Problem getting NetBird Relay working behind Nginx with TLS on self-hosted setup #2260

@faizansirajuddin commented on GitHub (Sep 14, 2025):

Is that working for you?

I'm trying similar setup with Netbird, Ngingx Proxy and Authentik and still could not able to make it working

@faizansirajuddin commented on GitHub (Sep 14, 2025): Is that working for you? I'm trying similar setup with Netbird, Ngingx Proxy and Authentik and still could not able to make it working

saavagebueno commented

@wooksta commented on GitHub (Sep 14, 2025):

Is that working for you?

I'm trying similar setup with Netbird, Ngingx Proxy and Authentik and still could not able to make it working

So I got it working in the end. I figured it out when I did netbird up on the host Maschine with localhost as the target. When that worked but via nginx didn't, I figured out the problem was on the nginx end. I can post my nginx config if you want.

@wooksta commented on GitHub (Sep 14, 2025): > Is that working for you? > > I'm trying similar setup with Netbird, Ngingx Proxy and Authentik and still could not able to make it working So I got it working in the end. I figured it out when I did netbird up on the host Maschine with localhost as the target. When that worked but via nginx didn't, I figured out the problem was on the nginx end. I can post my nginx config if you want.

saavagebueno commented

@faizansirajuddin commented on GitHub (Sep 14, 2025):

Sure. Please

So for me I have a NPM and Authentik installed in different machine than netbird. and I'm trying to get netbird work with reverse proxy.

thanks

@faizansirajuddin commented on GitHub (Sep 14, 2025): Sure. Please So for me I have a NPM and Authentik installed in different machine than netbird. and I'm trying to get netbird work with reverse proxy. thanks

saavagebueno commented

@wooksta commented on GitHub (Sep 14, 2025):

So I have NPM (network mode: host) and netbird (own network) running on one machine in docker, and I have my keycloak running on docker on another server.

You have npm and your idp on host (B) and netbird on host (A).

`# ------------------------------------------------------------

netbird..net

------------------------------------------------------------

log_format upstreamlog '$remote_addr - $remote_user [$time_local] '
'"$request" $status $body_bytes_sent '
'"$http_referer" "$http_user_agent" '
'upstream: $upstream_addr, response_time: $upstream_response_time, '
'status: $upstream_status';

access_log /var/log/nginx/upstream_access.log upstreamlog;

upstream dashboard {
server 127.0.0.1:10080;
keepalive 10;
}

upstream management {
server 127.0.0.1:33073;
keepalive 10;
}

upstream signal {
server 127.0.0.1:10001;
keepalive 10;
}

upstream relay {
server 127.0.0.1:33080;
}

server {
listen 80;
server_name netbird..net;

# 301 redirect to HTTPS
location / {
        return 301 https://$host$request_uri;
}

}
server {
listen 443 ssl http2;
server_name netbird..net;

# Let's Encrypt SSL
ssl_certificate /etc/letsencrypt/live/npm-4/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/npm-4/privkey.pem;

access_log /data/logs/proxy-host-netbird_access.log proxy;
error_log /data/logs/proxy-host-netbird_error.log warn;

client_header_timeout 1d;
client_body_timeout 1d;

proxy_set_header        X-Real-IP $remote_addr;
proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header        X-Scheme $scheme;
proxy_set_header        X-Forwarded-Proto https;
proxy_set_header        X-Forwarded-Host $host;
grpc_set_header         X-Forwarded-For $proxy_add_x_forwarded_for;

# Proxy dashboard
location / {
    proxy_pass http://dashboard;
}

# Proxy Signal
location /signalexchange.SignalExchange/ {
    grpc_pass grpc://signal;
    grpc_read_timeout 1d;
    grpc_send_timeout 1d;
    grpc_socket_keepalive on;
}

# Proxy Management http endpoint
location /api {
    proxy_pass http://management;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;    }

location /api {

grpc_pass grpc://127.0.0.1:33073;

error_page 502 = /errorgrpc_management;

}

# Proxy Management grpc endpoint
location /management.ManagementService/ {
    grpc_pass grpc://management;
    #grpc_ssl_verify off;
    grpc_read_timeout 1d;
    grpc_send_timeout 1d;
    grpc_socket_keepalive on;
}

# Relay for headless peers
location /relay {
    grpc_pass grpc://relay;
    grpc_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    grpc_set_header X-Forwarded-Proto $scheme;
    grpc_read_timeout 1d;
    grpc_send_timeout 1d;
    grpc_socket_keepalive on;
}

}`

This seems to work fine. As mentioned, try connecting to netbird through something that doesn't have to go through npm to see if npm is the problem or your config of netbird is wrong.

