SVI/netbird
1
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-05-14 20:21:59 -04:00
Code Issues 3.0k Packages Projects Releases 10 Wiki Activity

RDP connection from the dashboard — auth loop #2336

New Issue
Closed
opened 2025-11-20 07:07:57 -05:00 by saavagebueno · 7 comments
saavagebueno commented 2025-11-20 07:07:57 -05:00
Owner
Copy Link

Originally created by @streletskiy on GitHub (Oct 2, 2025).

Describe the problem

When I try to connect via new RDP feature on my self-hosted NetBird dashboard to any windows peer I got auth loop — just redirect to peers section on desktop and choose account window when open dashboard on mobile device

To Reproduce

Steps to reproduce the behavior:

  1. Go to peers window
  2. Click on connect -> RDP on any windows host
  3. Get redirect
  4. See peers window again

Expected behavior

I expect to see RDP auth window

Are you using NetBird Cloud?

No, I use self-hosted version

NetBird version

`0.59.1

Is any other VPN software installed?

No

Debug output

To help us resolve the problem, please attach the following anonymized status output

netbird status -dA

Create and upload a debug bundle, and share the returned file key:

netbird debug for 1m -AS -U

Uploaded files are automatically deleted after 30 days.

Alternatively, create the file only and attach it here manually:

netbird debug for 1m -AS

Screenshots

If applicable, add screenshots to help explain your problem.

Additional context

Add any other context about the problem here.

Have you tried these troubleshooting steps?

  • [x ] Reviewed client troubleshooting (if applicable)
  • [x ] Checked for newer NetBird versions
  • [x ] Searched for similar issues on GitHub (including closed ones)
  • [x ] Restarted the NetBird client
  • [x ] Disabled other VPN software
  • [x ] Checked firewall settings
Originally created by @streletskiy on GitHub (Oct 2, 2025). **Describe the problem** When I try to connect via new RDP feature on my self-hosted NetBird dashboard to any windows peer I got auth loop — just redirect to peers section on desktop and choose account window when open dashboard on mobile device **To Reproduce** Steps to reproduce the behavior: 1. Go to peers window 2. Click on connect -> RDP on any windows host 3. Get redirect 4. See peers window again **Expected behavior** I expect to see RDP auth window **Are you using NetBird Cloud?** No, I use self-hosted version **NetBird version** `0.59.1 **Is any other VPN software installed?** No **Debug output** To help us resolve the problem, please attach the following anonymized status output netbird status -dA Create and upload a debug bundle, and share the returned file key: netbird debug for 1m -AS -U *Uploaded files are automatically deleted after 30 days.* Alternatively, create the file only and attach it here manually: netbird debug for 1m -AS **Screenshots** If applicable, add screenshots to help explain your problem. **Additional context** Add any other context about the problem here. **Have you tried these troubleshooting steps?** - [x ] Reviewed [client troubleshooting](https://docs.netbird.io/how-to/troubleshooting-client) (if applicable) - [x ] Checked for newer NetBird versions - [x ] Searched for similar issues on GitHub (including closed ones) - [x ] Restarted the NetBird client - [x ] Disabled other VPN software - [x ] Checked firewall settings
saavagebueno added the triage-needed label 2025-11-20 07:07:57 -05:00
saavagebueno commented 2025-11-20 07:07:58 -05:00
Author
Owner
Copy Link

@pri11er commented on GitHub (Oct 2, 2025):

I have the same behavior with SSH to Linux peers. Also self-hosted.

@pri11er commented on GitHub (Oct 2, 2025): I have the same behavior with SSH to Linux peers. Also self-hosted.
saavagebueno commented 2025-11-20 07:07:58 -05:00
Author
Owner
Copy Link

@mlsmaycon commented on GitHub (Oct 3, 2025):

We are fixing this issue for some IdPs. We should release it soon.

