SVI/netbird
1
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-03-31 06:34:19 -04:00
Code Issues 3.0k Packages Projects Releases 10 Wiki Activity

Running own DNS server in mesh doesnt resolve on peer running the DNS server #2024

New Issue
Open
opened 2025-11-20 06:11:26 -05:00 by saavagebueno · 4 comments
saavagebueno commented 2025-11-20 06:11:26 -05:00
Owner
Copy Link

Originally created by @da-wilky on GitHub (Jun 28, 2025).

Describe the problem
I am hosting an own DNS Nameserver inside my mesh. It is running using CoreDNS on one server of my peers. Its setup inside the netbird dashboard and it is distributed to all peers. Also an access policy allows all peers to access this peer on port 54.
The DNS Nameserver is running on port 54 so it does not interfere with the locally running DNS on port 53.

To Reproduce

  1. Host CoreDNS Server on one of your peers to distribute custom dns. (Setup inside the additional context section)
  2. Create the DNS Server inside the mesh for those domains handled by that dns server (screenshot in additional context).
  3. Create Access Policy for all peers to access the dns-hosting peer on port 54 via tcp and udp. For testing I also tried opening port 53 or allow all traffic, that didnt change anything related to that problem.
  4. nslookup one of those domains from another peer:
❯ nslookup bckp.nb.local
Server:         127.0.0.53
Address:        127.0.0.53#53

Non-authoritative answer:
Name:   bckp.nb.local
Address: 100.85.175.76
  1. nslookup from the peer hosting the dns server:
nslookup bckp.nb.local
Server:         127.0.0.153
Address:        127.0.0.153#53

** server can't find bckp.nb.local: NXDOMAIN

Specifying the server on that peer works:

nslookup -port=54 bckp.nb.local 100.85.15.129
Server:         100.85.15.129
Address:        100.85.15.129#54

Name:   bckp.nb.local
Address: 100.85.175.76

Expected behavior
Also the peer hosting the DNS Server should be able to resolve those domains via the local netbird dns resolver, when this peer is also in the distribution group.

Are you using NetBird Cloud?
self-host NetBird's control plane

NetBird version
Peer running DNS-Server: 0.47.1
Other peers not running dns server: 0.47.1 0.49.0

Is any other VPN software installed?
No

Debug output

To help us resolve the problem, please attach the following anonymized status output

netbird status -dA

The output from another peer. You can see the nameserver listed.

Peers detail:
 peer2.netbird.selfhosted:
  NetBird IP: 100.85.210.62/32
  Public key: BJjacf7HSPwCzkxFkUlFlWMBbXiFQyLzhc2z6YrBd3E=
  Status: Idle
  -- detail --
  Connection type: 
  ICE candidate (Local/Remote): -/-
  ICE candidate endpoints (Local/Remote): -/-
  Relay server address: 
  Last connection update: 10 hours, 27 minutes ago
  Last WireGuard handshake: -
  Transfer status (received/sent) 0 B/0 B
  Quantum resistance: false
  Networks: -
  Latency: 0s

 peer1.netbird.selfhosted:
  NetBird IP: 100.85.15.129
  Public key: 3i66jPC1A19DHisOyc/VPOt6jp7vhIPcNnUlWGWVcG8=
  Status: Connected
  -- detail --
  Connection type: P2P
  ICE candidate (Local/Remote): srflx/host
  ICE candidate endpoints (Local/Remote): 198.51.100.0:51820/198.51.100.1:51820
  Relay server address: 
  Last connection update: 20 hours, 38 minutes ago
  Last WireGuard handshake: 1 minute, 24 seconds ago
  Transfer status (received/sent) 7.6 MiB/16.1 MiB
  Quantum resistance: false
  Networks: -
  Latency: 6.867441ms

 peer3.netbird.selfhosted:
  NetBird IP: 100.85.26.155
  Public key: qXy69ZUHM8IQJIapY/5z54AGTa2UyXPSefDISbzyByA=
  Status: Connected
  -- detail --
  Connection type: P2P
  ICE candidate (Local/Remote): srflx/srflx
  ICE candidate endpoints (Local/Remote): 198.51.100.0:51820/198.51.100.2:27872
  Relay server address: 
  Last connection update: 1 hour, 2 minutes ago
  Last WireGuard handshake: 53 seconds ago
  Transfer status (received/sent) 871.2 KiB/2.5 MiB
  Quantum resistance: false
  Networks: -
  Latency: 23.176815ms

