SVI/netbird
1
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-05-26 10:02:06 -04:00
Code Issues 3.0k Packages Projects Releases 10 Wiki Activity

DNS resolution is not working on Windows after upgrading to 0.59.0 #2328

New Issue
Closed
opened 2025-11-20 07:07:47 -05:00 by saavagebueno · 12 comments
saavagebueno commented 2025-11-20 07:07:47 -05:00
Owner
Copy Link

Originally created by @Ridys on GitHub (Oct 1, 2025).

Describe the problem

DNS resolution is not working on Windows after upgrading to 0.59.0. I first updated the client, and afterwards the Windows system was no longer able to resolve domains, although this had worked before. Updating Management, Signal, Dashboard, and Relay did not resolve the issue.

I use a nameserver inside the Netbird network for certain organization domains. On Windows, DNS resolution does not work either for the domains specified in Match domains or for peer addresses such as *.organization.local.

I noticed that if I configure at least one nameserver with the All group (as recommended in the documentation), DNS resolution starts working again, but it used to work without this requirement before.

Upd.: I tried creating a nameserver with match domains ALL, keeping the same groups (not All group), and everything works correctly.

To Reproduce

Steps to reproduce the behavior:

  1. Set up a DNS service on one of the peers inside the Netbird network.
  2. Assign the user to a group.
  3. In Access Control → Policies, create rules for TCP and UDP traffic to allow connections to the peer running DNS.
  4. Go to DNS → Nameservers and assign a nameserver inside the Netbird network to the user’s group.
    • The nameserver should include the specific domains it should handle (not a wildcard).
    • There must be no nameserver for the All group.
  5. Try to resolve a domain from the Match domains list on Windows 11, or run ping to another peer using an address like *.organization.local.
    • The system will attempt to resolve names using the DNS servers configured in the operating system, ignoring the assigned Netbird nameserver.

Expected behavior

DNS should resolve correctly on Windows 11 without requiring an All nameserver when a custom nameserver is specified for certain domains

Are you using NetBird Cloud?

No

NetBird version

0.59.0

Is any other VPN software installed?