@mlsmaycon commented on GitHub (Oct 3, 2025): We are fixing this issue for some IdPs. We should release it soon.
saavagebueno commented 2025-11-20 07:07:58 -05:00
Author
Owner
Copy Link

@mlsmaycon commented on GitHub (Oct 3, 2025):

We've released a new version of the dashboard handling a few issues, but with the connect button disabled. We are investigating a few issues on some deployments. Once they are resolved, we will enable it again.

@mlsmaycon commented on GitHub (Oct 3, 2025): We've released a new version of the dashboard handling a few issues, but with the connect button disabled. We are investigating a few issues on some deployments. Once they are resolved, we will enable it again.
saavagebueno commented 2025-11-20 07:07:58 -05:00
Author
Owner
Copy Link

@flotpg commented on GitHub (Oct 3, 2025):

Same here, Entra ID, no reverse roxy

With 2.19.1:
Image

My config:

#version: "3"
services:
  #UI dashboard
  dashboard:
    image: netbirdio/dashboard:latest
    #image: netbirdio/dashboard:v2.5.0
    restart: unless-stopped
    ports:
      - 80:80
      - 443:443
    environment:
      # Endpoints
      - NETBIRD_MGMT_API_ENDPOINT=https://netbird.mydomain.com:33073
      - NETBIRD_MGMT_GRPC_API_ENDPOINT=https://netbird.mydomain.com:33073
      # OIDC
      - AUTH_AUDIENCE=UID
      - AUTH_CLIENT_ID=UID
      - AUTH_CLIENT_SECRET=
      - AUTH_AUTHORITY=https://login.microsoftonline.com/UID/v2.0
      - USE_AUTH0=false
      - AUTH_SUPPORTED_SCOPES=openid profile email offline_access User.Read api://UID/api
      - AUTH_REDIRECT_URI=/auth
      - AUTH_SILENT_REDIRECT_URI=/silent-auth
      - NETBIRD_TOKEN_SOURCE=idToken
      # SSL
      - NGINX_SSL_PORT=443
      # Letsencrypt
      - LETSENCRYPT_DOMAIN=netbird.mydomain.com
      - LETSENCRYPT_EMAIL=mail@me.com
    volumes:
      - netbird-letsencrypt:/etc/letsencrypt/

  # Signal
  signal:
    image: netbirdio/signal:latest
    restart: unless-stopped
    volumes:
      - netbird-signal:/var/lib/netbird
    ports:
      - 10000:80
  #      # port and command for Let's Encrypt validation
  #      - 443:443
  #    command: ["--letsencrypt-domain", "netbird.mydomain.com", "--log-file", "console"]

  # Management
  management:
    image: netbirdio/management:latest
    #image: wiretrustee/management:debug-start
    #image: netbirdio/management:0.30.1
    #image: netbirdio/management:0.29.4
    restart: unless-stopped
    depends_on:
      - dashboard
    #environment:
    # - DEBUG=true
    # - NB_DB_REPLACE_CONTEXT=true
    volumes:
      - netbird-mgmt:/var/lib/netbird
      - netbird-letsencrypt:/etc/letsencrypt:ro
      - ./management.json:/etc/netbird/management.json
    ports:
      - 33073:443 #API port
  #    # command for Let's Encrypt validation without dashboard container
  #    command: ["--letsencrypt-domain", "netbird.mydomain.com", "--log-file", "console"]
    command: [
      "--port", "443",
      "--log-file", "console",
      #"--log-file", "/var/lib/netbird/management.log",
      "--log-level", "trace",
      "--disable-anonymous-metrics=false",
      "--single-account-mode-domain=netbird.mydomain.com",
      "--dns-domain=ivo"
      ]