Where I have localhost, you would have to setup the connection to the machine with netbird (A) on it.
If that machine (A) is exposed to the internet, you might consider installing an npm on that machine too. Because I have npm and netbird on the same machine, I can just pass http from npm to netbird. If you are using anything outside a private network (like at your home) I would use https to connect from npm to netbird.
If you put npm on that host (A), you can just pass ssl from (B) to (A) and have http internal.

@wooksta commented on GitHub (Sep 14, 2025): So I have NPM (network mode: host) and netbird (own network) running on one machine in docker, and I have my keycloak running on docker on another server. You have npm and your idp on host (B) and netbird on host (A). `# ------------------------------------------------------------ # netbird.<redacted>.net # ------------------------------------------------------------ log_format upstreamlog '$remote_addr - $remote_user [$time_local] ' '"$request" $status $body_bytes_sent ' '"$http_referer" "$http_user_agent" ' 'upstream: $upstream_addr, response_time: $upstream_response_time, ' 'status: $upstream_status'; access_log /var/log/nginx/upstream_access.log upstreamlog; upstream dashboard { server 127.0.0.1:10080; keepalive 10; } upstream management { server 127.0.0.1:33073; keepalive 10; } upstream signal { server 127.0.0.1:10001; keepalive 10; } upstream relay { server 127.0.0.1:33080; } server { listen 80; server_name netbird.<redacted>.net; # 301 redirect to HTTPS location / { return 301 https://$host$request_uri; } } server { listen 443 ssl http2; server_name netbird.<redacted>.net; # Let's Encrypt SSL ssl_certificate /etc/letsencrypt/live/npm-4/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/npm-4/privkey.pem; access_log /data/logs/proxy-host-netbird_access.log proxy; error_log /data/logs/proxy-host-netbird_error.log warn; client_header_timeout 1d; client_body_timeout 1d; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Scheme $scheme; proxy_set_header X-Forwarded-Proto https; proxy_set_header X-Forwarded-Host $host; grpc_set_header X-Forwarded-For $proxy_add_x_forwarded_for; # Proxy dashboard location / { proxy_pass http://dashboard; } # Proxy Signal location /signalexchange.SignalExchange/ { grpc_pass grpc://signal; grpc_read_timeout 1d; grpc_send_timeout 1d; grpc_socket_keepalive on; } # Proxy Management http endpoint location /api { proxy_pass http://management; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; } # location /api { # grpc_pass grpc://127.0.0.1:33073; # error_page 502 = /errorgrpc_management; # } # Proxy Management grpc endpoint location /management.ManagementService/ { grpc_pass grpc://management; #grpc_ssl_verify off; grpc_read_timeout 1d; grpc_send_timeout 1d; grpc_socket_keepalive on; } # Relay for headless peers location /relay { grpc_pass grpc://relay; grpc_set_header X-Forwarded-For $proxy_add_x_forwarded_for; grpc_set_header X-Forwarded-Proto $scheme; grpc_read_timeout 1d; grpc_send_timeout 1d; grpc_socket_keepalive on; } }` This seems to work fine. As mentioned, try connecting to netbird through something that doesn't have to go through npm to see if npm is the problem or your config of netbird is wrong. Where I have localhost, you would have to setup the connection to the machine with netbird (A) on it. If that machine (A) is exposed to the internet, you might consider installing an npm on that machine too. Because I have npm and netbird on the same machine, I can just pass http from npm to netbird. If you are using anything outside a private network (like at your home) I would use https to connect from npm to netbird. If you put npm on that host (A), you can just pass ssl from (B) to (A) and have http internal.

saavagebueno commented

@faizansirajuddin commented on GitHub (Sep 14, 2025):

Hi Thanks you.

Ealier I tried using direct setup without proxy with zitadel auth provider and it was working fine without any issues. but now with authntik and NMP is creating problems.