 peer4.netbird.selfhosted:
  NetBird IP: 100.85.175.76
  Public key: MvDBVV63GFtK+MdEy3lV9/73Fuw5eUaRmNfQTMEi3DQ=
  Status: Connected
  -- detail --
  Connection type: P2P
  ICE candidate (Local/Remote): srflx/prflx
  ICE candidate endpoints (Local/Remote): 198.51.100.0:51820/198.51.100.2:28522
  Relay server address: 
  Last connection update: 16 hours, 9 minutes ago
  Last WireGuard handshake: 2 minutes, 1 seconds ago
  Transfer status (received/sent) 35.0 MiB/333.6 MiB
  Quantum resistance: false
  Networks: -
  Latency: 27.165588ms

Events:
  [WARNING] DNS (1dd74cb1-06f4-4d99-b1cb-406fe336f31c)
    Message: All upstream servers failed (probe failed)
    Time: 20 hours, 58 minutes ago
    Metadata: upstreams: 100.85.15.129:54
  [WARNING] DNS (c6f81e62-39f8-4cf6-b6c5-5c3277025d32)
    Message: All upstream servers failed (probe failed)
    Time: 20 hours, 58 minutes ago
    Metadata: upstreams: 100.85.15.129:54
  [WARNING] DNS (632aa5c5-a544-4359-8f90-b395fe6cd8fe)
    Message: All upstream servers failed (probe failed)
    Time: 20 hours, 58 minutes ago
    Metadata: upstreams: 100.85.15.129:54
  [WARNING] DNS (3d04a2b3-73a6-416a-8240-d4b3453d098e)
    Message: All upstream servers failed (probe failed)
    Time: 20 hours, 58 minutes ago
    Metadata: upstreams: 100.85.15.129:54
  [INFO] SYSTEM (69c8c7e1-a0b8-4415-8fe7-9da469d42d9e)
    Message: Network map updated
    Time: 20 hours, 58 minutes ago
  [INFO] SYSTEM (03e65fdd-c54d-445d-bb49-aa67adb50211)
    Message: Network map updated
    Time: 17 hours, 8 minutes ago
  [INFO] SYSTEM (0b61ed90-19e7-4f66-a768-5414de556dc3)
    Message: Network map updated
    Time: 17 hours, 5 minutes ago
  [INFO] SYSTEM (02edc424-12d8-40eb-963c-a6afadca4d91)
    Message: Network map updated
    Time: 10 hours, 57 minutes ago
  [INFO] SYSTEM (17dba5c0-641b-4746-bb61-5c1eb9f0584b)
    Message: Network map updated
    Time: 10 hours, 27 minutes ago
OS: linux/amd64
Daemon version: 0.49.0
CLI version: 0.49.0
Management: Connected to https://netbird.anon-N8awN.domain:443
Signal: Connected to https://netbird.anon-N8awN.domain:443
Relays: 
  [stun:netbird.anon-N8awN.domain:3478] is Available
  [turn:netbird.anon-N8awN.domain:3478?transport=udp] is Available
Nameservers: 
  [1.1.1.1:53, 1.0.0.1:53] for [.] is Available
  [100.85.15.129:54] for [vault.anon-Qkfy5.domain, pic.anon-Qkfy5.domain, bckp.anon-Qkfy5.domain, dns.anon-Qkfy5.domain] is Available
FQDN: peer5.netbird.selfhosted
NetBird IP: 100.85.4.113/16
Interface type: Kernel
Quantum resistance: false
Lazy connection: false
Networks: -
Forwarding rules: 0
Peers count: 3/4 Connected

The output from the dns-server hosting peer. You can see the nameserver is missing here.

Peers detail:
 peer2.netbird.selfhosted:
  NetBird IP: 100.85.210.62/32
  Public key: BJjacf7HSPwCzkxFkUlFlWMBbXiFQyLzhc2z6YrBd3E=
  Status: Idle
  -- detail --
  Connection type: 
  ICE candidate (Local/Remote): -/-
  ICE candidate endpoints (Local/Remote): -/-
  Relay server address: 
  Last connection update: 10 hours, 29 minutes ago
  Last WireGuard handshake: -
  Transfer status (received/sent) 0 B/0 B
  Quantum resistance: false
  Networks: -
  Latency: 0s

