SVI/netbird
1
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-07-24 15:03:59 -04:00
Code Issues 3.0k Packages Projects Releases 10 Wiki Activity

Windows DNS isues on AD DC and AD joined Windows machines #383

New Issue
Open
opened 2025-11-20 05:10:34 -05:00 by saavagebueno · 23 comments
saavagebueno commented 2025-11-20 05:10:34 -05:00
Owner
Copy Link

Originally created by @bbaumgartl on GitHub (Jun 26, 2023).

It seems like that the netbird search domain is ignored on a Windows Server Active Directory Domain Controller.

After connecting netbird the log states that the search domain was added:

2023-06-23T11:44:27+02:00 INFO client/internal/dns/host_windows.go:181: updated the search domains in the registry with 1 domains. Domain list: [netbird.cloud]

But it does not show up in ipconfig /all under DNS Suffix Search List or Connection-specific DNS Suffix:

Windows IP Configuration

   Host Name . . . . . . . . . . . . : windows-server
   Primary Dns Suffix  . . . . . . . : domain.local
   Node Type . . . . . . . . . . . . : Hybrid
   IP Routing Enabled. . . . . . . . : No
   WINS Proxy Enabled. . . . . . . . : No
   DNS Suffix Search List. . . . . . : domain.local

Unknown adapter wt0:

   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : WireGuard Tunnel
   Physical Address. . . . . . . . . :
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
   IPv4 Address. . . . . . . . . . . : 100.71.19.142(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.0.0
   Default Gateway . . . . . . . . . :
   DHCPv6 IAID . . . . . . . . . . . : 162275179
   DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-22-98-15-90-AC-1F-6B-60-F5-72
   DNS Servers . . . . . . . . . . . : fec0:0:0:ffff::1%1
                                       fec0:0:0:ffff::2%1
                                       fec0:0:0:ffff::3%1
   NetBIOS over Tcpip. . . . . . . . : Enabled

And DNS queries with only the hostname fail:

PS C:\Users\administrator> Resolve-DnsName -Name peer-a
Resolve-DnsName : peer-a : DNS name does not exist
At line:1 char:1
+ Resolve-DnsName -Name  peer-a
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : ResourceUnavailable: (peer-a:String) [Resolve-DnsName], Win32Exception
    + FullyQualifiedErrorId : DNS_ERROR_RCODE_NAME_ERROR,Microsoft.DnsClient.Commands.ResolveDnsName

Using the FQDN does work though:

PS C:\Users\administrator> Resolve-DnsName -Name peer-a.netbird.cloud
Name                                           Type   TTL   Section    IPAddress
----                                           ----   ---   -------    ---------
peer-a.netbird.cloud                           A      300   Answer     100.71.126.42
Originally created by @bbaumgartl on GitHub (Jun 26, 2023). It seems like that the netbird search domain is ignored on a Windows Server Active Directory Domain Controller. After connecting netbird the log states that the search domain was added: ``` 2023-06-23T11:44:27+02:00 INFO client/internal/dns/host_windows.go:181: updated the search domains in the registry with 1 domains. Domain list: [netbird.cloud] ``` But it does not show up in `ipconfig /all` under `DNS Suffix Search List` or `Connection-specific DNS Suffix`: ``` Windows IP Configuration Host Name . . . . . . . . . . . . : windows-server Primary Dns Suffix . . . . . . . : domain.local Node Type . . . . . . . . . . . . : Hybrid IP Routing Enabled. . . . . . . . : No WINS Proxy Enabled. . . . . . . . : No DNS Suffix Search List. . . . . . : domain.local Unknown adapter wt0: Connection-specific DNS Suffix . : Description . . . . . . . . . . . : WireGuard Tunnel Physical Address. . . . . . . . . : DHCP Enabled. . . . . . . . . . . : No Autoconfiguration Enabled . . . . : Yes IPv4 Address. . . . . . . . . . . : 100.71.19.142(Preferred) Subnet Mask . . . . . . . . . . . : 255.255.0.0 Default Gateway . . . . . . . . . : DHCPv6 IAID . . . . . . . . . . . : 162275179 DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-22-98-15-90-AC-1F-6B-60-F5-72 DNS Servers . . . . . . . . . . . : fec0:0:0:ffff::1%1 fec0:0:0:ffff::2%1 fec0:0:0:ffff::3%1 NetBIOS over Tcpip. . . . . . . . : Enabled ``` And DNS queries with only the hostname fail: ```powershell PS C:\Users\administrator> Resolve-DnsName -Name peer-a Resolve-DnsName : peer-a : DNS name does not exist At line:1 char:1 + Resolve-DnsName -Name peer-a + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : ResourceUnavailable: (peer-a:String) [Resolve-DnsName], Win32Exception + FullyQualifiedErrorId : DNS_ERROR_RCODE_NAME_ERROR,Microsoft.DnsClient.Commands.ResolveDnsName ``` Using the FQDN does work though: ```powershell PS C:\Users\administrator> Resolve-DnsName -Name peer-a.netbird.cloud Name Type TTL Section IPAddress ---- ---- --- ------- --------- peer-a.netbird.cloud A 300 Answer 100.71.126.42 ```
saavagebueno commented 2025-11-20 05:10:35 -05:00
Author
Owner
Copy Link