I'm pasting my configureation see if you can help me out.

upon visiting netbird.doamin.com I can able to authnticate with auththentik and it is redirecting to netbird peer page

and there it is being stucked and keep load. I have notice one error on netbird side also see

------------------------------------------------------------

netbird.example.com

------------------------------------------------------------

map $scheme $hsts_header {
https "max-age=63072000; preload";
}

server {
set $server "192.168.1.10"; # <-- NetBird host IP

listen 80;
listen [::]:80;

listen 443 ssl;
listen [::]:443 ssl;
http2 on;

server_name netbird.example.com;

ssl_certificate /etc/letsencrypt/live/npm-3/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/npm-3/privkey.pem;

include conf.d/include/letsencrypt-acme-challenge.conf;
include conf.d/include/ssl-cache.conf;
include conf.d/include/ssl-ciphers.conf;
include conf.d/include/block-exploits.conf;
include conf.d/include/force-ssl.conf;

access_log /data/logs/proxy-host-11_access.log proxy;
error_log /data/logs/proxy-host-11_error.log warn;

proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $http_connection;
proxy_http_version 1.1;

Dashboard

location / {
proxy_pass http://$server:80;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}

Management API (HTTP)

location /api {
proxy_pass http://$server:33073;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}

Management gRPC

location /management.ManagementService/ {
grpc_pass grpc://$server:33073;
grpc_read_timeout 1d;
grpc_send_timeout 1d;
grpc_socket_keepalive on;
}

Signal gRPC

location /signalexchange.SignalExchange/ {
grpc_pass grpc://$server:10000;
grpc_read_timeout 1d;
grpc_send_timeout 1d;
grpc_socket_keepalive on;
}

Relay

location /relay/ {
proxy_pass http://$server:33080;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}

Custom

include /data/nginx/custom/server_proxy[.]conf;
}

This error I'm getting on netbird side when starting docker compose

management-1 | 2025-09-14T11:53:05Z WARN management/server/account.go:250: failed warming up cache due to error: 403 Forbidden

@faizansirajuddin commented on GitHub (Sep 14, 2025): Hi Thanks you. Ealier I tried using direct setup without proxy with zitadel auth provider and it was working fine without any issues. but now with authntik and NMP is creating problems. I'm pasting my configureation see if you can help me out. upon visiting netbird.doamin.com I can able to authnticate with auththentik and it is redirecting to netbird peer page and there it is being stucked and keep load. I have notice one error on netbird side also see # ------------------------------------------------------------ # netbird.example.com # ------------------------------------------------------------ map $scheme $hsts_header { https "max-age=63072000; preload"; } server { set $server "192.168.1.10"; # <-- NetBird host IP listen 80; listen [::]:80; listen 443 ssl; listen [::]:443 ssl; http2 on; server_name netbird.example.com; ssl_certificate /etc/letsencrypt/live/npm-3/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/npm-3/privkey.pem; include conf.d/include/letsencrypt-acme-challenge.conf; include conf.d/include/ssl-cache.conf; include conf.d/include/ssl-ciphers.conf; include conf.d/include/block-exploits.conf; include conf.d/include/force-ssl.conf; access_log /data/logs/proxy-host-11_access.log proxy; error_log /data/logs/proxy-host-11_error.log warn; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $http_connection; proxy_http_version 1.1; # Dashboard location / { proxy_pass http://$server:80; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; } # Management API (HTTP) location /api { proxy_pass http://$server:33073; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; } # Management gRPC location /management.ManagementService/ { grpc_pass grpc://$server:33073; grpc_read_timeout 1d; grpc_send_timeout 1d; grpc_socket_keepalive on; } # Signal gRPC location /signalexchange.SignalExchange/ { grpc_pass grpc://$server:10000; grpc_read_timeout 1d; grpc_send_timeout 1d; grpc_socket_keepalive on; } # Relay location /relay/ { proxy_pass http://$server:33080; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; } # Custom include /data/nginx/custom/server_proxy[.]conf; } #### This error I'm getting on netbird side when starting docker compose management-1 | 2025-09-14T11:53:05Z WARN management/server/account.go:250: failed warming up cache due to error: 403 Forbidden

saavagebueno commented

@wooksta commented on GitHub (Sep 14, 2025):

So, all I saw was that I set grpc for the relay location, and you use http, that might be it.

I think the cache might be unrelated, butsomething you should look up.

