grpc-and-proxies Quick check some other web proxies Squid: https://wiki.squid-cache.org/Features/HTTP2 Tinyproxy: no http/2 https://github.com/tinyproxy/tinyproxy/issues/139 Envoy: http/2 and grpc https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/other_protocols/grpc#grpc Nginx: http/2 and grpc https://blog.nginx.org/blog/nginx-1-13-10-grpc, https://github.com/chobits/ngx_http_proxy_connect_module Tested with Squid 6.10, no sslbump
saavagebueno commented 2025-11-20 06:08:11 -05:00
Author
Owner
Copy Link

@vaclcer commented on GitHub (May 22, 2025):

Having exactly the same use case - peer can access the public Internet only via HTTP PROXY (defined in $HTTP_PROXY or similar env variable). The proxy itself is Squid.

Btw. FRP supports it ;-) https://github.com/fatedier/frp?tab=readme-ov-file#connecting-to-frps-via-proxy

@vaclcer commented on GitHub (May 22, 2025): Having exactly the same use case - peer can access the public Internet only via HTTP PROXY (defined in $HTTP_PROXY or similar env variable). The proxy itself is Squid. Btw. FRP supports it ;-) https://github.com/fatedier/frp?tab=readme-ov-file#connecting-to-frps-via-proxy
saavagebueno commented 2025-11-20 06:08:11 -05:00
Author
Owner
Copy Link

@lixmal commented on GitHub (May 22, 2025):

Can you try configuring the proxy envs for the netbird service, e.g. similar to https://docs.netbird.io/how-to/troubleshooting-client#on-linux-with-systemd

@lixmal commented on GitHub (May 22, 2025): Can you try configuring the proxy envs for the netbird service, e.g. similar to https://docs.netbird.io/how-to/troubleshooting-client#on-linux-with-systemd
saavagebueno commented 2025-11-20 06:08:11 -05:00
Author
Owner
Copy Link

@vaclcer commented on GitHub (May 22, 2025):

This does not help.. You can see below that curl works, because it by default uses $HTTP_PROXY. Direct connection by Netbird does not.

2025-05-22T13:14:05Z INFO util/grpc/dialer.go:89: DialContext error: context deadline exceeded
2025-05-22T13:14:05Z INFO management/client/grpc.go:57: createConnection error: context deadline exceeded
2025-05-22T13:14:05Z ERRO util/grpc/dialer.go:45: Failed to dial: d.Dialer.DialContext: dial tcp 91.99.74.154:443: operation was canceled
2025-05-22T13:14:05Z INFO ./caller_not_available:0: 2025/05/22 13:14:05 WARNING: [core] [Channel #11 SubChannel #12]grpc: addrConn.createTransport failed to connect to {Addr: "netbird.magentify.eu:443", ServerName: "netbird.magentify.eu:443", }. Err: connection error: desc = "transport: Error while dialing: nbnet.NewDialer().DialContext: d.Dialer.DialContext: dial tcp 91.99.74.154:443: operation was canceled"
2025-05-22T13:14:05Z ERRO management/client/grpc.go:65: failed creating connection to Management Service: context deadline exceeded
2025-05-22T13:14:05Z ERRO client/internal/device_auth.go:60: failed connecting to Management Service https://netbird.magentify.eu:443 context deadline exceeded
2025-05-22T13:14:05Z INFO ./caller_not_available:0: 2025/05/22 13:14:05 WARNING: [core] [Server #1]grpc: Server.processUnaryRPC failed to write status: connection error: desc = "transport is closing"

curl works:

(base) root@turing:/home/vaclav# curl -I https://netbird.magentify.eu:443
HTTP/1.1 200 Connection established