@bbaumgartl commented on GitHub (Jun 27, 2023):

I tried the same configuration on an AD joined Windows 10 machine. DNS resolution for netbird works, but the local AD domain doesn't resolve anymore. It looks like netbird changes the DNS configuration (in the adapter properties) from Append primary and connection specific DNS suffixes to Append these DNS suffixes (in order) (like it is described here https://answers.uillinois.edu/illinois/page.php?id=114224). This somehow means that Windows is only using the suffixes from this list and on a Windows AD DC this seems to have no effect at all (after changing the setting manually while testing it somehow worked but reconnecting netbird broke it again).

I tried two different manual dns configurations with netbird connected:

  1. Activating Append primary and connection specific DNS suffixes and setting DNS suffix for this connection on the wt0 adapter to netbird.cloud. This appends netbird.cloud to the DNS Suffix Search List in ipconfig /all.
  2. Adding domain.local to Append these DNS suffixes (in order) after netbird added netbird.cloud to the list.

Both seem to work (local AD domain and netbird domain are added to the search list and can be resolved) on the Windows AD DC and Windows 10 machine. Maybe one could be a possible solution?

@bbaumgartl commented on GitHub (Jun 27, 2023): I tried the same configuration on an AD joined Windows 10 machine. DNS resolution for netbird works, but the local AD domain doesn't resolve anymore. It looks like netbird changes the DNS configuration (in the adapter properties) from `Append primary and connection specific DNS suffixes` to `Append these DNS suffixes (in order)` (like it is described here https://answers.uillinois.edu/illinois/page.php?id=114224). This somehow means that Windows is only using the suffixes from this list and on a Windows AD DC this seems to have no effect at all (after changing the setting manually while testing it somehow worked but reconnecting netbird broke it again). I tried two different manual dns configurations with netbird connected: 1. Activating `Append primary and connection specific DNS suffixes` and setting `DNS suffix for this connection` on the `wt0` adapter to `netbird.cloud`. This appends `netbird.cloud` to the `DNS Suffix Search List` in `ipconfig /all`. 2. Adding `domain.local` to `Append these DNS suffixes (in order)` after netbird added `netbird.cloud` to the list. Both seem to work (local AD domain and netbird domain are added to the search list and can be resolved) on the Windows AD DC and Windows 10 machine. Maybe one could be a possible solution?
saavagebueno commented 2025-11-20 05:10:35 -05:00
Author
Owner
Copy Link

@bbaumgartl commented on GitHub (Jul 4, 2023):