@wooksta commented on GitHub (Sep 14, 2025): So, all I saw was that I set grpc for the relay location, and you use http, that might be it. I think the cache might be unrelated, butsomething you should look up.

saavagebueno commented

@faizansirajuddin commented on GitHub (Sep 14, 2025):

So after inspecting http request I got to know that I'm getting SSL PROTOCOL ERROR while connecting to management port 33073

8786-6cab84d1f1050c71.js:1 GET https://netbird.example.com:33073/api/users/current net::ERR_SSL_PROTOCOL_ERROR

So in my setup requests to the port 80,443 is availble through NPM and rest port request can bypass proxy and can be directly rechable.

Here are my containers

NAME IMAGE COMMAND SERVICE CREATED STATUS PORTS
artifacts-coturn-1 coturn/coturn:latest "docker-entrypoint.s…" coturn 3 minutes ago Up 3 minutes
artifacts-dashboard-1 netbirdio/dashboard:latest "/usr/bin/supervisor…" dashboard 3 minutes ago Up 3 minutes 0.0.0.0:80->80/tcp, [::]:80->80/tcp, 0.0.0.0:443->443/tcp, [::]:443->443/tcp
artifacts-management-1 netbirdio/management:latest "/go/bin/netbird-mgm…" management 3 minutes ago Up 3 minutes 0.0.0.0:33073->443/tcp, [::]:33073->443/tcp
artifacts-relay-1 netbirdio/relay:latest "/go/bin/netbird-rel…" relay 3 minutes ago Up 3 minutes 0.0.0.0:33080->33080/tcp, [::]:33080->33080/tcp
artifacts-signal-1 netbirdio/signal:latest "/go/bin/netbird-sig…" signal 3 minutes ago Up 3 minutes 0.0.0.0:10000->80/tcp, [::]:10000->80/tcp
[root@netbird artifacts]#

@faizansirajuddin commented on GitHub (Sep 14, 2025): So after inspecting http request I got to know that I'm getting SSL PROTOCOL ERROR while connecting to management port 33073 8786-6cab84d1f1050c71.js:1 GET https://netbird.example.com:33073/api/users/current net::ERR_SSL_PROTOCOL_ERROR So in my setup requests to the port 80,443 is availble through NPM and rest port request can bypass proxy and can be directly rechable. Here are my containers NAME IMAGE COMMAND SERVICE CREATED STATUS PORTS artifacts-coturn-1 coturn/coturn:latest "docker-entrypoint.s…" coturn 3 minutes ago Up 3 minutes artifacts-dashboard-1 netbirdio/dashboard:latest "/usr/bin/supervisor…" dashboard 3 minutes ago Up 3 minutes 0.0.0.0:80->80/tcp, [::]:80->80/tcp, 0.0.0.0:443->443/tcp, [::]:443->443/tcp artifacts-management-1 netbirdio/management:latest "/go/bin/netbird-mgm…" management 3 minutes ago Up 3 minutes 0.0.0.0:33073->443/tcp, [::]:33073->443/tcp artifacts-relay-1 netbirdio/relay:latest "/go/bin/netbird-rel…" relay 3 minutes ago Up 3 minutes 0.0.0.0:33080->33080/tcp, [::]:33080->33080/tcp artifacts-signal-1 netbirdio/signal:latest "/go/bin/netbird-sig…" signal 3 minutes ago Up 3 minutes 0.0.0.0:10000->80/tcp, [::]:10000->80/tcp [root@netbird artifacts]#

saavagebueno commented

@wooksta commented on GitHub (Sep 15, 2025):

it sounds like your backend is expecting SSL, which it shouldn't according to your config. I think you might have to try to work on that.

@wooksta commented on GitHub (Sep 15, 2025): it sounds like your backend is expecting SSL, which it shouldn't according to your config. I think you might have to try to work on that.

saavagebueno commented

@faizansirajuddin commented on GitHub (Sep 15, 2025):

Thanks man @wooksta for your support. now it is working for me as well.

@faizansirajuddin commented on GitHub (Sep 15, 2025): Thanks man @wooksta for your support. now it is working for me as well.

saavagebueno commented

@teksrq commented on GitHub (Sep 15, 2025):

Glad you both got it working, but just want to clarify that my issue is a bit different from what wooksta fixed with container name resolution.

In my setup:

Management and Signal are running fine behind Nginx with TLS.

