SVI/netbird
1
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-06-10 09:22:09 -04:00
Code Issues 3.0k Packages Projects Releases 10 Wiki Activity

Netbird local DNS resolver problem #2213

New Issue
Open
opened 2025-11-20 07:05:58 -05:00 by saavagebueno · 4 comments
saavagebueno commented 2025-11-20 07:05:58 -05:00
Owner
Copy Link

Originally created by @Mordi33 on GitHub (Aug 21, 2025).

Hello everyone,

I use a nameserver to resolve DNS requests from all Netbird agents.
On Netbird agent we have the 100.127.255.254 DNS on our wt0 network card (I understood on another issue that it is the local DNS resolver used by Netbird to reduce the charge of requests on the network).
Sometimes we identify a mistake with this feature. The DNS responds with a bad IP but our DNS server knows the correct.
All devices are not affected at the same time, and some devices are not affected by this problem.

Last week, we migrated an asset from site A to site B.
On site A we have the range 172.100x.x and 172.16.x.x on site B.
We updated the IP of this asset on our DNS server.
80% of Netbird agents received the update correctly
=> nslookup asset.mycompany.com
=> return the new IP (site B range)
20% of Netbird agents did not receive the update
=> nslookup asset.mycompany.com
=> return the old IP (site A range)

I have the problem with my computer so I have realised a lot of tests.

  • Disconnect/Reconnect Netbird agent => KO
  • Exit and launch again Netbird agent => KO
  • Execute the "ipconfig /flushdns" command => KO
  • Disable my network card => KO
  • Restart my computer => KO
  • Update my agent to the last version (0.55.1) => KO

I discovered a PowerShell command to test the resolve URL from a specific DNS server.
Resolve-DnsName -Name asset.mycompany.com -Server My_DNS_Server
Name Type TTL Section IPAddress
asset.mycompany.com A 3600 Answer Site_B_Range

Resolve-DnsName -Name asset.mycompany.com -Server 100.127.255.254
Name Type TTL Section IPAddress
asset.mycompany.com A 3600 Answer Site_A_Range (the old !)

My netbird agent configuration is good : (netbird status -d)

[INFO] SYSTEM (881668c2-ec32-4440-a3f8-c1520d603c6b)
Message: Network map updated
Time: 8 seconds ago
OS: windows/amd64
Daemon version: 0.55.1
CLI version: 0.55.1
Profile: default
Management: Connected to https://netbird.mycompany.com:443
Signal: Connected to https://netbird.mycompany.com:443
Relays:
[stun:netbird.mycompany.com:3478] is Available
[turn:netbird.mycompany.com:3478?transport=udp] is Available
[rels://netbird.mycompany.com:443] is Available
Nameservers:
[My_DNS_Server:53] for [.] is Available
FQDN: bdx-tog-016-163-2.netbird.vpn
NetBird IP: 100.127.163.2/16
Interface type: Userspace

Thank a lot for your answer,
Cédric

Originally created by @Mordi33 on GitHub (Aug 21, 2025). Hello everyone, I use a nameserver to resolve DNS requests from all Netbird agents. On Netbird agent we have the 100.127.255.254 DNS on our wt0 network card (I understood on another issue that it is the local DNS resolver used by Netbird to reduce the charge of requests on the network). Sometimes we identify a mistake with this feature. The DNS responds with a bad IP but our DNS server knows the correct. All devices are not affected at the same time, and some devices are not affected by this problem. Last week, we migrated an asset from site A to site B. On site A we have the range 172.100x.x and 172.16.x.x on site B. We updated the IP of this asset on our DNS server. 80% of Netbird agents received the update correctly => nslookup asset.mycompany.com => return the new IP (site B range) 20% of Netbird agents did not receive the update => nslookup asset.mycompany.com => return the old IP (site A range) I have the problem with my computer so I have realised a lot of tests. - Disconnect/Reconnect Netbird agent => KO - Exit and launch again Netbird agent => KO - Execute the "ipconfig /flushdns" command => KO - Disable my network card => KO - Restart my computer => KO - Update my agent to the last version (0.55.1) => KO I discovered a PowerShell command to test the resolve URL from a specific DNS server. Resolve-DnsName -Name asset.mycompany.com -Server My_DNS_Server Name Type TTL Section IPAddress asset.mycompany.com A 3600 Answer Site_B_Range Resolve-DnsName -Name asset.mycompany.com -Server 100.127.255.254 Name Type TTL Section IPAddress asset.mycompany.com A 3600 Answer Site_A_Range (the old !) My netbird agent configuration is good : (netbird status -d) > [INFO] SYSTEM (881668c2-ec32-4440-a3f8-c1520d603c6b) > Message: Network map updated > Time: 8 seconds ago > OS: windows/amd64 > Daemon version: 0.55.1 > CLI version: 0.55.1 > Profile: default > Management: Connected to https://netbird.mycompany.com:443 > Signal: Connected to https://netbird.mycompany.com:443 > Relays: > [stun:netbird.mycompany.com:3478] is Available > [turn:netbird.mycompany.com:3478?transport=udp] is Available > [rels://netbird.mycompany.com:443] is Available > Nameservers: > [My_DNS_Server:53] for [.] is Available > FQDN: bdx-tog-016-163-2.netbird.vpn > NetBird IP: 100.127.163.2/16 > Interface type: Userspace Thank a lot for your answer, Cédric
saavagebueno added the triage-needed label 2025-11-20 07:05:58 -05:00
saavagebueno commented 2025-11-20 07:05:59 -05:00
Author
Owner
Copy Link