  # Relay
  relay:
    image: netbirdio/relay:latest
    restart: unless-stopped
    environment:
    - NB_LOG_LEVEL=info
    - NB_LISTEN_ADDRESS=:33080
    - NB_EXPOSED_ADDRESS=netbird.mydomain.com:33080
    - NB_AUTH_SECRET=g9mlFdhat4lPJ5HjTUeZMRWCJ8NVOFGOyST+4SBpoJU
    ports:
      - 33080:33080
    logging:
      driver: "json-file"
      options:
        max-size: "500m"
        max-file: "2"

  # Coturn
  coturn:
    image: coturn/coturn:latest
    restart: unless-stopped
    domainname: netbird.mydomain.com
    volumes:
      - ./turnserver.conf:/etc/turnserver.conf:ro
    #      - ./privkey.pem:/etc/coturn/private/privkey.pem:ro
    #      - ./cert.pem:/etc/coturn/certs/cert.pem:ro
    network_mode: host
    command:
      - -c /etc/turnserver.conf

volumes:
  netbird-mgmt:
  netbird-signal:
  netbird-letsencrypt:
@flotpg commented on GitHub (Oct 3, 2025): Same here, Entra ID, no reverse roxy With 2.19.1: <img width="982" height="882" alt="Image" src="https://github.com/user-attachments/assets/d125e6d4-9038-43ba-a6b7-2f3bed73131c" /> My config: ``` #version: "3" services: #UI dashboard dashboard: image: netbirdio/dashboard:latest #image: netbirdio/dashboard:v2.5.0 restart: unless-stopped ports: - 80:80 - 443:443 environment: # Endpoints - NETBIRD_MGMT_API_ENDPOINT=https://netbird.mydomain.com:33073 - NETBIRD_MGMT_GRPC_API_ENDPOINT=https://netbird.mydomain.com:33073 # OIDC - AUTH_AUDIENCE=UID - AUTH_CLIENT_ID=UID - AUTH_CLIENT_SECRET= - AUTH_AUTHORITY=https://login.microsoftonline.com/UID/v2.0 - USE_AUTH0=false - AUTH_SUPPORTED_SCOPES=openid profile email offline_access User.Read api://UID/api - AUTH_REDIRECT_URI=/auth - AUTH_SILENT_REDIRECT_URI=/silent-auth - NETBIRD_TOKEN_SOURCE=idToken # SSL - NGINX_SSL_PORT=443 # Letsencrypt - LETSENCRYPT_DOMAIN=netbird.mydomain.com - LETSENCRYPT_EMAIL=mail@me.com volumes: - netbird-letsencrypt:/etc/letsencrypt/ # Signal signal: image: netbirdio/signal:latest restart: unless-stopped volumes: - netbird-signal:/var/lib/netbird ports: - 10000:80 # # port and command for Let's Encrypt validation # - 443:443 # command: ["--letsencrypt-domain", "netbird.mydomain.com", "--log-file", "console"] # Management management: image: netbirdio/management:latest #image: wiretrustee/management:debug-start #image: netbirdio/management:0.30.1 #image: netbirdio/management:0.29.4 restart: unless-stopped depends_on: - dashboard #environment: # - DEBUG=true # - NB_DB_REPLACE_CONTEXT=true volumes: - netbird-mgmt:/var/lib/netbird - netbird-letsencrypt:/etc/letsencrypt:ro - ./management.json:/etc/netbird/management.json ports: - 33073:443 #API port # # command for Let's Encrypt validation without dashboard container # command: ["--letsencrypt-domain", "netbird.mydomain.com", "--log-file", "console"] command: [ "--port", "443", "--log-file", "console", #"--log-file", "/var/lib/netbird/management.log", "--log-level", "trace", "--disable-anonymous-metrics=false", "--single-account-mode-domain=netbird.mydomain.com", "--dns-domain=ivo" ] # Relay relay: image: netbirdio/relay:latest restart: unless-stopped environment: - NB_LOG_LEVEL=info - NB_LISTEN_ADDRESS=:33080 - NB_EXPOSED_ADDRESS=netbird.mydomain.com:33080 - NB_AUTH_SECRET=g9mlFdhat4lPJ5HjTUeZMRWCJ8NVOFGOyST+4SBpoJU ports: - 33080:33080 logging: driver: "json-file" options: max-size: "500m" max-file: "2" # Coturn coturn: image: coturn/coturn:latest restart: unless-stopped domainname: netbird.mydomain.com volumes: - ./turnserver.conf:/etc/turnserver.conf:ro # - ./privkey.pem:/etc/coturn/private/privkey.pem:ro # - ./cert.pem:/etc/coturn/certs/cert.pem:ro network_mode: host command: - -c /etc/turnserver.conf volumes: netbird-mgmt: netbird-signal: netbird-letsencrypt: ```
saavagebueno commented 2025-11-20 07:07:58 -05:00
Author
Owner
Copy Link