 peer5.netbird.selfhosted:
  NetBird IP: 100.85.4.113
  Public key: De9Eqq4hqP7xAZoYOo/x4mOQQp0MSTYT474XkP2/EUs=
  Status: Connected
  -- detail --
  Connection type: P2P
  ICE candidate (Local/Remote): srflx/prflx
  ICE candidate endpoints (Local/Remote): 198.51.100.0:51820/198.51.100.1:51820
  Relay server address: 
  Last connection update: 20 hours, 40 minutes ago
  Last WireGuard handshake: 1 minute, 56 seconds ago
  Transfer status (received/sent) 16.0 MiB/7.6 MiB
  Quantum resistance: false
  Networks: -
  Latency: 6.471122ms

 peer3.netbird.selfhosted:
  NetBird IP: 100.85.26.155
  Public key: qXy69ZUHM8IQJIapY/5z54AGTa2UyXPSefDISbzyByA=
  Status: Connected
  -- detail --
  Connection type: P2P
  ICE candidate (Local/Remote): srflx/srflx
  ICE candidate endpoints (Local/Remote): 198.51.100.0:51820/198.51.100.2:27872
  Relay server address: 
  Last connection update: 1 hour, 5 minutes ago
  Last WireGuard handshake: 1 minute, 14 seconds ago
  Transfer status (received/sent) 615.2 KiB/2.4 MiB
  Quantum resistance: false
  Networks: -
  Latency: 20.656522ms

 peer4.netbird.selfhosted:
  NetBird IP: 100.85.175.76
  Public key: MvDBVV63GFtK+MdEy3lV9/73Fuw5eUaRmNfQTMEi3DQ=
  Status: Connected
  -- detail --
  Connection type: P2P
  ICE candidate (Local/Remote): srflx/prflx
  ICE candidate endpoints (Local/Remote): 198.51.100.0:51820/198.51.100.2:28522
  Relay server address: 
  Last connection update: 16 hours, 12 minutes ago
  Last WireGuard handshake: 1 minute, 30 seconds ago
  Transfer status (received/sent) 4.0 MiB/31.2 MiB
  Quantum resistance: false
  Networks: -
  Latency: 20.243701ms

 peer5.netbird.selfhosted:
  NetBird IP: 100.85.192.163
  Public key: 31zTks+NyPpA0UmmYU30KeSwu0HkrOqeAMBk7lZzpyg=
  Status: Connected
  -- detail --
  Connection type: P2P
  ICE candidate (Local/Remote): host/prflx
  ICE candidate endpoints (Local/Remote): 198.51.100.0:51820/198.51.100.3:51820
  Relay server address: 
  Last connection update: 35 minutes, 22 seconds ago
  Last WireGuard handshake: 10 seconds ago
  Transfer status (received/sent) 5.8 MiB/1.4 MiB
  Quantum resistance: false
  Networks: -
  Latency: 6.904414ms

 peer6.netbird.selfhosted:
  NetBird IP: 100.85.215.72
  Public key: IIOJuuohc0qTp8WjFjHdr3eENJo0LxPHYzec2OY+WVQ=
  Status: Connecting
  -- detail --
  Connection type: 
  ICE candidate (Local/Remote): -/-
  ICE candidate endpoints (Local/Remote): -/-
  Relay server address: 
  Last connection update: 20 hours, 40 minutes ago
  Last WireGuard handshake: -
  Transfer status (received/sent) 0 B/0 B
  Quantum resistance: false
  Networks: -
  Latency: 0s

 peer7.netbird.selfhosted:
  NetBird IP: 100.85.224.38
  Public key: Qfd7JSDbc0emYQdKigHWO9jzQYunzsPEI8ONq9caNEo=
  Status: Connecting
  -- detail --
  Connection type: 
  ICE candidate (Local/Remote): -/-
  ICE candidate endpoints (Local/Remote): -/-
  Relay server address: 
  Last connection update: 16 hours, 54 minutes ago
  Last WireGuard handshake: -
  Transfer status (received/sent) 0 B/0 B
  Quantum resistance: false
  Networks: -
  Latency: 45.54084ms