No

Debug output

2025-10-02T09:47:41+07:00 INFO client/internal/connect.go:283: Netbird engine started, the IP is: 100.96.48.79/16
2025-10-02T09:47:41+07:00 INFO client/internal/wg_iface_monitor.go:50: Interface monitor: watching wt0 (index: 70)
2025-10-02T09:47:42+07:00 INFO shared/management/client/grpc.go:157: connected to the Management Service stream
2025-10-02T09:47:42+07:00 INFO client/internal/dns/host_windows.go:265: added 4 separate NRPT entries. Domain list: [.app1.anon-shW8E.domain .app2.anon-shW8E.domain .anon-Tf6Pc.domain .96.100.in-addr.arpa]
2025-10-02T09:47:42+07:00 INFO client/internal/dns/host_windows.go:346: updated search domains: [anon-Tf6Pc.domain]
2025-10-02T09:47:42+07:00 WARN client/internal/dns/upstream.go:254: probing upstream nameserver 100.96.118.81:5353: with udp: read udp 100.96.48.79:57092->100.96.118.81:5353: i/o timeout
2025-10-02T09:47:42+07:00 WARN client/internal/dns/upstream.go:344: Upstream resolving is Disabled for 30s
2025-10-02T09:47:42+07:00 WARN client/internal/dns/upstream.go:254: probing upstream nameserver 100.96.118.81:5353: with udp: read udp 100.96.48.79:57094->100.96.118.81:5353: i/o timeout
2025-10-02T09:47:42+07:00 WARN client/internal/dns/upstream.go:344: Upstream resolving is Disabled for 30s
2025-10-02T09:47:42+07:00 WARN client/internal/dns/upstream.go:254: probing upstream nameserver 100.96.118.81:5353: with udp: read udp 100.96.48.79:57093->100.96.118.81:5353: i/o timeout
2025-10-02T09:47:42+07:00 WARN client/internal/dns/upstream.go:254: probing upstream nameserver 100.96.118.81:5353: with udp: read udp 100.96.48.79:57095->100.96.118.81:5353: i/o timeout
2025-10-02T09:47:42+07:00 WARN client/internal/dns/upstream.go:344: Upstream resolving is Disabled for 30s
2025-10-02T09:47:42+07:00 INFO [nameservers: [{100.96.118.81 udp 5353}]] client/internal/dns/server.go:830: Temporarily deactivating nameservers group due to timeout
2025-10-02T09:47:45+07:00 INFO client/internal/dns/host_windows.go:316: registered DNS names
2025-10-02T09:47:45+07:00 INFO client/internal/dns/host_windows.go:339: flushed DNS cache
2025-10-02T09:47:45+07:00 INFO client/internal/dns/upstream.go:322: upstreams 100.96.118.81:5353 are responsive again. Adding them back to system
2025-10-02T09:47:45+07:00 INFO client/internal/dns/upstream.go:322: upstreams 100.96.118.81:5353 are responsive again. Adding them back to system
2025-10-02T09:47:45+07:00 INFO client/internal/dns/host_windows.go:265: added 4 separate NRPT entries. Domain list: [.app1.anon-shW8E.domain .app2.anon-shW8E.domain .anon-Tf6Pc.domain .96.100.in-addr.arpa]
2025-10-02T09:47:45+07:00 INFO client/internal/dns/host_windows.go:346: updated search domains: [anon-Tf6Pc.domain]
2025-10-02T09:47:45+07:00 INFO client/internal/dns/host_windows.go:265: added 4 separate NRPT entries. Domain list: [.app1.anon-shW8E.domain .app2.anon-shW8E.domain .anon-Tf6Pc.domain .96.100.in-addr.arpa]
2025-10-02T09:47:45+07:00 INFO client/internal/dns/host_windows.go:346: updated search domains: [anon-Tf6Pc.domain]
2025-10-02T09:47:45+07:00 INFO client/internal/dns/upstream.go:322: upstreams 100.96.118.81:5353 are responsive again. Adding them back to system
2025-10-02T09:47:45+07:00 INFO client/internal/dns/host_windows.go:265: added 4 separate NRPT entries. Domain list: [.app1.anon-shW8E.domain .app2.anon-shW8E.domain .anon-Tf6Pc.domain .96.100.in-addr.arpa]
2025-10-02T09:47:45+07:00 INFO client/internal/dns/host_windows.go:346: updated search domains: [anon-Tf6Pc.domain]
2025-10-02T09:47:45+07:00 INFO client/internal/dns/upstream.go:322: upstreams 100.96.118.81:5353 are responsive again. Adding them back to system
2025-10-02T09:47:45+07:00 INFO client/internal/dns/host_windows.go:265: added 4 separate NRPT entries. Domain list: [.app1.anon-shW8E.domain .app2.anon-shW8E.domain .anon-Tf6Pc.domain .96.100.in-addr.arpa]
2025-10-02T09:47:45+07:00 INFO client/internal/dns/host_windows.go:346: updated search domains: [anon-Tf6Pc.domain]
2025-10-02T09:47:45+07:00 INFO client/internal/dns/host_windows.go:316: registered DNS names
2025-10-02T09:47:45+07:00 INFO client/internal/dns/host_windows.go:316: registered DNS names
2025-10-02T09:47:45+07:00 INFO client/internal/dns/host_windows.go:339: flushed DNS cache
2025-10-02T09:47:45+07:00 INFO client/internal/dns/host_windows.go:339: flushed DNS cache
2025-10-02T09:47:45+07:00 INFO client/internal/dns/host_windows.go:316: registered DNS names
2025-10-02T09:47:45+07:00 INFO client/internal/dns/host_windows.go:339: flushed DNS cache
2025-10-02T09:47:45+07:00 INFO client/internal/dns/host_windows.go:316: registered DNS names
2025-10-02T09:47:45+07:00 INFO client/internal/dns/host_windows.go:339: flushed DNS cache
2025-10-02T09:47:48+07:00 INFO client/internal/dns/host_windows.go:316: registered DNS names
2025-10-02T09:47:48+07:00 INFO client/internal/dns/host_windows.go:316: registered DNS names
2025-10-02T09:47:48+07:00 INFO client/internal/dns/host_windows.go:339: flushed DNS cache
2025-10-02T09:47:48+07:00 INFO client/internal/dns/host_windows.go:339: flushed DNS cache
2025-10-02T09:47:48+07:00 INFO client/internal/dns/host_windows.go:316: registered DNS names
2025-10-02T09:47:48+07:00 INFO client/internal/dns/host_windows.go:339: flushed DNS cache
2025-10-02T09:47:48+07:00 INFO client/internal/dns/host_windows.go:316: registered DNS names
2025-10-02T09:47:48+07:00 INFO client/internal/dns/host_windows.go:339: flushed DNS cache

