SVI/netbird
1
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-06-11 09:52:11 -04:00
Code Issues 3.0k Packages Projects Releases 10 Wiki Activity

android connected to exit node running a vpn will not work #2330

New Issue
Closed
opened 2025-11-20 07:07:51 -05:00 by saavagebueno · 9 comments
saavagebueno commented 2025-11-20 07:07:51 -05:00
Owner
Copy Link

Originally created by @mikebakke on GitHub (Sep 30, 2025).

I have a linux server configured as an exit node. On this I have a WG tunnel to my vpn providers' French POP. After adding necessary IPTABLES config I am able to connect correctly and access sites via France from:

  1. A Linux desktop on my lan simply set with its' default gateway as the exit node - netbird not installed on this client - all works
  2. Another linux server on my lan which is on the Netbird network. From CLI I select my exit node and again - all works as expected.

As soon as I connect my android mobile to the netbird network all network access fails until I disable the exit node and reconnect. Using the mobile on the netbird network works fine other than that - network and dns is correct.

As a side note- it is bizarre that there's no way to control use of networks on the mobile client. If the exit node is up in management then the mobile tries to use it.

Environment - self hosted on a debian trixie vps.
Linux clients - 0.58.2
Android - 0.57.0

Originally created by @mikebakke on GitHub (Sep 30, 2025). I have a linux server configured as an exit node. On this I have a WG tunnel to my vpn providers' French POP. After adding necessary IPTABLES config I am able to connect correctly and access sites via France from: 1. A Linux desktop on my lan simply set with its' default gateway as the exit node - netbird not installed on this client - all works 2. Another linux server on my lan which is on the Netbird network. From CLI I select my exit node and again - all works as expected. As soon as I connect my android mobile to the netbird network all network access fails until I disable the exit node and reconnect. Using the mobile on the netbird network works fine other than that - network and dns is correct. As a side note- it is bizarre that there's no way to control use of networks on the mobile client. If the exit node is up in management then the mobile tries to use it. Environment - self hosted on a debian trixie vps. Linux clients - 0.58.2 Android - 0.57.0
saavagebueno added the clientmobiletriage-neededself-hosting labels 2025-11-20 07:07:51 -05:00
saavagebueno commented 2025-11-20 07:07:52 -05:00
Author
Owner
Copy Link

@mikebakke commented on GitHub (Oct 2, 2025):

Side note - I tried the same setup on a headscale/tailscale setup with identical results. Tested with 2 different phones (Nothing and Moto) with identical results - enable exit node and network access hangs.

@mikebakke commented on GitHub (Oct 2, 2025): Side note - I tried the same setup on a headscale/tailscale setup with identical results. Tested with 2 different phones (Nothing and Moto) with identical results - enable exit node and network access hangs.
saavagebueno commented 2025-11-20 07:07:52 -05:00
Author
Owner
Copy Link

@mikebakke commented on GitHub (Oct 2, 2025):

Ok - even worse. I realised my VPS is actually hosted in France so I installed Netbird on it and configured it as an exit node. From a linux client I select the exit node and I immediately get a French external IP.

Mobile - the usual hang.

From this I have to currently conclude that exit nodes simply do not work with the android client.

@mikebakke commented on GitHub (Oct 2, 2025): Ok - even worse. I realised my VPS is actually hosted in France so I installed Netbird on it and configured it as an exit node. From a linux client I select the exit node and I immediately get a French external IP. Mobile - the usual hang. From this I have to currently conclude that exit nodes simply do not work with the android client.
saavagebueno commented 2025-11-20 07:07:52 -05:00
Author
Owner
Copy Link

@mikebakke commented on GitHub (Oct 6, 2025):

Tested this morning with the android client released 2nd Oct - no change. As soon as I start the client, the phone loses all network access to the net. I did try the advanced settings and the only one which maintained external access was disabling server routes which of course means it's no longer using the exit route of 0.0.0.0/0 which was the whole point of doing this.

@mikebakke commented on GitHub (Oct 6, 2025): Tested this morning with the android client released 2nd Oct - no change. As soon as I start the client, the phone loses all network access to the net. I did try the advanced settings and the only one which maintained external access was disabling server routes which of course means it's no longer using the exit route of 0.0.0.0/0 which was the whole point of doing this.
saavagebueno commented 2025-11-20 07:07:53 -05:00
Author
Owner
Copy Link

@nazarewk commented on GitHub (Oct 6, 2025):

Since you have reported a few other VPN solutions not working, it sounds like there is something wrong/particularly restrictive with your mobile service provider. It might not let you use the internet unless you go through their infrastructure. Does it have any form of captive portal or restrictions in any other places?

Did you determine whether it's a DNS or the internet access not working? You could install app like PingTools and try to run ping against some IP address and against a domain name.

It's unlikely to have something misconfigured on Dashboard if you have it working on other devices, but could you post some screenshots of your Dashboard setup just in case?

I'm mostly interested in seeing all of the Groups for:

  • Exit Node configuration
  • Peer details of one of the working machines and android
  • Access Policies
  • Nameservers
@nazarewk commented on GitHub (Oct 6, 2025): Since you have reported a few other VPN solutions not working, it sounds like there is something wrong/particularly restrictive with your mobile service provider. It might not let you use the internet unless you go through their infrastructure. Does it have any form of captive portal or restrictions in any other places? Did you determine whether it's a DNS or the internet access not working? You could install app like PingTools and try to run `ping` against some IP address and against a domain name. --- It's unlikely to have something misconfigured on Dashboard if you have it working on other devices, but could you post some screenshots of your Dashboard setup just in case? I'm mostly interested in seeing all of the Groups for: - Exit Node configuration - Peer details of one of the working machines and android - Access Policies - Nameservers
saavagebueno commented 2025-11-20 07:07:53 -05:00
Author
Owner
Copy Link

@mikebakke commented on GitHub (Oct 6, 2025):

Thank you for the suggestions. I had just tried to change the exit node configuration to auto apply the exit route to all peers with the approved groups and that worked. I now have a French IP on my mobile.