Events:
  [INFO] SYSTEM (1c278d56-8919-4677-a4b4-99011615392b)
    Message: Network map updated
    Time: 20 hours, 40 minutes ago
  [INFO] SYSTEM (bf17b5af-6c10-4b2a-8079-74416c37f6f3)
    Message: Network map updated
    Time: 17 hours, 10 minutes ago
  [INFO] SYSTEM (82968507-f6f5-47a5-abbc-41a5e4cdd1b7)
    Message: Network map updated
    Time: 17 hours, 7 minutes ago
  [INFO] SYSTEM (4471cbf0-33b0-411b-a450-0613146f221e)
    Message: Network map updated
    Time: 11 hours ago
  [INFO] SYSTEM (e955b9b3-bada-4f42-8e69-0f37d1096060)
    Message: Network map updated
    Time: 10 hours, 29 minutes ago
OS: linux/amd64
Daemon version: 0.47.1
CLI version: 0.47.1
Management: Connected to https://netbird.anon-KbkAh.domain:443
Signal: Connected to https://netbird.anon-KbkAh.domain:443
Relays: 
  [stun:netbird.anon-KbkAh.domain:3478] is Available
  [turn:netbird.anon-KbkAh.domain:3478?transport=udp] is Available
Nameservers: 
  [1.1.1.1:53, 1.0.0.1:53] for [.] is Available
FQDN: peer1.netbird.selfhosted
NetBird IP: 100.85.15.129/16
Interface type: Kernel
Quantum resistance: false
Lazy connection: false
Networks: -
Forwarding rules: 0
Peers count: 4/7 Connected

Create and upload a debug bundle, and share the returned file key:

netbird debug for 1m -AS -U

d2b6d9400b330f2f3f7cb1f86bb3c9977c4191ac7fbf26ec6335f09e742dbb96/36c7fab6-d112-48a4-a073-d58db63bb1f2

Uploaded files are automatically deleted after 30 days.

Screenshots

Image

Additional context

Corefile:

nb.local:54 {
    file /zones/nb.local.zone nb.local.

    log
    errors
}

nb.local.zone:

$ORIGIN nb.local.
$TTL 60

@       IN  SOA     ns.nb.local. admin.nb.local. (
                2025041201 ; serial
                3600       ; refresh
                1800       ; retry
                604800     ; expire
                60         ; minimum
)

        IN  NS      ns.nb.local.

ns              IN  A       100.85.15.129

bckp            IN  A       100.85.175.76 
vault           IN  CNAME   bckp
pic             IN  CNAME   bckp
dns             IN  CNAME   bckp

docker-compose.yml:

services:
  coredns:
    image: coredns/coredns:latest
    ports:
      - "100.85.15.129:54:54/udp"
      - "100.85.15.129:54:54/tcp"
    volumes:
      - ./Corefile:/Corefile:ro
      - ./zones:/zones:ro
    restart: unless-stopped

Have you tried these troubleshooting steps?