Relay is also behind Nginx (terminating TLS), and peers are correctly receiving the advertised relay address (rels://netbird.example.com:33080/relay).

Peers can reach the relay, but the connection fails with errors like:

http: server gave HTTP response to HTTPS client
tls: first record does not look like a TLS handshake

Relevant UFW Firewall rules:

TCP 33080 open for relay.
UDP 3478 open for STUN/TURN.
UDP 49152–65535 open for WebRTC media

This looks like a protocol mismatch — the peer expects TLS/WebSocket, but the relay behind Nginx isn’t handling the handshake correctly.

So unlike wooksta’s case (container DNS/hostname discovery), my relay is being discovered, but TLS/WebSocket negotiation fails.

Question:
Does NetBird officially support running the relay behind an Nginx reverse proxy with TLS termination? If so, an example Nginx config that correctly handles rels:// WebSocket traffic would be greatly appreciated!

@teksrq commented on GitHub (Sep 15, 2025): Glad you both got it working, but just want to clarify that my issue is a bit different from what wooksta fixed with container name resolution. In my setup: Management and Signal are running fine behind Nginx with TLS. Relay is also behind Nginx (terminating TLS), and peers are correctly receiving the advertised relay address (rels://netbird.example.com:33080/relay). Peers can reach the relay, but the connection fails with errors like: http: server gave HTTP response to HTTPS client tls: first record does not look like a TLS handshake Relevant UFW Firewall rules: - TCP 33080 open for relay. - UDP 3478 open for STUN/TURN. - UDP 49152–65535 open for WebRTC media This looks like a protocol mismatch — the peer expects TLS/WebSocket, but the relay behind Nginx isn’t handling the handshake correctly. So unlike wooksta’s case (container DNS/hostname discovery), my relay is being discovered, but TLS/WebSocket negotiation fails. Question: Does NetBird officially support running the relay behind an Nginx reverse proxy with TLS termination? If so, an example Nginx config that correctly handles rels:// WebSocket traffic would be greatly appreciated!

saavagebueno commented

@faizansirajuddin commented on GitHub (Sep 15, 2025):

Yes Netbird is supported behind the reverse proxy. but you need to terminal all you connection except stun to the proxy.

then proxy will forward it to servers.

what you need to do is while configuring environment file set following things.

Set NETBIRD_DOMAIN to your domain, e.g. demo.netbird.io
Set NETBIRD_DISABLE_LETSENCRYPT=true
Add NETBIRD_MGMT_API_PORT to your reverse-proxy TLS-port (default: 443) ## I have set to 443
Add NETBIRD_SIGNAL_PORT to your reverse-proxy TLS-port ### I have set to 443
Optional:

Add TURN_MIN_PORT and TURN_MAX_PORT to configure the port-range used by the Turn-server (min 10000 max 20000)

when you run configure script it will generate management URLs pointing to the proxy. https://netbird.example.com

at this stag if you run docker compose then it will break as there are conflicting ports so have to change outside ports to non conflicting ports. do not change inside ports.

then configure proxy accordingly. here config from my Nginx proxy manager it is based fully on nginx so configuration will be same.

------------------------------------------------------------

netbird.example.com

------------------------------------------------------------

map $scheme $hsts_header {
https "max-age=63072000; preload";
}

server {
set $forward_scheme http;
set $server "192.168.1.10";
set $port 80;

listen 80;
listen [::]:80;

listen 443 ssl;
listen [::]:443 ssl;

server_name netbird.example.com;

http2 on;

Let's Encrypt SSL

include conf.d/include/letsencrypt-acme-challenge.conf;
include conf.d/include/ssl-cache.conf;
include conf.d/include/ssl-ciphers.conf;
ssl_certificate /etc/letsencrypt/live/npm-3/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/npm-3/privkey.pem;

proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $http_connection;
proxy_http_version 1.1;

access_log /data/logs/proxy-host-11_access.log proxy;
error_log /data/logs/proxy-host-11_error.log warn;

location / {

proxy_set_header Host $host;
proxy_set_header X-Forwarded-Scheme $scheme;
proxy_set_header X-Forwarded-Proto  $scheme;
proxy_set_header X-Forwarded-For    $remote_addr;
proxy_set_header X-Real-IP          $remote_addr;

proxy_pass       http://192.168.1.10:80;












proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $http_connection;
proxy_http_version 1.1;