Another thing i noticed is that connecting netbird registers the netbird IP address in the local DNS server. This causes local network clients to sometimes get the netbird IP instead of the local IP and thus can't connect to the server. There is an option in the adapter properties (Register this connection's addresses in DNS) which should avoid this. Maybe this is something that can be set after the adapter is created?

image
@bbaumgartl commented on GitHub (Jul 4, 2023): Another thing i noticed is that connecting netbird registers the netbird IP address in the local DNS server. This causes local network clients to sometimes get the netbird IP instead of the local IP and thus can't connect to the server. There is an option in the adapter properties (`Register this connection's addresses in DNS`) which should avoid this. Maybe this is something that can be set after the adapter is created? <img width="508" alt="image" src="https://github.com/netbirdio/netbird/assets/14923000/9a14569e-a162-4105-a898-f03278106816">
saavagebueno commented 2025-11-20 05:10:35 -05:00
Author
Owner
Copy Link

@MobileManiC commented on GitHub (Oct 9, 2023):

Yes, waiting for that fix as well... This makes NetBird effectively unusable in AD environment, because short names are usually heavily utilized in avarage business usecases (seems that even some Win10/11 domain communication itself expects AD servers to be accessible by their short name).

@MobileManiC commented on GitHub (Oct 9, 2023): Yes, waiting for that fix as well... This makes NetBird effectively unusable in AD environment, because short names are usually heavily utilized in avarage business usecases (seems that even some Win10/11 domain communication itself expects AD servers to be accessible by their short name).
saavagebueno commented 2025-11-20 05:10:35 -05:00
Author
Owner
Copy Link

@MobileManiC commented on GitHub (Oct 9, 2023):

Btw. I think the solution 1. ("Append primary and connection specific DNS suffixes") is proper one

@MobileManiC commented on GitHub (Oct 9, 2023): Btw. I think the solution 1. (`"Append primary and connection specific DNS suffixes"`) is proper one
saavagebueno commented 2025-11-20 05:10:36 -05:00
Author
Owner
Copy Link

@hesshaus commented on GitHub (May 3, 2024):

Can confirm this is an issue in AD environments. The suggestions above did fix these issues, however, they are temporary (upon reboot or restarting the netbird client). Would love to roll this solution out but this is a major hurdle.

@hesshaus commented on GitHub (May 3, 2024): Can confirm this is an issue in AD environments. The suggestions above did fix these issues, however, they are temporary (upon reboot or restarting the netbird client). Would love to roll this solution out but this is a major hurdle.
saavagebueno commented 2025-11-20 05:10:36 -05:00
Author
Owner
Copy Link

@MobileManiC commented on GitHub (May 4, 2024):

I think this is already resolved for a long time. Have you tried to install current version and configure DNS properly on the server side?

@MobileManiC commented on GitHub (May 4, 2024): I think this is already resolved for a long time. Have you tried to install current version and configure DNS properly on the server side?
saavagebueno commented 2025-11-20 05:10:36 -05:00
Author
Owner
Copy Link

@bbaumgartl commented on GitHub (May 10, 2024):

I just briefly checked it and it seems that the first two points (windows server netbird dns resolution, ad joined windows machine local dns resolution) seem to work now.

The third point (netbird ip is registered in the local domain as ip address) seems to be still an issue.

@bbaumgartl commented on GitHub (May 10, 2024): I just briefly checked it and it seems that the first two points (windows server netbird dns resolution, ad joined windows machine local dns resolution) seem to work now. The third point (netbird ip is registered in the local domain as ip address) seems to be still an issue.
saavagebueno commented 2025-11-20 05:10:36 -05:00
Author
Owner
Copy Link

@florian-obradovic commented on GitHub (Oct 12, 2024):

"The third point (netbird ip is registered in the local domain as ip address) seems to be still an issue."

This is standard behaviour for windows: https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/enable-disable-dns-dynamic-registration

"Windows supports Domain Name System (DNS) updates per RFC 2136. By default, this behavior is enabled for Windows DNS clients."

