SVI/netbird
1
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-08-04 19:55:09 -04:00
Code Issues 3.0k Packages Projects Releases 10 Wiki Activity

0.54.0.1 Windows Client DNS matched Domains are not resolving #2186

New Issue
Open
opened 2025-11-20 07:05:29 -05:00 by saavagebueno · 7 comments
saavagebueno commented 2025-11-20 07:05:29 -05:00
Owner
Copy Link

Originally created by @jacac on GitHub (Aug 14, 2025).

Netbird client: Windows0.54.1
Netbird Server: netbird-mgmt version 0.54.1

After successful connection to Netbird matched domains are not resolving.

Checking the registry Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient\DnsPolicyConfig\ all domains are configured.

Image

Running Get-DnsClientNrptPolicy only returns the default domain policy.

After ending the DNS Client Service Get-DnsClientNrptPolicy return all matched domains and DNS resolution starts working.
Image

Workaround

Ending the task DNS client fixes the problem until the next reconnect.

Image
Originally created by @jacac on GitHub (Aug 14, 2025). Netbird client: Windows0.54.1 Netbird Server: netbird-mgmt version 0.54.1 After successful connection to Netbird matched domains are not resolving. Checking the registry `Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient\DnsPolicyConfig\` all domains are configured. <img width="396" height="220" alt="Image" src="https://github.com/user-attachments/assets/b7eef55c-6931-481e-8212-72f428ab9137" /> Running `Get-DnsClientNrptPolicy` only returns the default domain policy. After ending the DNS Client Service `Get-DnsClientNrptPolicy` return all matched domains and DNS resolution starts working. <img width="343" height="151" alt="Image" src="https://github.com/user-attachments/assets/770d0805-1dad-4600-a1ca-e21099bf7076" /> ### Workaround Ending the task DNS client fixes the problem until the next reconnect. <img width="343" height="151" alt="Image" src="https://github.com/user-attachments/assets/770d0805-1dad-4600-a1ca-e21099bf7076" />
saavagebueno added the triage-needed label 2025-11-20 07:05:29 -05:00
saavagebueno commented 2025-11-20 07:05:30 -05:00
Author
Owner
Copy Link

@jacac commented on GitHub (Aug 23, 2025):

After more testing, the NRPT policies eventually get loaded. It varies for me between 3 and 20 minutes. Also, on a disconnect, it can take a few minutes until the policies are removed.

@jacac commented on GitHub (Aug 23, 2025): After more testing, the NRPT policies eventually get loaded. It varies for me between 3 and 20 minutes. Also, on a disconnect, it can take a few minutes until the policies are removed.
saavagebueno commented 2025-11-20 07:05:30 -05:00
Author
Owner
Copy Link

@jacac commented on GitHub (Aug 25, 2025):

It seems that Netbird does not notify Name Resolution Policy client about the registry changes.

https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-gpnrpt/2547a7f3-3b7f-46a2-b8be-4789686f8379

On number 3 it points out that the after changing the registry the Name Resolution Policy client component needs to be notified. I could not find anywhere how this can be done manually.

@jacac commented on GitHub (Aug 25, 2025): It seems that Netbird does not notify `Name Resolution Policy client` about the registry changes. https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-gpnrpt/2547a7f3-3b7f-46a2-b8be-4789686f8379 On number 3 it points out that the after changing the registry the `Name Resolution Policy client component` needs to be notified. I could not find anywhere how this can be done manually.
saavagebueno commented 2025-11-20 07:05:30 -05:00
Author
Owner
Copy Link

@jacac commented on GitHub (Aug 29, 2025):

I've disabled our DNS GPO temporarily and deleted the Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient\DnsPolicyConfig key.

Get-DnsClientNrptPolicy records are loaded now within a few seconds after connecting.