}

location /api {

proxy_set_header Host $host;
proxy_set_header X-Forwarded-Scheme $scheme;
proxy_set_header X-Forwarded-Proto  $scheme;
proxy_set_header X-Forwarded-For    $remote_addr;
proxy_set_header X-Real-IP          $remote_addr;

proxy_pass       http://192.168.1.10:443;












proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $http_connection;
proxy_http_version 1.1;

}

location /signalexchange.SignalExchange/ {
location /signalexchange.SignalExchange/ {
grpc_pass grpc://192.168.1.10:9443;
grpc_read_timeout 1d;
grpc_send_timeout 1d;
grpc_socket_keepalive on;
}

proxy_set_header Host $host;
proxy_set_header X-Forwarded-Scheme $scheme;
proxy_set_header X-Forwarded-Proto  $scheme;
proxy_set_header X-Forwarded-For    $remote_addr;
proxy_set_header X-Real-IP          $remote_addr;

proxy_pass       http://192.168.1.10:9443;












proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $http_connection;
proxy_http_version 1.1;

}

location /management.ManagementService/ {
location /management.ManagementService/ {
grpc_pass grpc://192.168.1.10:443;
grpc_read_timeout 1d;
grpc_send_timeout 1d;
grpc_socket_keepalive on;
}

proxy_set_header Host $host;
proxy_set_header X-Forwarded-Scheme $scheme;
proxy_set_header X-Forwarded-Proto  $scheme;
proxy_set_header X-Forwarded-For    $remote_addr;
proxy_set_header X-Real-IP          $remote_addr;

proxy_pass       http://192.168.1.10:443;












proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $http_connection;
proxy_http_version 1.1;

}

Custom

include /data/nginx/custom/server_proxy[.]conf;
}

and here is docker compose includes on ports and env setting linking to proxy config

services:

UI dashboard

dashboard:
<<: *default
image: netbirdio/dashboard:latest
ports:
- 80:80
- 8443:443

environment:
  # Endpoints
  - NETBIRD_MGMT_API_ENDPOINT=https://netbird.example.com:443
  - NETBIRD_MGMT_GRPC_API_ENDPOINT=https://netbird.example.com:443

Signal

signal:
<<: *default
image: netbirdio/signal:latest
volumes:
- netbird-signal:/var/lib/netbird
ports:
- 9443:80

Relay

relay:
<<: *default
image: netbirdio/relay:latest
environment:
- NB_LOG_LEVEL=info
- NB_LISTEN_ADDRESS=:33080
- NB_EXPOSED_ADDRESS=rels://netbird.example.com:33080/relay

Management

management:
<<: *default
image: netbirdio/management:latest
depends_on:
- dashboard
volumes:
- netbird-mgmt:/var/lib/netbird
- netbird-letsencrypt:/etc/letsencrypt:ro
- ./management.json:/etc/netbird/management.json
ports:
- 443:443 #API port