  • Reviewed client troubleshooting (if applicable)
  • Checked for newer NetBird versions
  • Searched for similar issues on GitHub (including closed ones)
  • Restarted the NetBird client
  • Disabled other VPN software
  • Checked firewall settings
Originally created by @da-wilky on GitHub (Jun 28, 2025). **Describe the problem** I am hosting an own DNS Nameserver inside my mesh. It is running using CoreDNS on one server of my peers. Its setup inside the netbird dashboard and it is distributed to all peers. Also an access policy allows all peers to access this peer on port 54. The DNS Nameserver is running on port 54 so it does not interfere with the locally running DNS on port 53. **To Reproduce** 1. Host CoreDNS Server on one of your peers to distribute custom dns. (Setup inside the additional context section) 2. Create the DNS Server inside the mesh for those domains handled by that dns server (screenshot in additional context). 3. Create Access Policy for all peers to access the dns-hosting peer on port 54 via tcp and udp. For testing I also tried opening port 53 or allow all traffic, that didnt change anything related to that problem. 4. nslookup one of those domains from another peer: ``` ❯ nslookup bckp.nb.local Server: 127.0.0.53 Address: 127.0.0.53#53 Non-authoritative answer: Name: bckp.nb.local Address: 100.85.175.76 ``` 5. nslookup from the peer hosting the dns server: ``` nslookup bckp.nb.local Server: 127.0.0.153 Address: 127.0.0.153#53 ** server can't find bckp.nb.local: NXDOMAIN ``` Specifying the server on that peer works: ``` nslookup -port=54 bckp.nb.local 100.85.15.129 Server: 100.85.15.129 Address: 100.85.15.129#54 Name: bckp.nb.local Address: 100.85.175.76 ``` **Expected behavior** Also the peer hosting the DNS Server should be able to resolve those domains via the local netbird dns resolver, when this peer is also in the distribution group. **Are you using NetBird Cloud?** self-host NetBird's control plane **NetBird version** Peer running DNS-Server: 0.47.1 Other peers not running dns server: 0.47.1 0.49.0 **Is any other VPN software installed?** No **Debug output** To help us resolve the problem, please attach the following anonymized status output netbird status -dA The output from another peer. You can see the nameserver listed. ``` Peers detail: peer2.netbird.selfhosted: NetBird IP: 100.85.210.62/32 Public key: BJjacf7HSPwCzkxFkUlFlWMBbXiFQyLzhc2z6YrBd3E= Status: Idle -- detail -- Connection type: ICE candidate (Local/Remote): -/- ICE candidate endpoints (Local/Remote): -/- Relay server address: Last connection update: 10 hours, 27 minutes ago Last WireGuard handshake: - Transfer status (received/sent) 0 B/0 B Quantum resistance: false Networks: - Latency: 0s peer1.netbird.selfhosted: NetBird IP: 100.85.15.129 Public key: 3i66jPC1A19DHisOyc/VPOt6jp7vhIPcNnUlWGWVcG8= Status: Connected -- detail -- Connection type: P2P ICE candidate (Local/Remote): srflx/host ICE candidate endpoints (Local/Remote): 198.51.100.0:51820/198.51.100.1:51820 Relay server address: Last connection update: 20 hours, 38 minutes ago Last WireGuard handshake: 1 minute, 24 seconds ago Transfer status (received/sent) 7.6 MiB/16.1 MiB Quantum resistance: false Networks: - Latency: 6.867441ms peer3.netbird.selfhosted: NetBird IP: 100.85.26.155 Public key: qXy69ZUHM8IQJIapY/5z54AGTa2UyXPSefDISbzyByA= Status: Connected -- detail -- Connection type: P2P ICE candidate (Local/Remote): srflx/srflx ICE candidate endpoints (Local/Remote): 198.51.100.0:51820/198.51.100.2:27872 Relay server address: Last connection update: 1 hour, 2 minutes ago Last WireGuard handshake: 53 seconds ago Transfer status (received/sent) 871.2 KiB/2.5 MiB Quantum resistance: false Networks: - Latency: 23.176815ms peer4.netbird.selfhosted: NetBird IP: 100.85.175.76 Public key: MvDBVV63GFtK+MdEy3lV9/73Fuw5eUaRmNfQTMEi3DQ= Status: Connected -- detail -- Connection type: P2P ICE candidate (Local/Remote): srflx/prflx ICE candidate endpoints (Local/Remote): 198.51.100.0:51820/198.51.100.2:28522 Relay server address: Last connection update: 16 hours, 9 