@allastornin commented on GitHub (Sep 1, 2025):

I've encountered the same problem. We use a self-hosted system.

We've tried all of the above.

Additionally, when I use nslookup, I occasionally receive a time-out response from DNS 100.127.255.254.

@allastornin commented on GitHub (Sep 1, 2025): I've encountered the same problem. We use a self-hosted system. We've tried all of the above. Additionally, when I use nslookup, I occasionally receive a time-out response from DNS 100.127.255.254.
saavagebueno commented 2025-11-20 07:06:00 -05:00
Author
Owner
Copy Link

@Mordi33 commented on GitHub (Sep 30, 2025):

Hi,
Nobody have an idea for my problem ?
We meet this sometime from Windows and Mac OS.
Thanks a lot,
Regards

@Mordi33 commented on GitHub (Sep 30, 2025): Hi, Nobody have an idea for my problem ? We meet this sometime from Windows and Mac OS. Thanks a lot, Regards
saavagebueno commented 2025-11-20 07:06:00 -05:00
Author
Owner
Copy Link

@pdsccode commented on GitHub (Nov 14, 2025):

I had the same issue while building our network last week. Some devices did not catch newly added resources/services to our DNS server. What did help for me was disabling and enabling the nameserver entry in the Netbird manager. After that, it seems to have rebuild the local dns cache and everything was correctly reachable.

@pdsccode commented on GitHub (Nov 14, 2025): I had the same issue while building our network last week. Some devices did not catch newly added resources/services to our DNS server. What did help for me was disabling and enabling the nameserver entry in the Netbird manager. After that, it seems to have rebuild the local dns cache and everything was correctly reachable.
saavagebueno commented 2025-11-20 07:06:00 -05:00
Author
Owner
Copy Link

@Mordi33 commented on GitHub (Nov 14, 2025):

I update this issue.
The action to disable/enable the nameserver entry didnt' work on our network.
But we found another workaround ! In our configuration we deploy a nameserver to a security group (not to All). And this security group contain every peer whose allow to acces to our DNS (it's a security option to confirm a new peer on our netbird network).
If we remove this security group and deploy the nameserver to "All" each DNS resolution on every peer works !

Maybe this action permit to the community to solve the problem on the client (or the management console) netbird.

@Mordi33 commented on GitHub (Nov 14, 2025): I update this issue. The action to disable/enable the nameserver entry didnt' work on our network. But we found another workaround ! In our configuration we deploy a nameserver to a security group (not to All). And this security group contain every peer whose allow to acces to our DNS (it's a security option to confirm a new peer on our netbird network). If we remove this security group and deploy the nameserver to "All" each DNS resolution on every peer works ! Maybe this action permit to the community to solve the problem on the client (or the management console) netbird.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
2021 Q4
2022 Q1
2022 Q1
accessibility
acl
agent
agent
Android
Android
api
authentik
automation
azure
battery-usage
bug
cache
client
client-ui
cloud
cloud-only
cloudflare
community
compatibility
config-idp
config-issue
connection
contribution
coturn
cross-vpn
dashboard
data-usage
distribution
dns
docker
documentation
duplicate
enhancement
enhancement
event-stream
feature-request
freebsd
getting-started
go
good first issue
gui
help wanted
home-assistant
idp
inconsistency
integration
integrations
ios
ipv6
jwt
k8s
keycloak
linux
login
macos
management-service
missing-docs
mobile
moved-internal
needs-review
netbird-ui
networking
new-platform
nginx
notification
okta
openwrt
packaging
peer-management
peer-management
peer-management
performance
postgres
posture-checks
psk
pull-request
Mirrored from GitHub Pull Request
 question
refactor
relay
release
rfc
routes
security
security-related
self-hosting
server
signal
sleep-issue
ssh
ssl
status
store
synology
system-compatibility-issue
test-suite
third-party-integration
triage
triage-needed
troubleshooting
UX
waiting-feedback
windows
wontfix
zitadel
No Label triage-needed
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
saavagebueno
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: SVI/netbird#2213
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?