You could disable this via GPO:
Computer Configuration > Administrative Templates > Network > DNS Client > Dynamic Update
Set it to disabled:
CleanShot 2024-10-12 at 14 55 04@2x

@florian-obradovic commented on GitHub (Oct 12, 2024): "The third point (netbird ip is registered in the local domain as ip address) seems to be still an issue." This is standard behaviour for windows: https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/enable-disable-dns-dynamic-registration "Windows supports Domain Name System (DNS) updates per RFC 2136. By default, this behavior is enabled for Windows DNS clients." You could disable this via GPO: Computer Configuration > Administrative Templates > Network > DNS Client > **Dynamic Update** Set it to disabled: ![CleanShot 2024-10-12 at 14 55 04@2x](https://github.com/user-attachments/assets/9ddc080d-4b25-4f70-a3c5-184545d55918)
saavagebueno commented 2025-11-20 05:10:36 -05:00
Author
Owner
Copy Link

@florian-obradovic commented on GitHub (Oct 12, 2024):

I came across this issue and have the same issue on all AD joined machines (Windows 10/11, Server OS).
All Netbird specific DNS settings are ignored on AD joined or Entra-ID hybrid joined machines. WORKGROUP or Entra-ID only joined machines work fine.

Looks like the NRPT Rules are ignored: Get-DnsClientNrptRule
CleanShot 2024-10-12 at 16 06 16@2x

  • the default dns search domain, in my case onetpg (Example: server01.onetpg) isn't working

  • CleanShot 2024-10-12 at 16 08 24@2x

  • Added nameservers like this:
    CleanShot 2024-10-12 at 16 05 10@2x

nslookup or Resolve-DnsName work if you specify the Netbird default DNS IP:
CleanShot 2024-10-12 at 16 07 27@2x

It works on machines without domain join:
CleanShot 2024-10-12 at 16 09 32@2x

@florian-obradovic commented on GitHub (Oct 12, 2024): I came across this issue and have the same issue on all AD joined machines (Windows 10/11, Server OS). All Netbird specific DNS settings are ignored on AD joined or Entra-ID hybrid joined machines. WORKGROUP or Entra-ID only joined machines work fine. Looks like the NRPT Rules are ignored: `Get-DnsClientNrptRule` ![CleanShot 2024-10-12 at 16 06 16@2x](https://github.com/user-attachments/assets/7ad48dd2-be3e-40e9-9c47-1566c8e5df97) - the default dns search domain, in my case onetpg (Example: server01.onetpg) isn't working - ![CleanShot 2024-10-12 at 16 08 24@2x](https://github.com/user-attachments/assets/555586db-ea5e-4463-a108-2dd23e412142) - Added nameservers like this: ![CleanShot 2024-10-12 at 16 05 10@2x](https://github.com/user-attachments/assets/7cde5adc-3c7f-430f-b44b-30bc6de84b5d) nslookup or Resolve-DnsName work if you specify the Netbird default DNS IP: ![CleanShot 2024-10-12 at 16 07 27@2x](https://github.com/user-attachments/assets/cc56c550-2ab4-4677-bcbb-0e5ba9cc1619) It works on machines without domain join: ![CleanShot 2024-10-12 at 16 09 32@2x](https://github.com/user-attachments/assets/098faa89-547c-4de0-98f9-0bfaa26fff79)
saavagebueno commented 2025-11-20 05:10:36 -05:00
Author
Owner
Copy Link

@florian-obradovic commented on GitHub (Oct 12, 2024):

I found some hints in a Tailscale issue.

The Nrpt-Rule Netbird creates, is ignored if this key exists which is the default in every Active Directory domain, even without any DNS client specific GPOs applied (I tested it...)
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient\DnsPolicyConfig

From the documentation:
"<4> Section 2.2.2.1: The Name key specification is Software\Policies\Microsoft\WindowsNT\DNSClient\DnsPolicyConfig{Name}.
In the presence of both specified keys, Windows ignores the System\CurrentControlSet\services\Dnscache\Parameters key."