minutes ago Last WireGuard handshake: 2 minutes, 1 seconds ago Transfer status (received/sent) 35.0 MiB/333.6 MiB Quantum resistance: false Networks: - Latency: 27.165588ms Events: [WARNING] DNS (1dd74cb1-06f4-4d99-b1cb-406fe336f31c) Message: All upstream servers failed (probe failed) Time: 20 hours, 58 minutes ago Metadata: upstreams: 100.85.15.129:54 [WARNING] DNS (c6f81e62-39f8-4cf6-b6c5-5c3277025d32) Message: All upstream servers failed (probe failed) Time: 20 hours, 58 minutes ago Metadata: upstreams: 100.85.15.129:54 [WARNING] DNS (632aa5c5-a544-4359-8f90-b395fe6cd8fe) Message: All upstream servers failed (probe failed) Time: 20 hours, 58 minutes ago Metadata: upstreams: 100.85.15.129:54 [WARNING] DNS (3d04a2b3-73a6-416a-8240-d4b3453d098e) Message: All upstream servers failed (probe failed) Time: 20 hours, 58 minutes ago Metadata: upstreams: 100.85.15.129:54 [INFO] SYSTEM (69c8c7e1-a0b8-4415-8fe7-9da469d42d9e) Message: Network map updated Time: 20 hours, 58 minutes ago [INFO] SYSTEM (03e65fdd-c54d-445d-bb49-aa67adb50211) Message: Network map updated Time: 17 hours, 8 minutes ago [INFO] SYSTEM (0b61ed90-19e7-4f66-a768-5414de556dc3) Message: Network map updated Time: 17 hours, 5 minutes ago [INFO] SYSTEM (02edc424-12d8-40eb-963c-a6afadca4d91) Message: Network map updated Time: 10 hours, 57 minutes ago [INFO] SYSTEM (17dba5c0-641b-4746-bb61-5c1eb9f0584b) Message: Network map updated Time: 10 hours, 27 minutes ago OS: linux/amd64 Daemon version: 0.49.0 CLI version: 0.49.0 Management: Connected to https://netbird.anon-N8awN.domain:443 Signal: Connected to https://netbird.anon-N8awN.domain:443 Relays: [stun:netbird.anon-N8awN.domain:3478] is Available [turn:netbird.anon-N8awN.domain:3478?transport=udp] is Available Nameservers: [1.1.1.1:53, 1.0.0.1:53] for [.] is Available [100.85.15.129:54] for [vault.anon-Qkfy5.domain, pic.anon-Qkfy5.domain, bckp.anon-Qkfy5.domain, dns.anon-Qkfy5.domain] is Available FQDN: peer5.netbird.selfhosted NetBird IP: 100.85.4.113/16 Interface type: Kernel Quantum resistance: false Lazy connection: false Networks: - Forwarding rules: 0 Peers count: 3/4 Connected ``` The output from the dns-server hosting peer. You can see the nameserver is missing here. ``` Peers detail: peer2.netbird.selfhosted: NetBird IP: 100.85.210.62/32 Public key: BJjacf7HSPwCzkxFkUlFlWMBbXiFQyLzhc2z6YrBd3E= Status: Idle -- detail -- Connection type: ICE candidate (Local/Remote): -/- ICE candidate endpoints (Local/Remote): -/- Relay server address: Last connection update: 10 hours, 29 minutes ago Last WireGuard handshake: - Transfer status (received/sent) 0 B/0 B Quantum resistance: false Networks: - Latency: 0s peer5.netbird.selfhosted: NetBird IP: 100.85.4.113 Public key: De9Eqq4hqP7xAZoYOo/x4mOQQp0MSTYT474XkP2/EUs= Status: Connected -- detail -- Connection type: P2P ICE candidate (Local/Remote): srflx/prflx ICE candidate endpoints (Local/Remote): 198.51.100.0:51820/198.51.100.1:51820 Relay server address: Last connection update: 20 hours, 40 minutes ago Last WireGuard handshake: 1 minute, 56 seconds ago Transfer status (received/sent) 16.0 MiB/7.6 MiB Quantum resistance: false Networks: - Latency: 6.471122ms peer3.netbird.selfhosted: NetBird IP: 100.85.26.155 Public key: qXy69ZUHM8IQJIapY/5z54AGTa2UyXPSefDISbzyByA= Status: Connected -- detail -- Connection type: P2P ICE candidate (Local/Remote): srflx/srflx ICE candidate endpoints (Local/Remote): 198.51.100.0:51820/198.51.100.2:27872 Relay server address: Last connection update: 1 hour, 5 minutes ago Last WireGuard handshake: 1 minute, 14 seconds ago Transfer status (received/sent) 615.2 KiB/2.4 MiB Quantum resistance: false Networks: - Latency: 20.656522ms peer4.netbird.selfhosted: NetBird IP: 100.85.175.76 Public key: MvDBVV63GFtK+MdEy3lV9/73Fuw5eUaRmNfQTMEi3DQ= Status: Connected -- detail -- Connection type: P2P ICE candidate (Local/Remote): srflx/prflx ICE candidate endpoints (Local/Remote): 198.51.100.0:51820/198.51.100.2:28522 Relay server address: Last connection update: 16 hours, 12 minutes ago Last WireGuard handshake: 1 minute, 30 seconds ago Transfer