@jacac commented on GitHub (Aug 29, 2025): I've disabled our DNS GPO temporarily and deleted the `Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient\DnsPolicyConfig` key. `Get-DnsClientNrptPolicy` records are loaded now within a few seconds after connecting.
saavagebueno commented 2025-11-20 07:05:30 -05:00
Author
Owner
Copy Link

@OnlyFreshMeat commented on GitHub (Sep 10, 2025):

I have the same problem
Netbird Server: netbird-mgmt version 0.56.1
Netbird tested clients: Windows 0.56.1 // 0.54 // 0.53
My solution was to remove 'match domain' and set it to 'ALL'. Luckily, I only have 1 domain

@OnlyFreshMeat commented on GitHub (Sep 10, 2025): I have the same problem Netbird Server: netbird-mgmt version 0.56.1 Netbird tested clients: Windows 0.56.1 // 0.54 // 0.53 My solution was to remove 'match domain' and set it to 'ALL'. Luckily, I only have 1 domain
saavagebueno commented 2025-11-20 07:05:31 -05:00
Author
Owner
Copy Link

@PeakeIT commented on GitHub (Sep 17, 2025):

Same problem.
Netbird Server: Netbird Cloud.
Netbird tested clients: 0.57.1 and 0.56.1 - and many previous versions so I don't know when it started.

Get-DnsClientNrptPolicy returns nothing until I kill the DNS Client process and after it automatically restarts the expected entries are there.

@PeakeIT commented on GitHub (Sep 17, 2025): Same problem. Netbird Server: Netbird Cloud. Netbird tested clients: 0.57.1 and 0.56.1 - and many previous versions so I don't know when it started. Get-DnsClientNrptPolicy returns nothing until I kill the DNS Client process and after it automatically restarts the expected entries are there.
saavagebueno commented 2025-11-20 07:05:31 -05:00
Author
Owner
Copy Link

@jacac commented on GitHub (Oct 10, 2025):

Like many others I've switched to resolve all domains. It is not ideal but the 15 minutes time delay before DNS starts to work was not acceptable for us.

@jacac commented on GitHub (Oct 10, 2025): Like many others I've switched to resolve `all domains`. It is not ideal but the 15 minutes time delay before DNS starts to work was not acceptable for us.
saavagebueno commented 2025-11-20 07:05:31 -05:00
Author
Owner
Copy Link

@OnlyFreshMeat commented on GitHub (Oct 27, 2025):

This issue is now causing a problem in another case.
Let's say there is a domain "*.custom.com" that is restricted to my IP address. I have a Network with "*.custom.com" and with a routing peer inside my network. On macOS, iOS, and Android everything works, but on Windows I need to stop the DNS Client process.

Is it possible to configure Netbird so that when connecting and disconnectins, it executes:
$service = Get-WmiObject Win32_Service -Filter "Name='Dnscache'"
Stop-Process -Id $service.ProcessId -Force

(Searching for and stopping the process named "dnscache")

@OnlyFreshMeat commented on GitHub (Oct 27, 2025): This issue is now causing a problem in another case. Let's say there is a domain _"*.custom.com"_ that is restricted to my IP address. I have a Network with _"*.custom.com"_ and with a routing peer inside my network. On macOS, iOS, and Android everything works, but on Windows I need to stop the DNS Client process. Is it possible to configure Netbird so that when connecting and disconnectins, it executes: $service = Get-WmiObject Win32_Service -Filter "Name='Dnscache'" Stop-Process -Id $service.ProcessId -Force (Searching for and stopping the process named "dnscache")
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
2021 Q4
2022 Q1
2022 Q1
accessibility
acl
agent
agent
Android
Android
api
authentik
automation
azure
battery-usage
bug
cache
client
client-ui
cloud
cloud-only
cloudflare
community
compatibility
config-idp
config-issue
connection
contribution
coturn
cross-vpn
dashboard
data-usage
distribution
dns
docker
documentation
duplicate
enhancement
enhancement
event-stream
feature-request
freebsd
getting-started
go
good first issue
gui
help wanted
home-assistant
idp
inconsistency
integration
integrations
ios
ipv6
jwt
k8s
keycloak
linux
login
macos
management-service
missing-docs
mobile
moved-internal
needs-review
netbird-ui
networking
new-platform
nginx
notification
okta
openwrt
packaging
peer-management
peer-management
peer-management
performance
postgres
posture-checks
psk
pull-request
Mirrored from GitHub Pull Request
 question
refactor
relay
release
rfc
routes
security
security-related
self-hosting
server
signal
sleep-issue
ssh
ssl
status
store
synology
system-compatibility-issue
test-suite
third-party-integration
triage
triage-needed
troubleshooting
UX
waiting-feedback
windows
wontfix
zitadel
No Label triage-needed
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
saavagebueno
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: SVI/netbird#2186
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?