So, the NrptRule is ignored:
(Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters\DnsPolicyConfig\NetBird-Match)
CleanShot 2024-10-12 at 20 12 20@2x

Steps to test:

  1. Backup and delete the full key HKLM\SOFTWARE\Policies\Microsoft\Windows NT*DNSClient*_
  2. Delete the whole key or or at least ..DNSClient*DnsPolicyConfig*
  3. Make sure you have no network connection to the AD to avoid any GPOs getting re-applied :)
  4. Disconnect Netbird, restart the service Restart-Service Netbird or reboot the machine
  5. Connect Netbird and DNS is working ✅
    CleanShot 2024-10-12 at 20 26 33@2x

Possible solution
Creating DNS Client NRPT Rule like this doesn't work ❌:

Add-DnsClientNrptRule -Namespace "onetpg" -NameServers "100.116.255.254"
Get-DnsClientNrptRule -Name "{265F11C4-B797-48F6-BF9D-24CFD59DC369}"

I think we need a DnsClientNrptPolicy I think but I'm unsure how to create them correctly... there is no Add-DnsClientNrptPolicy commandlet

I created registry key manually and it works :)
My Nebird domain suffix is onetpg (Example: server01.onetpg so it's: _Name=hex(7):2e,00,6f,00,6e,00,65,00,74,00,70,00,67,00,00,00,00,00 = **.onetpg**_ 

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient\DnsPolicyConfig\Netbird-onetpg]
"ConfigOptions"=dword:00000008
"Name"=hex(7):2e,00,6f,00,6e,00,65,00,74,00,70,00,67,00,00,00,00,00
"IPSECCARestriction"=""
"GenericDNSServers"="100.116.255.254"
"Version"=dword:00000002

CleanShot 2024-10-12 at 20 45 03@2x
CleanShot 2024-10-12 at 20 45 56@2x

GPO - Group Policy
CleanShot 2024-10-12 at 22 05 30@2x

Proposed fix
@mlsmaycon:

  1. If HKLM\Software\Policies\Microsoft\WindowsNT\DNSClient\DnsPolicyConfig exists, we need to add all Netbird specific DNS settings / Nameservers to the policy store instead of the local one (HKLM\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters\DnsPolicyConfig)
  2. Refresh group policy: 4d0d4e0b69 (diff-a3c40a24112fd7205c9cf7de4f44d040b2e7f50db1496f778c09931df7a425e1R41)