@faizansirajuddin commented on GitHub (Sep 15, 2025): Yes Netbird is supported behind the reverse proxy. but you need to terminal all you connection except stun to the proxy. then proxy will forward it to servers. what you need to do is while configuring environment file set following things. Set NETBIRD_DOMAIN to your domain, e.g. demo.netbird.io Set NETBIRD_DISABLE_LETSENCRYPT=true Add NETBIRD_MGMT_API_PORT to your reverse-proxy TLS-port (default: 443) ## I have set to 443 Add NETBIRD_SIGNAL_PORT to your reverse-proxy TLS-port ### I have set to 443 Optional: Add TURN_MIN_PORT and TURN_MAX_PORT to configure the port-range used by the Turn-server (min 10000 max 20000) when you run configure script it will generate management URLs pointing to the proxy. https://netbird.example.com at this stag if you run docker compose then it will break as there are conflicting ports so have to change outside ports to non conflicting ports. do not change inside ports. then configure proxy accordingly. here config from my Nginx proxy manager it is based fully on nginx so configuration will be same. # ------------------------------------------------------------ # netbird.example.com # ------------------------------------------------------------ map $scheme $hsts_header { https "max-age=63072000; preload"; } server { set $forward_scheme http; set $server "192.168.1.10"; set $port 80; listen 80; listen [::]:80; listen 443 ssl; listen [::]:443 ssl; server_name netbird.example.com; http2 on; # Let's Encrypt SSL include conf.d/include/letsencrypt-acme-challenge.conf; include conf.d/include/ssl-cache.conf; include conf.d/include/ssl-ciphers.conf; ssl_certificate /etc/letsencrypt/live/npm-3/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/npm-3/privkey.pem; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $http_connection; proxy_http_version 1.1; access_log /data/logs/proxy-host-11_access.log proxy; error_log /data/logs/proxy-host-11_error.log warn; location / { proxy_set_header Host $host; proxy_set_header X-Forwarded-Scheme $scheme; proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header X-Forwarded-For $remote_addr; proxy_set_header X-Real-IP $remote_addr; proxy_pass http://192.168.1.10:80; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $http_connection; proxy_http_version 1.1; } location /api { proxy_set_header Host $host; proxy_set_header X-Forwarded-Scheme $scheme; proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header X-Forwarded-For $remote_addr; proxy_set_header X-Real-IP $remote_addr; proxy_pass http://192.168.1.10:443; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $http_connection; proxy_http_version 1.1; } location /signalexchange.SignalExchange/ { location /signalexchange.SignalExchange/ { grpc_pass grpc://192.168.1.10:9443; grpc_read_timeout 1d; grpc_send_timeout 1d; grpc_socket_keepalive on; } proxy_set_header Host $host; proxy_set_header X-Forwarded-Scheme $scheme; proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header X-Forwarded-For $remote_addr; proxy_set_header X-Real-IP $remote_addr; proxy_pass http://192.168.1.10:9443; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $http_connection; proxy_http_version 1.1; } location /management.ManagementService/ { location /management.ManagementService/ { grpc_pass grpc://192.168.1.10:443; grpc_read_timeout 1d; grpc_send_timeout 1d; grpc_socket_keepalive on; } proxy_set_header Host $host; proxy_set_header X-Forwarded-Scheme $scheme; proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header X-Forwarded-For $remote_addr; proxy_set_header X-Real-IP $remote_addr; proxy_pass http://192.168.1.10:443; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $http_connection; proxy_http_version 1.1; } # Custom include /data/nginx/custom/server_proxy[.]conf; } # and here is docker compose includes on ports and env setting linking to proxy config services: # UI dashboard dashboard: <<: *default image: netbirdio/dashboard:latest ports: - 80:80 - 8443:443 environment: # Endpoints - NETBIRD_MGMT_API_ENDPOINT=https://netbird.example.com:443 - NETBIRD_MGMT_GRPC_API_ENDPOINT=https://netbird.example.com:443 # Signal signal: <<: *default image: netbirdio/signal:latest volumes: - netbird-signal:/var/lib/netbird ports: - 9443:80 # Relay relay: <<: *default image: netbirdio/relay:latest environment: - NB_LOG_LEVEL=info - NB_LISTEN_ADDRESS=:33080 - NB_EXPOSED_ADDRESS=rels://netbird.example.com:33080/relay # Management management: <<: *default image: netbirdio/management:latest depends_on: - dashboard volumes: - netbird-mgmt:/var/lib/netbird - netbird-letsencrypt:/etc/letsencrypt:ro - ./management.json:/etc/netbird/management.json ports: - 443:443 #API port

saavagebueno commented

@wooksta commented on GitHub (Sep 19, 2025):

@faizansirajuddin hey am I seeing that right? your nginx doesn't proxy the relay, you have an open port for that?

also how do you deal with SSL? can you configure ssl just for relay?

@wooksta commented on GitHub (Sep 19, 2025): @faizansirajuddin hey am I seeing that right? your nginx doesn't proxy the relay, you have an open port for that? also how do you deal with SSL? can you configure ssl just for relay?

saavagebueno commented

@faizansirajuddin commented on GitHub (Sep 19, 2025):

Yes, I did not proxied the relay as netbird document does not mention it and opened port for that. as far as I know relay is being protected by wiregurd tunnel so your don't need SSL on relay.

In relay case your tunnel is hopping through your netbird server.

@faizansirajuddin commented on GitHub (Sep 19, 2025): Yes, I did not proxied the relay as netbird document does not mention it and opened port for that. as far as I know relay is being protected by wiregurd tunnel so your don't need SSL on relay. In relay case your tunnel is hopping through your netbird server.

saavagebueno commented