status (received/sent) 4.0 MiB/31.2 MiB Quantum resistance: false Networks: - Latency: 20.243701ms peer5.netbird.selfhosted: NetBird IP: 100.85.192.163 Public key: 31zTks+NyPpA0UmmYU30KeSwu0HkrOqeAMBk7lZzpyg= Status: Connected -- detail -- Connection type: P2P ICE candidate (Local/Remote): host/prflx ICE candidate endpoints (Local/Remote): 198.51.100.0:51820/198.51.100.3:51820 Relay server address: Last connection update: 35 minutes, 22 seconds ago Last WireGuard handshake: 10 seconds ago Transfer status (received/sent) 5.8 MiB/1.4 MiB Quantum resistance: false Networks: - Latency: 6.904414ms peer6.netbird.selfhosted: NetBird IP: 100.85.215.72 Public key: IIOJuuohc0qTp8WjFjHdr3eENJo0LxPHYzec2OY+WVQ= Status: Connecting -- detail -- Connection type: ICE candidate (Local/Remote): -/- ICE candidate endpoints (Local/Remote): -/- Relay server address: Last connection update: 20 hours, 40 minutes ago Last WireGuard handshake: - Transfer status (received/sent) 0 B/0 B Quantum resistance: false Networks: - Latency: 0s peer7.netbird.selfhosted: NetBird IP: 100.85.224.38 Public key: Qfd7JSDbc0emYQdKigHWO9jzQYunzsPEI8ONq9caNEo= Status: Connecting -- detail -- Connection type: ICE candidate (Local/Remote): -/- ICE candidate endpoints (Local/Remote): -/- Relay server address: Last connection update: 16 hours, 54 minutes ago Last WireGuard handshake: - Transfer status (received/sent) 0 B/0 B Quantum resistance: false Networks: - Latency: 45.54084ms Events: [INFO] SYSTEM (1c278d56-8919-4677-a4b4-99011615392b) Message: Network map updated Time: 20 hours, 40 minutes ago [INFO] SYSTEM (bf17b5af-6c10-4b2a-8079-74416c37f6f3) Message: Network map updated Time: 17 hours, 10 minutes ago [INFO] SYSTEM (82968507-f6f5-47a5-abbc-41a5e4cdd1b7) Message: Network map updated Time: 17 hours, 7 minutes ago [INFO] SYSTEM (4471cbf0-33b0-411b-a450-0613146f221e) Message: Network map updated Time: 11 hours ago [INFO] SYSTEM (e955b9b3-bada-4f42-8e69-0f37d1096060) Message: Network map updated Time: 10 hours, 29 minutes ago OS: linux/amd64 Daemon version: 0.47.1 CLI version: 0.47.1 Management: Connected to https://netbird.anon-KbkAh.domain:443 Signal: Connected to https://netbird.anon-KbkAh.domain:443 Relays: [stun:netbird.anon-KbkAh.domain:3478] is Available [turn:netbird.anon-KbkAh.domain:3478?transport=udp] is Available Nameservers: [1.1.1.1:53, 1.0.0.1:53] for [.] is Available FQDN: peer1.netbird.selfhosted NetBird IP: 100.85.15.129/16 Interface type: Kernel Quantum resistance: false Lazy connection: false Networks: - Forwarding rules: 0 Peers count: 4/7 Connected ``` Create and upload a debug bundle, and share the returned file key: netbird debug for 1m -AS -U d2b6d9400b330f2f3f7cb1f86bb3c9977c4191ac7fbf26ec6335f09e742dbb96/36c7fab6-d112-48a4-a073-d58db63bb1f2 *Uploaded files are automatically deleted after 30 days.* **Screenshots** ![Image](https://github.com/user-attachments/assets/fcc2db69-53bb-44d3-81e4-8d6b1752c59c) **Additional context** **Corefile:** ``` nb.local:54 { file /zones/nb.local.zone nb.local. log errors } ``` **nb.local.zone:** ``` $ORIGIN nb.local. $TTL 60 @ IN SOA ns.nb.local. admin.nb.local. ( 2025041201 ; serial 3600 ; refresh 1800 ; retry 604800 ; expire 60 ; minimum ) IN NS ns.nb.local. ns IN A 100.85.15.129 bckp IN A 100.85.175.76 vault IN CNAME bckp pic IN CNAME bckp dns IN CNAME bckp ``` **docker-compose.yml:** ``` services: coredns: image: coredns/coredns:latest ports: - "100.85.15.129:54:54/udp" - "100.85.15.129:54:54/tcp" volumes: - ./Corefile:/Corefile:ro - ./zones:/zones:ro restart: unless-stopped ``` **Have you tried these troubleshooting steps?** - [x] Reviewed [client troubleshooting](https://docs.netbird.io/how-to/troubleshooting-client) (if applicable) - [x] Checked for newer NetBird versions - [x] Searched for similar issues on GitHub (including closed ones) - [x] Restarted the NetBird client - [ ] Disabled other VPN software - [x] Checked firewall settings
saavagebueno added the clientquestionconfig-issuedns labels 2025-11-20 06:11:26 -05:00
saavagebueno commented 2025-11-20 06:11:27 -05:00
Author
Owner
Copy Link