Infos

@florian-obradovic commented on GitHub (Oct 12, 2024): I found some hints in a [Tailscale issue](https://github.com/tailscale/tailscale/issues/4607). The Nrpt-Rule Netbird creates, is ignored if this key exists which is the default in every Active Directory domain, even without any DNS client specific GPOs applied (I tested it...) `HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient\DnsPolicyConfig` **From the documentation:** "<4> Section 2.2.2.1: The Name key specification is Software\Policies\Microsoft\WindowsNT\DNSClient\DnsPolicyConfig\{Name}. In the presence of both specified keys, **Windows ignores the** System\CurrentControlSet\services\Dnscache\Parameters key." So, the NrptRule is ignored: (_Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters\DnsPolicyConfig\NetBird-Match_) ![CleanShot 2024-10-12 at 20 12 20@2x](https://github.com/user-attachments/assets/1d5093b2-af61-4fb2-8b58-e1039237d7d6) **Steps to test:** 1. Backup and delete the full key _HKLM\SOFTWARE\Policies\Microsoft\Windows NT\**DNSClient**__ 2. Delete the whole key or or at least _..DNSClient\**DnsPolicyConfig**_ 3. Make sure you have no network connection to the AD to avoid any GPOs getting re-applied :) 4. Disconnect Netbird, restart the service `Restart-Service Netbird` or reboot the machine 5. Connect Netbird and DNS is working ✅ ![CleanShot 2024-10-12 at 20 26 33@2x](https://github.com/user-attachments/assets/00d10302-61cd-4dc8-8dfd-bd3a50aa3383) **Possible solution** Creating DNS Client NRPT Rule like this doesn't work ❌: ``` Add-DnsClientNrptRule -Namespace "onetpg" -NameServers "100.116.255.254" Get-DnsClientNrptRule -Name "{265F11C4-B797-48F6-BF9D-24CFD59DC369}" ``` I think we need a DnsClientNrptPolicy I think but I'm unsure how to create them correctly... there is no Add-DnsClientNrpt**Policy** commandlet I created registry key manually and it works :) My Nebird domain suffix is onetpg (Example: server01.onetpg so it's: `_Name=hex(7):2e,00,6f,00,6e,00,65,00,74,00,70,00,67,00,00,00,00,00 = **.onetpg**_ ` ``` Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient\DnsPolicyConfig\Netbird-onetpg] "ConfigOptions"=dword:00000008 "Name"=hex(7):2e,00,6f,00,6e,00,65,00,74,00,70,00,67,00,00,00,00,00 "IPSECCARestriction"="" "GenericDNSServers"="100.116.255.254" "Version"=dword:00000002 ``` ![CleanShot 2024-10-12 at 20 45 03@2x](https://github.com/user-attachments/assets/79bb6fcf-de80-4186-8b09-23459501741b) ![CleanShot 2024-10-12 at 20 45 56@2x](https://github.com/user-attachments/assets/2ce55d25-3e37-4981-b471-9ab045e203a1) **GPO - Group Policy** ![CleanShot 2024-10-12 at 22 05 30@2x](https://github.com/user-attachments/assets/08a24e68-34c9-4cab-ada9-fc4119d9757c) **Proposed fix** @mlsmaycon: - https://github.com/tailscale/tailscale/commit/4d0d4e0b69cde02b6e9b3191e3ffa1eaacbe0202#diff-f0aeef11af128394e1c4468f5139e97885e2078b620b94640e7a1030721bddc8R21 - Warning: https://github.com/tailscale/tailscale/pull/11684 1. If HKLM\Software\Policies\Microsoft\WindowsNT\DNSClient\DnsPolicyConfig exists, we need to add all Netbird specific DNS settings / Nameservers to the policy store instead of the local one (HKLM\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters\DnsPolicyConfig\) 2. Refresh group policy: https://github.com/tailscale/tailscale/commit/4d0d4e0b69cde02b6e9b3191e3ffa1eaacbe0202#diff-a3c40a24112fd7205c9cf7de4f44d040b2e7f50db1496f778c09931df7a425e1R41 **Infos** - Microsoft: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-gpnrpt/8cc31cb9-20cb-4140-9e85-3e08703b4745 - Microsoft: https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-GPNRPT/%5bMS-GPNRPT%5d.pdf - "<4> Section 2.2.2.1: The Name key specification is Software\Policies\Microsoft\WindowsNT\DNSClient\DnsPolicyConfig\{Name}. In the presence of both specified keys, Windows ignores the System\CurrentControlSet\services\Dnscache\Parameters key." - Tailscale: https://github.com/tailscale/tailscale/commit/4d0d4e0b69cde02b6e9b3191e3ffa1eaacbe0202 - Tailscale: https://github.com/tailscale/tailscale/pull/11684 - Tailscale comment: https://github.com/tailscale/tailscale/issues/4607#issuecomment-1119146501 - Richard Hicks (AlwaysON VPN / DirectAccess Guru 🥷: https://directaccess.richardhicks.com/2018/04/23/always-on-vpn-and-the-name-resolution-policy-table-nrpt/
saavagebueno commented 2025-11-20 05:10:36 -05:00
Author
Owner
Copy Link

@florian-obradovic commented on GitHub (Oct 29, 2024):

@mlsmaycon did you have a chance to look at this?
I bet this could block a rollout for many corps with Windows environments.