I normally set it to not apply because I want to choose from my nodes whether or not to apply it. As I noted above, on the android client I can't see any way to select/de-select the exit node routing. It's either always on or always off based on the dashboard setting.

My work-around for now I think will have to be to set multiple exit nodes on the peer - one with select for general linux use and one with auto-apply dedicated to a particular mobile via specific group and just accept that if I sign into netbird from the mobile I have the exit route.

Hopefully the android client can be updated in future to allow network selection as the linux client can.

Thanks again.

@mikebakke commented on GitHub (Oct 6, 2025): Thank you for the suggestions. I had just tried to change the exit node configuration to auto apply the exit route to all peers with the approved groups and that worked. I now have a French IP on my mobile. I normally set it to not apply because I want to choose from my nodes whether or not to apply it. As I noted above, on the android client I can't see any way to select/de-select the exit node routing. It's either always on or always off based on the dashboard setting. My work-around for now I think will have to be to set multiple exit nodes on the peer - one with select for general linux use and one with auto-apply dedicated to a particular mobile via specific group and just accept that if I sign into netbird from the mobile I have the exit route. Hopefully the android client can be updated in future to allow network selection as the linux client can. Thanks again.
saavagebueno commented 2025-11-20 07:07:53 -05:00
Author
Owner
Copy Link

@glaz123 commented on GitHub (Oct 6, 2025):

Great! Your workaround works for me. I got this problem with exit route that stopped all traffic on mobile/tablet (trafic internal to netbird still works) on all official android clients (Android 15/Android 12) and jetbird 1.4.5 client (netbird 0.58.1 inside). Only jetbird version 1.4.4 (Netbird v0.54.2 inside) works as expected before workaround. Today I create exit node only for android (with auto apply), and traffic starting to flow as expected on all android clients.

@glaz123 commented on GitHub (Oct 6, 2025): Great! Your workaround works for me. I got this problem with exit route that stopped all traffic on mobile/tablet (trafic internal to netbird still works) on all official android clients (Android 15/Android 12) and jetbird 1.4.5 client (netbird 0.58.1 inside). Only jetbird version 1.4.4 (Netbird v0.54.2 inside) works as expected before workaround. Today I create exit node only for android (with auto apply), and traffic starting to flow as expected on all android clients.
saavagebueno commented 2025-11-20 07:07:53 -05:00
Author
Owner
Copy Link

@mikebakke commented on GitHub (Oct 6, 2025):

@glaz123

Found another wrinkle to this.

I can control it from android - if I have the auto apply enabled to the exit node definition BUT then on android use the advanced menu and enable the "disable client routes" switch I can be connected to my netbird network but not be using the exit route - I still have a UK based IP and I can reach connected netbird nodes. The thing to remember is that changing the toggle in the client does not take effect until I disconnect and reconnect.

It's not perfect yet because my end use case is that I choose which exit node to route via and I see no way to achieve that client side.

@mikebakke commented on GitHub (Oct 6, 2025): @glaz123 Found another wrinkle to this. I can control it from android - if I have the auto apply enabled to the exit node definition BUT then on android use the advanced menu and enable the "disable client routes" switch I can be connected to my netbird network but not be using the exit route - I still have a UK based IP and I can reach connected netbird nodes. The thing to remember is that changing the toggle in the client does not take effect until I disconnect and reconnect. It's not perfect yet because my end use case is that I choose *which* exit node to route via and I see no way to achieve that client side.
saavagebueno commented 2025-11-20 07:07:53 -05:00
Author
Owner
Copy Link

@nazarewk commented on GitHub (Oct 6, 2025):

We will be implementing proper route selection on Android soon to match the desktop/CLI client features.

@nazarewk commented on GitHub (Oct 6, 2025): We will be implementing proper route selection on Android soon to match the desktop/CLI client features.
saavagebueno commented 2025-11-20 07:07:53 -05:00
Author
Owner
Copy Link

@mikebakke commented on GitHub (Oct 6, 2025):

Thank you for confirming this, much appreciated!

@mikebakke commented on GitHub (Oct 6, 2025): Thank you for confirming this, much appreciated!
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
2021 Q4
2022 Q1
2022 Q1
accessibility
acl
agent
agent
Android
Android
api
authentik
automation
azure
battery-usage
bug
cache
client
client-ui
cloud
cloud-only
cloudflare
community
compatibility
config-idp
config-issue
connection
contribution
coturn
cross-vpn
dashboard
data-usage
distribution
dns
docker
documentation
duplicate
enhancement
enhancement
event-stream
feature-request
freebsd
getting-started
go
good first issue
gui
help wanted
home-assistant
idp
inconsistency
integration
integrations
ios
ipv6
jwt
k8s
keycloak
linux
login
macos
management-service
missing-docs
mobile
moved-internal
needs-review
netbird-ui
networking
new-platform
nginx
notification
okta
openwrt
packaging
peer-management
peer-management
peer-management
performance
postgres
posture-checks
psk
pull-request
Mirrored from GitHub Pull Request
 question
refactor
relay
release
rfc
routes
security
security-related
self-hosting
server
signal
sleep-issue
ssh
ssl
status
store
synology
system-compatibility-issue
test-suite
third-party-integration
triage
triage-needed
troubleshooting
UX
waiting-feedback
windows
wontfix
zitadel
No Label client mobile self-hosting triage-needed
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
saavagebueno
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: SVI/netbird#2330
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?