@mjohnson9 commented on GitHub (Jun 29, 2025):

I ran into this. I resolved (no pun intended) it by adding a second "Nameservers" entry, where the Distribution Group was set to the DNS servers, and the nameserver was 127.0.0.1.

@mjohnson9 commented on GitHub (Jun 29, 2025): I ran into this. I resolved (no pun intended) it by adding a second "Nameservers" entry, where the `Distribution Group` was set to the DNS servers, and the nameserver was `127.0.0.1`.
saavagebueno commented 2025-11-20 06:11:27 -05:00
Author
Owner
Copy Link

@da-wilky commented on GitHub (Jun 29, 2025):

I can confirm this is a proper workaround for the problem.

Adding another new nameserver with not the IP of the peer in it is working fine. You can add multiple IP:PORT nameservers to one nameserver, but as soon as there is the ip of a peer in the list, that peer doesnt receive this nameserver as resolver anymore - at least it seems like this to me.
Maybe a dev can explain if this is the intended behavior? From a usability point of view it would be nice to also pass those nameservers to those peers, so we dont need another nameserver as workaround. Also all matching domains that I want to add need to be added for both nameservers that way.

@da-wilky commented on GitHub (Jun 29, 2025): I can confirm this is a proper workaround for the problem. Adding another new nameserver with not the IP of the peer in it is working fine. You can add multiple IP:PORT nameservers to one nameserver, but as soon as there is the ip of a peer in the list, that peer doesnt receive this nameserver as resolver anymore - at least it seems like this to me. Maybe a dev can explain if this is the intended behavior? From a usability point of view it would be nice to also pass those nameservers to those peers, so we dont need another nameserver as workaround. Also all matching domains that I want to add need to be added for both nameservers that way.
saavagebueno commented 2025-11-20 06:11:27 -05:00
Author
Owner
Copy Link

@nazarewk commented on GitHub (Jun 30, 2025):

You can add multiple IP:PORT nameservers to one nameserver, but as soon as there is the ip of a peer in the list, that peer doesnt receive this nameserver as resolver anymore - at least it seems like this to me.
Maybe a dev can explain if this is the intended behavior?

I would argue that the server for its own IP address can easily get messy by overriding pieces of the operating system's configuration, making the whole solution unusable.

Nevertheless, I have asked the team for comments.

@nazarewk commented on GitHub (Jun 30, 2025): > You can add multiple IP:PORT nameservers to one nameserver, but as soon as there is the ip of a peer in the list, that peer doesnt receive this nameserver as resolver anymore - at least it seems like this to me. > Maybe a dev can explain if this is the intended behavior? I would argue that the server for its own IP address can easily get messy by overriding pieces of the operating system's configuration, making the whole solution unusable. Nevertheless, I have asked the team for comments.
saavagebueno commented 2025-11-20 06:11:28 -05:00
Author
Owner
Copy Link

@b4rgut commented on GitHub (Jul 2, 2025):

I had the same problem after updating Netbird. I am using Coredns in a Docker container with a static IP address. However, the command dig @my_dns_ip my.loc is working properly on the server and on the clients.

@b4rgut commented on GitHub (Jul 2, 2025): I had the same problem after updating Netbird. I am using Coredns in a Docker container with a static IP address. However, the command `dig @my_dns_ip my.loc` is working properly on the server and on the clients.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
2021 Q4
2022 Q1
2022 Q1
accessibility
acl
agent
agent
Android
Android
api
authentik
automation
azure
battery-usage
bug
cache
client
client-ui
cloud
cloud-only
cloudflare
community
compatibility
config-idp
config-issue
connection
contribution
coturn
cross-vpn
dashboard
data-usage
distribution
dns
docker
documentation
duplicate
enhancement
enhancement
event-stream
feature-request
freebsd
getting-started
go
good first issue
gui
help wanted
home-assistant
idp
inconsistency
integration
integrations
ios
ipv6
jwt
k8s
keycloak
linux
login
macos
management-service
missing-docs
mobile
moved-internal
needs-review
netbird-ui
networking
new-platform
nginx
notification
okta
openwrt
packaging
peer-management
peer-management
peer-management
performance
postgres
posture-checks
psk
pull-request
Mirrored from GitHub Pull Request
 question
refactor
relay
release
rfc
routes
security
security-related
self-hosting
server
signal
sleep-issue
ssh
ssl
status
store
synology
system-compatibility-issue
test-suite
third-party-integration
triage
triage-needed
troubleshooting
UX
waiting-feedback
windows
wontfix
zitadel
No Label client config-issue dns question
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
saavagebueno
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: SVI/netbird#2024
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?