PS C:\Users\user> netbird status -dA
Peers detail:
 iphone.anon-Tf6Pc.domain:
  NetBird IP: 100.96.230.203/32
  Public key: cREimgML75hSklSwJBw0HxIXwErdzUhJhmYDv4AUvnI=
  Status: Idle
  -- detail --
  Connection type: P2P
  ICE candidate (Local/Remote): -/-
  ICE candidate endpoints (Local/Remote): -/-
  Relay server address:
  Last connection update: 30 minutes, 9 seconds ago
  Last WireGuard handshake: -
  Transfer status (received/sent) 0 B/0 B
  Quantum resistance: false
  Networks: -
  Latency: 0s

 server1.anon-Tf6Pc.domain:
  NetBird IP: 100.96.118.81
  Public key: JQHuesauk1bns3ZXZFmAmyDj04dRCFK0ljeZi/1Tk3E=
  Status: Connected
  -- detail --
  Connection type: P2P
  ICE candidate (Local/Remote): host/srflx
  ICE candidate endpoints (Local/Remote): 192.168.0.100:51820/198.51.100.0:51565
  Relay server address: rel://netbird.anon-shW8E.domain:33080
  Last connection update: 43 minutes, 46 seconds ago
  Last WireGuard handshake: 1 minute, 52 seconds ago
  Transfer status (received/sent) 831.2 KiB/47.8 KiB
  Quantum resistance: false
  Networks: -
  Latency: 53.1689ms

 server2.anon-Tf6Pc.domain:
  NetBird IP: 100.96.171.170
  Public key: snzWuUuEMVowIL97c6Df+ftYVvg9ZqpMV4M/Umimz1c=
  Status: Connected
  -- detail --
  Connection type: P2P
  ICE candidate (Local/Remote): host/srflx
  ICE candidate endpoints (Local/Remote): 172.24.176.1:51820/198.51.100.1:51820
  Relay server address: rel://netbird.anon-shW8E.domain:33080
  Last connection update: 43 minutes, 58 seconds ago
  Last WireGuard handshake: 1 minute, 51 seconds ago
  Transfer status (received/sent) 21.2 KiB/15.3 KiB
  Quantum resistance: false
  Networks: -
  Latency: 67.3631ms

Events:
  [WARNING] DNS (cf37375c-19cd-4be5-a834-bb02f5313296)
    Message: All upstream servers failed (probe failed)
    Time: 1 hour, 2 minutes ago
    Metadata: upstreams: 100.96.118.81:5353
  [INFO] SYSTEM (6ff3faac-eccf-482b-8a1b-fcbddbfd5f08)
    Message: Network map updated
    Time: 1 hour, 2 minutes ago
  [INFO] SYSTEM (73df67e7-25dd-4d7d-b2b5-d75951ecdc04)
    Message: Network map updated
    Time: 50 minutes, 49 seconds ago
  [WARNING] DNS (7a1db8cc-40e2-4bb6-a211-7176f1ab3e1d)
    Message: All upstream servers failed (probe failed)
    Time: 43 minutes, 59 seconds ago
    Metadata: upstreams: 100.96.118.81:5353
  [WARNING] DNS (6897df03-928e-43cb-a7d6-f648958e7978)
    Message: All upstream servers failed (probe failed)
    Time: 43 minutes, 59 seconds ago
    Metadata: upstreams: 100.96.118.81:5353
  [WARNING] DNS (302cadba-416b-4066-b376-5904b891ee06)
    Message: All upstream servers failed (probe failed)
    Time: 43 minutes, 59 seconds ago
    Metadata: upstreams: 100.96.118.81:5353
  [WARNING] DNS (033d4a7b-2607-4225-8aeb-a92ee66e5b6d)
    Message: All upstream servers failed (probe failed)
    Time: 43 minutes, 59 seconds ago
    Metadata: upstreams: 100.96.118.81:5353
  [INFO] SYSTEM (81472bd8-6ea6-4b64-bea4-c9d5acd21da4)
    Message: Network map updated
    Time: 43 minutes, 59 seconds ago
  [INFO] SYSTEM (6c019aa2-9e8e-4741-ac04-2f436eac514b)
    Message: Network map updated
    Time: 30 minutes, 27 seconds ago
  [INFO] SYSTEM (be0e9de5-6849-477f-84e8-b0636747c663)
    Message: Network map updated
    Time: 30 minutes, 9 seconds ago
OS: windows/amd64
Daemon version: 0.59.0
CLI version: 0.59.0
Profile: default
Management: Connected to https://netbird.anon-shW8E.domain:443
Signal: Connected to https://netbird.anon-shW8E.domain:443
Relays:
  [stun:netbird.anon-shW8E.domain:3478] is Available
  [turn:netbird.anon-shW8E.domain:3478?transport=udp] is Available
  [rel://netbird.anon-shW8E.domain:33080] is Available
Nameservers:
  [100.96.118.81:5353] for [app1.anon-shW8E.domain, app2.anon-shW8E.domain] is Available
FQDN: ridys.anon-Tf6Pc.domain
NetBird IP: 100.96.48.79/16
Interface type: Userspace
Quantum resistance: false
Lazy connection: false
Networks: -
Forwarding rules: 0
Peers count: 2/3 Connected

Screenshots

If applicable, add screenshots to help explain your problem.

Additional context

OS Name: Microsoft Windows 11 Pro
OS Version: 10.0.26100 N/A Build 26100

Have you tried these troubleshooting steps?