@vaclcer commented on GitHub (May 22, 2025): This does not help.. You can see below that curl works, because it by default uses $HTTP_PROXY. Direct connection by Netbird does not. > 2025-05-22T13:14:05Z INFO util/grpc/dialer.go:89: DialContext error: context deadline exceeded > 2025-05-22T13:14:05Z INFO management/client/grpc.go:57: createConnection error: context deadline exceeded > 2025-05-22T13:14:05Z ERRO util/grpc/dialer.go:45: Failed to dial: d.Dialer.DialContext: dial tcp 91.99.74.154:443: operation was canceled > 2025-05-22T13:14:05Z INFO ./caller_not_available:0: 2025/05/22 13:14:05 WARNING: [core] [Channel #11 SubChannel #12]grpc: addrConn.createTransport failed to connect to {Addr: "netbird.magentify.eu:443", ServerName: "netbird.magentify.eu:443", }. Err: connection error: desc = "transport: Error while dialing: nbnet.NewDialer().DialContext: d.Dialer.DialContext: dial tcp 91.99.74.154:443: operation was canceled" > 2025-05-22T13:14:05Z ERRO management/client/grpc.go:65: failed creating connection to Management Service: context deadline exceeded > 2025-05-22T13:14:05Z ERRO client/internal/device_auth.go:60: failed connecting to Management Service https://netbird.magentify.eu:443 context deadline exceeded > 2025-05-22T13:14:05Z INFO ./caller_not_available:0: 2025/05/22 13:14:05 WARNING: [core] [Server #1]grpc: Server.processUnaryRPC failed to write status: connection error: desc = "transport is closing" > curl works: > (base) root@turing:/home/vaclav# curl -I https://netbird.magentify.eu:443 > HTTP/1.1 200 Connection established
saavagebueno commented 2025-11-20 06:08:11 -05:00
Author
Owner
Copy Link

@vaclcer commented on GitHub (Jul 6, 2025):

Hi, do you think this would be ever achievable?

@vaclcer commented on GitHub (Jul 6, 2025): Hi, do you think this would be ever achievable?
saavagebueno commented 2025-11-20 06:08:11 -05:00
Author
Owner
Copy Link

@nazarewk commented on GitHub (Jul 7, 2025):

@vaclcer not sure what system are you running, but are you sure the $HTTP_PROXY envvar is active for the NetBird service? The main process is a system-wide background daemon that needs a separate handling of envvars depending on the system.

On Linux you can add the vars to /etc/sysconfig/netbird
On Windows you can run [Environment]::SetEnvironmentVariable("HTTP_PROXY", "XXXX", "Machine")
On MacOS you have to resort to editing netbird.plist file manually

@nazarewk commented on GitHub (Jul 7, 2025): @vaclcer not sure what system are you running, but are you sure the `$HTTP_PROXY` envvar is active for the NetBird service? The main process is a system-wide background daemon that needs a separate handling of envvars depending on the system. On Linux you can [add the vars to `/etc/sysconfig/netbird`](https://docs.netbird.io/how-to/troubleshooting-client#on-linux-with-systemd) On Windows you can run [`[Environment]::SetEnvironmentVariable("HTTP_PROXY", "XXXX", "Machine")`](https://docs.netbird.io/how-to/troubleshooting-client#on-windows) On MacOS you have to resort to [editing `netbird.plist` file manually](https://www.dowdandassociates.com/blog/content/howto-set-an-environment-variable-in-mac-os-x-launchd-plist/)
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
2021 Q4
2022 Q1
2022 Q1
accessibility
acl
agent
agent
Android
Android
api
authentik
automation
azure
battery-usage
bug
cache
client
client-ui
cloud
cloud-only
cloudflare
community
compatibility
config-idp
config-issue
connection
contribution
coturn
cross-vpn
dashboard
data-usage
distribution
dns
docker
documentation
duplicate
enhancement
enhancement
event-stream
feature-request
freebsd
getting-started
go
good first issue
gui
help wanted
home-assistant
idp
inconsistency
integration
integrations
ios
ipv6
jwt
k8s
keycloak
linux
login
macos
management-service
missing-docs
mobile
moved-internal
needs-review
netbird-ui
networking
new-platform
nginx
notification
okta
openwrt
packaging
peer-management
peer-management
peer-management
performance
postgres
posture-checks
psk
pull-request
Mirrored from GitHub Pull Request
 question
refactor
relay
release
rfc
routes
security
security-related
self-hosting
server
signal
sleep-issue
ssh
ssl
status
store
synology
system-compatibility-issue
test-suite
third-party-integration
triage
triage-needed
troubleshooting
UX
waiting-feedback
windows
wontfix
zitadel
No Label feature-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
saavagebueno
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: SVI/netbird#1861
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?