@florian-obradovic commented on GitHub (Oct 29, 2024): @mlsmaycon did you have a chance to look at this? I bet this could block a rollout for many corps with Windows environments.
saavagebueno commented 2025-11-20 05:10:37 -05:00
Author
Owner
Copy Link

@the-project-group commented on GitHub (Jan 5, 2025):

I just spent a few hours with this topic.
Currently on 0.35.2 and Windows 11 24h2 december 2024 update.
@mlsmaycon: did something change here since my last post?
If I remember correctly, there where no NRPT policies (Get-DnsClientNrptPolicy), only NRTP rules (Get-DnsClientNrptRule) which were ignored if the reg-key mentioned above is present! Now I have both!

I think there is something broken:
The NRTP policies & rule created by the Netbird client don't match the name servers settings configured in the dashboard.

Example:

  • Netbird Subnet 100.116.0.0/16
  • Netbird Domain Suffix: onetpg
  • Configured DNS Server for match domains like my domain.com: 100.116.177.244

CleanShot 2025-01-05 at 17 58 51@2x
As you can see, all NRPT policies have 100.116.255.254 as DNS server and not the configured DNS server .177.244
It's normal for the Netbird Domain / default match domain like selfhosted.

Get-DnsClientNrptRule
Name                             : NetBird-Match
Version                          : 2
Namespace                        : {.matchdomain01.ontpg.com, .matchdomain02.ontpg.com, .mydomain.local, .other.local...}
IPsecCARestriction               :
DirectAccessDnsServers           :
DirectAccessEnabled              : False
DirectAccessProxyType            :
DirectAccessProxyName            :
DirectAccessQueryIPsecEncryption :
DirectAccessQueryIPsecRequired   :
NameServers                      : 100.116.255.254
DnsSecEnabled                    : False
DnsSecQueryIPsecEncryption       :
DnsSecQueryIPsecRequired         :
DnsSecValidationRequired         :
NameEncoding                     : Disable
DisplayName                      :
Comment                          :


Get-DnsClientNrptPolicy
Namespace                        : .onetpg
QueryPolicy                      :
SecureNameQueryFallback          :
DirectAccessIPsecCARestriction   :
DirectAccessProxyName            :
DirectAccessDnsServers           :
DirectAccessEnabled              :
DirectAccessProxyType            : NoProxy
DirectAccessQueryIPsecEncryption :
DirectAccessQueryIPsecRequired   : False
NameServers                      : 100.116.255.254
DnsSecIPsecCARestriction         :
DnsSecQueryIPsecEncryption       :
DnsSecQueryIPsecRequired         : False
DnsSecValidationRequired         : False
NameEncoding                     : Utf8WithoutMapping

Namespace                        : .matchdomain01.ontpg.com
QueryPolicy                      :
SecureNameQueryFallback          :
DirectAccessIPsecCARestriction   :
DirectAccessProxyName            :
DirectAccessDnsServers           :
DirectAccessEnabled              :
DirectAccessProxyType            : NoProxy
DirectAccessQueryIPsecEncryption :
DirectAccessQueryIPsecRequired   : False
NameServers                      : 100.116.255.254
DnsSecIPsecCARestriction         :
DnsSecQueryIPsecEncryption       :
DnsSecQueryIPsecRequired         : False
DnsSecValidationRequired         : False
NameEncoding                     : Utf8WithoutMapping