  • Reviewed client troubleshooting (if applicable)
  • Checked for newer NetBird versions
  • Searched for similar issues on GitHub (including closed ones)
  • Restarted the NetBird client
  • Disabled other VPN software
  • Checked firewall settings
Originally created by @Ridys on GitHub (Oct 1, 2025). **Describe the problem** DNS resolution is not working on Windows after upgrading to 0.59.0. I first updated the client, and afterwards the Windows system was no longer able to resolve domains, although this had worked before. Updating Management, Signal, Dashboard, and Relay did not resolve the issue. I use a nameserver inside the Netbird network for certain organization domains. On Windows, DNS resolution does not work either for the domains specified in Match domains or for peer addresses such as *.organization.local. I noticed that if I configure at least one nameserver with the All group (as recommended in the documentation), DNS resolution starts working again, but it used to work without this requirement before. Upd.: I tried creating a nameserver with match domains ALL, keeping the same groups (not All group), and everything works correctly. **To Reproduce** Steps to reproduce the behavior: 1. Set up a DNS service on one of the peers inside the Netbird network. 2. Assign the user to a group. 3. In **Access Control → Policies**, create rules for TCP and UDP traffic to allow connections to the peer running DNS. 4. Go to **DNS → Nameservers** and assign a nameserver inside the Netbird network to the user’s group. - The nameserver should include the specific domains it should handle (not a wildcard). - There must be no nameserver for the *All* group. 5. Try to resolve a domain from the Match domains list on Windows 11, or run `ping` to another peer using an address like `*.organization.local`. - The system will attempt to resolve names using the DNS servers configured in the operating system, ignoring the assigned Netbird nameserver. **Expected behavior** DNS should resolve correctly on Windows 11 without requiring an All nameserver when a custom nameserver is specified for certain domains **Are you using NetBird Cloud?** No **NetBird version** 0.59.0 **Is any other VPN software installed?** No **Debug output** ``` 2025-10-02T09:47:41+07:00 INFO client/internal/connect.go:283: Netbird engine started, the IP is: 100.96.48.79/16 2025-10-02T09:47:41+07:00 INFO client/internal/wg_iface_monitor.go:50: Interface monitor: watching wt0 (index: 70) 2025-10-02T09:47:42+07:00 INFO shared/management/client/grpc.go:157: connected to the Management Service stream 2025-10-02T09:47:42+07:00 INFO client/internal/dns/host_windows.go:265: added 4 separate NRPT entries. Domain list: [.app1.anon-shW8E.domain .app2.anon-shW8E.domain .anon-Tf6Pc.domain .96.100.in-addr.arpa] 2025-10-02T09:47:42+07:00 INFO client/internal/dns/host_windows.go:346: updated search domains: [anon-Tf6Pc.domain] 2025-10-02T09:47:42+07:00 WARN client/internal/dns/upstream.go:254: probing upstream nameserver 100.96.118.81:5353: with udp: read udp 100.96.48.79:57092->100.96.118.81:5353: i/o timeout 2025-10-02T09:47:42+07:00 WARN client/internal/dns/upstream.go:344: Upstream resolving is Disabled for 30s 2025-10-02T09:47:42+07:00 WARN client/internal/dns/upstream.go:254: probing upstream nameserver 100.96.118.81:5353: with udp: read udp 100.96.48.79:57094->100.96.118.81:5353: i/o timeout 2025-10-02T09:47:42+07:00 WARN client/internal/dns/upstream.go:344: Upstream resolving is Disabled for 30s 2025-10-02T09:47:42+07:00 WARN client/internal/dns/upstream.go:254: probing upstream nameserver 100.96.118.81:5353: with udp: read udp 100.96.48.79:57093->100.96.118.81:5353: i/o timeout 2025-10-02T09:47:42+07:00 WARN client/internal/dns/upstream.go:254: probing upstream nameserver 100.96.118.81:5353: with udp: read udp 100.96.48.79:57095->100.96.118.81:5353: i/o timeout 2025-10-02T09:47:42+07:00 WARN client/internal/dns/upstream.go:344: Upstream resolving is Disabled for 30s 2025-10-02T09:47:42+07:00 INFO [nameservers: [{100.96.118.81 udp 5353}]] client/internal/dns/server.go:830: Temporarily deactivating nameservers group due to timeout 2025-10-02T09:47:45+07:00 INFO client/internal/dns/host_windows.go:316: registered DNS names 2025-10-02T09:47:45+07:00 INFO client/internal/dns/host_windows.go:339: flushed DNS cache 2025-10-02T09:47:45+07:00 INFO client/internal/dns/upstream.go:322: upstreams 100.96.118.81:5353 are responsive again. Adding them back to system 2025-10-02T09:47:45+07:00 INFO client/internal/dns/upstream.go:322: upstreams 100.96.118.81:5353 are responsive again. Adding them back to system 2025-10-02T09:47:45+07:00 INFO client/internal/dns/host_windows.go:265: added 4 separate NRPT entries. Domain list: [.app1.anon-shW8E.domain .app2.anon-shW8E.domain .anon-Tf6Pc.domain .96.100.in-addr.arpa] 2025-10-02T09:47:45+07:00 INFO client/internal/dns/host_windows.go:346: updated search domains: [anon-Tf6Pc.domain] 2025-10-02T09:47:45+07:00 INFO client/internal/dns/host_windows.go:265: added 4 separate NRPT entries. Domain list: [.app1.anon-shW8E.domain .app2.anon-shW8E.domain .anon-Tf6Pc.domain .96.100.in-addr.arpa] 2025-10-02T09:47:45+07:00 INFO client/internal/dns/host_windows.go:346: updated search domains: [anon-Tf6Pc.domain] 2025-10-02T09:47:45+07:00 INFO client/internal/dns/upstream.go:322: upstreams 100.96.118.81:5353 are responsive again. Adding them back to system 2025-10-02T09:47:45+07:00 INFO client/internal/dns/host_windows.go:265: added 4 separate NRPT entries. Domain list: [.app1.anon-shW8E.domain .app2.anon-shW8E.domain .anon-Tf6Pc.domain .96.100.in-addr.arpa] 2025-10-02T09:47:45+07:00 INFO client/internal/dns/host_windows.go:346: updated search domains: [anon-Tf6Pc.domain] 2025-10-02T09:47:45+07:00 INFO client/internal/dns/upstream.go:322: upstreams 100.96.118.81:5353 are responsive again. Adding them back to system 2025-10-02T09:47:45+07:00 INFO client/internal/dns/host_windows.go:265: added 4 separate NRPT entries. Domain list: [.app1.anon-shW8E.domain .app2.anon-shW8E.domain .anon-Tf6Pc.domain .96.100.in-addr.arpa] 2025-10-02T09:47:45+07:00 INFO client/internal/dns/host_windows.go:346: updated search domains: [anon-Tf6Pc.domain] 2025-10-02T09:47:45+07:00 INFO client/internal/dns/host_windows.go:316: registered DNS names 2025-10-02T09:47:45+07:00 INFO client/internal/dns/host_windows.go:316: registered DNS names 2025-10-02T09:47:45+07:00 INFO client/internal/dns/host_windows.go:339: flushed DNS cache 2025-10-02T09:47:45+07:00 INFO client/internal/dns/host_windows.go:339: flushed DNS cache 2025-10-02T09:47:45+07:00 INFO client/internal/dns/host_windows.go:316: registered DNS names 2025-10-02T09:47:45+07:00 INFO client/internal/dns/host_windows.go:339: flushed DNS cache 2025-10-02T09:47:45+07:00 INFO client/internal/dns/host_windows.go:316: registered DNS names 2025-10-02T09:47:45+07:00 INFO client/internal/dns/host_windows.go:339: flushed DNS cache 2025-10-02T09:47:48+07:00 INFO client/internal/dns/host_windows.go:316: registered DNS names 2025-10-02T09:47:48+07:00 INFO client/internal/dns/host_windows.go:316: registered DNS names 2025-10-02T09:47:48+07:00 INFO client/internal/dns/host_windows.go:339: flushed DNS cache 2025-10-02T09:47:48+07:00 INFO client/internal/dns/host_windows.go:339: flushed DNS cache 2025-10-02T09:47:48+07:00 INFO client/internal/dns/host_windows.go:316: registered DNS names 2025-10-02T09:47:48+07:00 INFO client/internal/dns/host_windows.go:339: flushed DNS cache 2025-10-02T09:47:48+07:00 INFO client/internal/dns/host_windows.go:316: registered DNS names 2025-10-02T09:47:48+07:00 INFO client/internal/dns/host_windows.go:339: flushed DNS cache ``` ``` PS C:\Users\user> netbird status -dA Peers detail: iphone.anon-Tf6Pc.domain: NetBird IP: 100.96.230.203/32 Public key: cREimgML75hSklSwJBw0HxIXwErdzUhJhmYDv4AUvnI= Status: Idle -- detail -- Connection type: P2P ICE candidate (Local/Remote): -/- ICE candidate endpoints (Local/Remote): -/- Relay server address: Last connection update: 30 minutes, 9 seconds ago Last WireGuard