@fede843 commented on GitHub (Oct 3, 2025):

Hi, same issue here, with ssh and Authentik as IdP

@fede843 commented on GitHub (Oct 3, 2025): Hi, same issue here, with ssh and Authentik as IdP
saavagebueno commented 2025-11-20 07:07:59 -05:00
Author
Owner
Copy Link

@ddesmond commented on GitHub (Oct 4, 2025):

Same here

@ddesmond commented on GitHub (Oct 4, 2025): Same here
saavagebueno commented 2025-11-20 07:07:59 -05:00
Author
Owner
Copy Link

@mlsmaycon commented on GitHub (Oct 6, 2025):

Helloq folks, we've released a new version.

Please update the management, signal, and dashboard. If you deployed using our quick-start guide, ensure to review the steps in the following URL as some ports have changed:

https://docs.netbird.io/selfhosted/selfhosted-quickstart#support-browser-clients

For those using Traefik or Nginx, we've updated the Docker template from our infrastructure_files:

https://github.com/netbirdio/netbird/blob/main/infrastructure_files/docker-compose.yml.tmpl.traefik
https://github.com/netbirdio/netbird/blob/main/infrastructure_files/nginx.tmpl.conf

@mlsmaycon commented on GitHub (Oct 6, 2025): Helloq folks, we've released a new version. Please update the management, signal, and dashboard. If you deployed using our quick-start guide, ensure to review the steps in the following URL as some ports have changed: https://docs.netbird.io/selfhosted/selfhosted-quickstart#support-browser-clients For those using Traefik or Nginx, we've updated the Docker template from our infrastructure_files: https://github.com/netbirdio/netbird/blob/main/infrastructure_files/docker-compose.yml.tmpl.traefik https://github.com/netbirdio/netbird/blob/main/infrastructure_files/nginx.tmpl.conf
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
2021 Q4
2022 Q1
2022 Q1
accessibility
acl
agent
agent
Android
Android
api
authentik
automation
azure
battery-usage
bug
cache
client
client-ui
cloud
cloud-only
cloudflare
community
compatibility
config-idp
config-issue
connection
contribution
coturn
cross-vpn
dashboard
data-usage
distribution
dns
docker
documentation
duplicate
enhancement
enhancement
event-stream
feature-request
freebsd
getting-started
go
good first issue
gui
help wanted
home-assistant
idp
inconsistency
integration
integrations
ios
ipv6
jwt
k8s
keycloak
linux
login
macos
management-service
missing-docs
mobile
moved-internal
needs-review
netbird-ui
networking
new-platform
nginx
notification
okta
openwrt
packaging
peer-management
peer-management
peer-management
performance
postgres
posture-checks
psk
pull-request
Mirrored from GitHub Pull Request
 question
refactor
relay
release
rfc
routes
security
security-related
self-hosting
server
signal
sleep-issue
ssh
ssl
status
store
synology
system-compatibility-issue
test-suite
third-party-integration
triage
triage-needed
troubleshooting
UX
waiting-feedback
windows
wontfix
zitadel
No Label triage-needed
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
saavagebueno
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: SVI/netbird#2336
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?