handshake: - Transfer status (received/sent) 0 B/0 B Quantum resistance: false Networks: - Latency: 0s server1.anon-Tf6Pc.domain: NetBird IP: 100.96.118.81 Public key: JQHuesauk1bns3ZXZFmAmyDj04dRCFK0ljeZi/1Tk3E= Status: Connected -- detail -- Connection type: P2P ICE candidate (Local/Remote): host/srflx ICE candidate endpoints (Local/Remote): 192.168.0.100:51820/198.51.100.0:51565 Relay server address: rel://netbird.anon-shW8E.domain:33080 Last connection update: 43 minutes, 46 seconds ago Last WireGuard handshake: 1 minute, 52 seconds ago Transfer status (received/sent) 831.2 KiB/47.8 KiB Quantum resistance: false Networks: - Latency: 53.1689ms server2.anon-Tf6Pc.domain: NetBird IP: 100.96.171.170 Public key: snzWuUuEMVowIL97c6Df+ftYVvg9ZqpMV4M/Umimz1c= Status: Connected -- detail -- Connection type: P2P ICE candidate (Local/Remote): host/srflx ICE candidate endpoints (Local/Remote): 172.24.176.1:51820/198.51.100.1:51820 Relay server address: rel://netbird.anon-shW8E.domain:33080 Last connection update: 43 minutes, 58 seconds ago Last WireGuard handshake: 1 minute, 51 seconds ago Transfer status (received/sent) 21.2 KiB/15.3 KiB Quantum resistance: false Networks: - Latency: 67.3631ms Events: [WARNING] DNS (cf37375c-19cd-4be5-a834-bb02f5313296) Message: All upstream servers failed (probe failed) Time: 1 hour, 2 minutes ago Metadata: upstreams: 100.96.118.81:5353 [INFO] SYSTEM (6ff3faac-eccf-482b-8a1b-fcbddbfd5f08) Message: Network map updated Time: 1 hour, 2 minutes ago [INFO] SYSTEM (73df67e7-25dd-4d7d-b2b5-d75951ecdc04) Message: Network map updated Time: 50 minutes, 49 seconds ago [WARNING] DNS (7a1db8cc-40e2-4bb6-a211-7176f1ab3e1d) Message: All upstream servers failed (probe failed) Time: 43 minutes, 59 seconds ago Metadata: upstreams: 100.96.118.81:5353 [WARNING] DNS (6897df03-928e-43cb-a7d6-f648958e7978) Message: All upstream servers failed (probe failed) Time: 43 minutes, 59 seconds ago Metadata: upstreams: 100.96.118.81:5353 [WARNING] DNS (302cadba-416b-4066-b376-5904b891ee06) Message: All upstream servers failed (probe failed) Time: 43 minutes, 59 seconds ago Metadata: upstreams: 100.96.118.81:5353 [WARNING] DNS (033d4a7b-2607-4225-8aeb-a92ee66e5b6d) Message: All upstream servers failed (probe failed) Time: 43 minutes, 59 seconds ago Metadata: upstreams: 100.96.118.81:5353 [INFO] SYSTEM (81472bd8-6ea6-4b64-bea4-c9d5acd21da4) Message: Network map updated Time: 43 minutes, 59 seconds ago [INFO] SYSTEM (6c019aa2-9e8e-4741-ac04-2f436eac514b) Message: Network map updated Time: 30 minutes, 27 seconds ago [INFO] SYSTEM (be0e9de5-6849-477f-84e8-b0636747c663) Message: Network map updated Time: 30 minutes, 9 seconds ago OS: windows/amd64 Daemon version: 0.59.0 CLI version: 0.59.0 Profile: default Management: Connected to https://netbird.anon-shW8E.domain:443 Signal: Connected to https://netbird.anon-shW8E.domain:443 Relays: [stun:netbird.anon-shW8E.domain:3478] is Available [turn:netbird.anon-shW8E.domain:3478?transport=udp] is Available [rel://netbird.anon-shW8E.domain:33080] is Available Nameservers: [100.96.118.81:5353] for [app1.anon-shW8E.domain, app2.anon-shW8E.domain] is Available FQDN: ridys.anon-Tf6Pc.domain NetBird IP: 100.96.48.79/16 Interface type: Userspace Quantum resistance: false Lazy connection: false Networks: - Forwarding rules: 0 Peers count: 2/3 Connected ``` **Screenshots** If applicable, add screenshots to help explain your problem. **Additional context** **OS Name**: Microsoft Windows 11 Pro **OS Version**: 10.0.26100 N/A Build 26100 **Have you tried these troubleshooting steps?** - [x] Reviewed [client troubleshooting](https://docs.netbird.io/how-to/troubleshooting-client) (if applicable) - [x] Checked for newer NetBird versions - [x] Searched for similar issues on GitHub (including closed ones) - [x] Restarted the NetBird client - [x] Disabled other VPN software - [x] Checked firewall settings
saavagebueno added the triage-needed label 2025-11-20 07:07:47 -05:00
saavagebueno commented 2025-11-20 07:07:48 -05:00
Author
Owner
Copy Link

@roberthase commented on GitHub (Oct 2, 2025):

I was able to confirm this on my end.

@roberthase commented on GitHub (Oct 2, 2025): I was able to confirm this on my end.
saavagebueno commented 2025-11-20 07:07:48 -05:00
Author
Owner
Copy Link

@hakansa commented on GitHub (Oct 2, 2025):

@Ridys could you run following powershell commands and share the output?

# Dump GPO policies
Get-ChildItem -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient\DnsPolicyConfig\NetBird-Match" -Recurse |
    ForEach-Object {
        Write-Output "`n=== $($_.Name) ==="
        Get-ItemProperty $_.PSPath | Format-List *
    }

# Dump runtime policies
Get-ChildItem -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters\DnsPolicyConfig\NetBird-Match" -Recurse |
    ForEach-Object {
        Write-Output "`n=== $($_.Name) ==="
        Get-ItemProperty $_.PSPath | Format-List *
    }
@hakansa commented on GitHub (Oct 2, 2025): @Ridys could you run following powershell commands and share the output? ```powershell # Dump GPO policies Get-ChildItem -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient\DnsPolicyConfig\NetBird-Match" -Recurse | ForEach-Object { Write-Output "`n=== $($_.Name) ===" Get-ItemProperty $_.PSPath | Format-List * } # Dump runtime policies Get-ChildItem -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters\DnsPolicyConfig\NetBird-Match" -Recurse | ForEach-Object { Write-Output "`n=== $($_.Name) ===" Get-ItemProperty $_.PSPath | Format-List * } ```
saavagebueno commented 2025-11-20 07:07:48 -05:00
Author
Owner
Copy Link

@SuperKali commented on GitHub (Oct 2, 2025):

i confirm on my side

@SuperKali commented on GitHub (Oct 2, 2025): i confirm on my side
saavagebueno commented 2025-11-20 07:07:49 -05:00
Author
Owner
Copy Link

@roberthase commented on GitHub (Oct 2, 2025):

The commands dont output anything on my system, but i looked up manually

HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient\DnsPolicyConfig\NetBird-Match

Missing on both versions 0.58.2. and 0.59.0 : DNSClient\DnsPolicyConfig\NetBird-Match

HKLM:\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters\DnsPolicyConfig\NetBird-Match

Missing entries from Controller on 0.59.0 , just some generic entry:

Image

On 0.58.2. everything is populated correctly.

@roberthase commented on GitHub (Oct 2, 2025): The commands dont output anything on my system, but i looked up manually HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient\DnsPolicyConfig\NetBird-Match Missing on both versions 0.58.2. and 0.59.0 : DNSClient\DnsPolicyConfig\NetBird-Match HKLM:\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters\DnsPolicyConfig\NetBird-Match Missing entries from Controller on 0.59.0 , just some generic entry: <img width="684" height="112" alt="Image" src="https://github.com/user-attachments/assets/67393abd-9aa0-43f3-8125-75e0c9539ef0" /> On 0.58.2. everything is populated correctly.
saavagebueno commented 2025-11-20 07:07:49 -05:00
Author
Owner
Copy Link

@hakansa commented on GitHub (Oct 2, 2025):

@roberthase could u upload a debug bundle? netbird debug bundle -UA

@hakansa commented on GitHub (Oct 2, 2025): @roberthase could u upload a debug bundle? `netbird debug bundle -UA`
saavagebueno commented 2025-11-20 07:07:49 -05:00
Author
Owner
Copy Link

@AirP0WeR commented on GitHub (Oct 2, 2025):

Same issue for me.
@hakansa
netbird.debug.1713944504.zip

rollout to 0.58.2 DNS works fine

@AirP0WeR commented on GitHub (Oct 2, 2025): Same issue for me. @hakansa [netbird.debug.1713944504.zip](https://github.com/user-attachments/files/22656536/netbird.debug.1713944504.zip) rollout to 0.58.2 DNS works fine
saavagebueno commented 2025-11-20 07:07:49 -05:00
Author
Owner
Copy Link

@Ridys commented on GitHub (Oct 2, 2025):

@Ridys could you run following powershell commands and share the output?

PowerShell 7.5.3
PS C:\Users\user> Get-ChildItem -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient\DnsPolicyConfig\NetBird-Match" -Recurse |
>>     ForEach-Object {
>>         Write-Output "`n=== $($_.Name) ==="
>>         Get-ItemProperty $_.PSPath | Format-List *
>>     }
Get-ChildItem: Cannot find path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient\DnsPolicyConfig\' because it does not exist.
PS C:\Users\user> Get-ChildItem -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters\DnsPolicyConfig\NetBird-Match" -Recurse |
>>     ForEach-Object {
>>         Write-Output "`n=== $($_.Name) ==="
>>         Get-ItemProperty $_.PSPath | Format-List *
>>     }
PS C:\Users\user>
@Ridys commented on GitHub (Oct 2, 2025): > [@Ridys](https://github.com/Ridys) could you run following powershell commands and share the output? ``` PowerShell 7.5.3 PS C:\Users\user> Get-ChildItem -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient\DnsPolicyConfig\NetBird-Match" -Recurse | >> ForEach-Object { >> Write-Output "`n=== $($_.Name) ===" >> Get-ItemProperty $_.PSPath | Format-List * >> } Get-ChildItem: Cannot find path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient\DnsPolicyConfig\' because it does not exist. PS C:\Users\user> Get-ChildItem -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters\DnsPolicyConfig\NetBird-Match" -Recurse | >> ForEach-Object { >> Write-Output "`n=== $($_.Name) ===" >> Get-ItemProperty $_.PSPath | Format-List * >> } PS C:\Users\user> ```
saavagebueno commented 2025-11-20 07:07:49 -05:00
Author
Owner
Copy Link

@hakansa commented on GitHub (Oct 2, 2025):

Thanks for the cooperation guys, we've already identified the issue and the fix. Will release a new version with the fix soon.

@hakansa commented on GitHub (Oct 2, 2025): Thanks for the cooperation guys, we've already identified the issue and the [fix](https://github.com/netbirdio/netbird/pull/4572). Will release a new version with the fix soon.
saavagebueno commented 2025-11-20 07:07:49 -05:00
Author
Owner
Copy Link

@hakansa commented on GitHub (Oct 2, 2025):

v0.59.1 deployed. Please try again with the latest and let me know if still something is wrong.

@hakansa commented on GitHub (Oct 2, 2025): [v0.59.1](https://github.com/netbirdio/netbird/releases/tag/v0.59.1) deployed. Please try again with the latest and let me know if still something is wrong.
saavagebueno commented 2025-11-20 07:07:50 -05:00
Author
Owner
Copy Link

@SuperKali commented on GitHub (Oct 2, 2025):

I can confirm now that's working again, thanks

@SuperKali commented on GitHub (Oct 2, 2025): I can confirm now that's working again, thanks
saavagebueno commented 2025-11-20 07:07:50 -05:00
Author
Owner
Copy Link

@flotpg commented on GitHub (Oct 28, 2025):

Today I tried it on a Windows 11 25H2 machine (which is only Entra ID joined, no local onprem AD join) and suddenly it's also broken there as well.
I only get DNS if I set the DNS server to match ALL domains but I don't want to push every DNS query through the tunnel.
No GPOs applied...

@flotpg commented on GitHub (Oct 28, 2025): Today I tried it on a Windows 11 25H2 machine (which is only Entra ID joined, no local onprem AD join) and suddenly it's also broken there as well. I only get DNS if I set the DNS server to match ALL domains but I don't want to push every DNS query through the tunnel. No GPOs applied...
saavagebueno commented 2025-11-20 07:07:50 -05:00
Author
Owner
Copy Link

@tkolaski commented on GitHub (Nov 13, 2025):

I have the same problem, if I change the dns netbird up --dns-resolver-address "local_dns_srv:53" everything starts working - access to local domains is back - debian 13 - 0.59.12

@tkolaski commented on GitHub (Nov 13, 2025): I have the same problem, if I change the dns netbird up --dns-resolver-address "local_dns_srv:53" everything starts working - access to local domains is back - debian 13 - 0.59.12
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
2021 Q4
2022 Q1
2022 Q1
accessibility
acl
agent
agent
Android
Android
api
authentik
automation
azure
battery-usage
bug
cache
client
client-ui
cloud
cloud-only
cloudflare
community
compatibility
config-idp
config-issue
connection
contribution
coturn
cross-vpn
dashboard
data-usage
distribution
dns
docker
documentation
duplicate
enhancement
enhancement
event-stream
feature-request
freebsd
getting-started
go
good first issue
gui
help wanted
home-assistant
idp
inconsistency
integration
integrations
ios
ipv6
jwt
k8s
keycloak
linux
login
macos
management-service
missing-docs
mobile
moved-internal
needs-review
netbird-ui
networking
new-platform
nginx
notification
okta
openwrt
packaging
peer-management
peer-management
peer-management
performance
postgres
posture-checks
psk
pull-request
Mirrored from GitHub Pull Request
 question
refactor
relay
release
rfc
routes
security
security-related
self-hosting
server
signal
sleep-issue
ssh
ssl
status
store
synology
system-compatibility-issue
test-suite
third-party-integration
triage
triage-needed
troubleshooting
UX
waiting-feedback
windows
wontfix
zitadel
No Label triage-needed
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
saavagebueno
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: SVI/netbird#2328
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?