Namespace                        : .matchdomain02.ontpg.com
QueryPolicy                      :
SecureNameQueryFallback          :
DirectAccessIPsecCARestriction   :
DirectAccessProxyName            :
DirectAccessDnsServers           :
DirectAccessEnabled              :
DirectAccessProxyType            : NoProxy
DirectAccessQueryIPsecEncryption :
DirectAccessQueryIPsecRequired   : False
NameServers                      : 100.116.255.254
DnsSecIPsecCARestriction         :
DnsSecQueryIPsecEncryption       :
DnsSecQueryIPsecRequired         : False
DnsSecValidationRequired         : False
NameEncoding                     : Utf8WithoutMapping
@the-project-group commented on GitHub (Jan 5, 2025): I just spent a few hours with this topic. Currently on 0.35.2 and Windows 11 24h2 december 2024 update. @mlsmaycon: did something change here since my last post? If I remember correctly, there where no NRPT policies (**_Get-DnsClientNrptPolicy_**), only NRTP rules (**_Get-DnsClientNrptRule_**) which were ignored if the reg-key mentioned above is present! **Now I have both**! **I think there is something broken:** The NRTP policies & rule created by the Netbird client don't match the name servers settings configured in the dashboard. Example: - Netbird Subnet 100.116.0.0/16 - Netbird Domain Suffix: onetpg - Configured DNS Server for match domains like my domain.com: 100.116.177.244 ![CleanShot 2025-01-05 at 17 58 51@2x](https://github.com/user-attachments/assets/2e0cd354-5c92-483f-84e5-18085c0d5d72) As you can see, all NRPT **policies** have 100.116.255.254 as DNS server and not the configured DNS server .177.**244** It's normal for the Netbird Domain / default match domain like selfhosted. ``` Get-DnsClientNrptRule Name : NetBird-Match Version : 2 Namespace : {.matchdomain01.ontpg.com, .matchdomain02.ontpg.com, .mydomain.local, .other.local...} IPsecCARestriction : DirectAccessDnsServers : DirectAccessEnabled : False DirectAccessProxyType : DirectAccessProxyName : DirectAccessQueryIPsecEncryption : DirectAccessQueryIPsecRequired : NameServers : 100.116.255.254 DnsSecEnabled : False DnsSecQueryIPsecEncryption : DnsSecQueryIPsecRequired : DnsSecValidationRequired : NameEncoding : Disable DisplayName : Comment : ``` ``` Get-DnsClientNrptPolicy Namespace : .onetpg QueryPolicy : SecureNameQueryFallback : DirectAccessIPsecCARestriction : DirectAccessProxyName : DirectAccessDnsServers : DirectAccessEnabled : DirectAccessProxyType : NoProxy DirectAccessQueryIPsecEncryption : DirectAccessQueryIPsecRequired : False NameServers : 100.116.255.254 DnsSecIPsecCARestriction : DnsSecQueryIPsecEncryption : DnsSecQueryIPsecRequired : False DnsSecValidationRequired : False NameEncoding : Utf8WithoutMapping Namespace : .matchdomain01.ontpg.com QueryPolicy : SecureNameQueryFallback : DirectAccessIPsecCARestriction : DirectAccessProxyName : DirectAccessDnsServers : DirectAccessEnabled : DirectAccessProxyType : NoProxy DirectAccessQueryIPsecEncryption : DirectAccessQueryIPsecRequired : False NameServers : 100.116.255.254 DnsSecIPsecCARestriction : DnsSecQueryIPsecEncryption : DnsSecQueryIPsecRequired : False DnsSecValidationRequired : False NameEncoding : Utf8WithoutMapping Namespace : .matchdomain02.ontpg.com QueryPolicy : SecureNameQueryFallback : DirectAccessIPsecCARestriction : DirectAccessProxyName : DirectAccessDnsServers : DirectAccessEnabled : DirectAccessProxyType : NoProxy DirectAccessQueryIPsecEncryption : DirectAccessQueryIPsecRequired : False NameServers : 100.116.255.254 DnsSecIPsecCARestriction : DnsSecQueryIPsecEncryption : DnsSecQueryIPsecRequired : False DnsSecValidationRequired : False NameEncoding : Utf8WithoutMapping ```
saavagebueno commented 2025-11-20 05:10:37 -05:00
Author
Owner
Copy Link

@lixmal commented on GitHub (Jan 5, 2025):

100.116.255.254 is correct. It's netbird's fake dns IP, the configured dns servers will be set as upstream internally. See netbird status -d

@lixmal commented on GitHub (Jan 5, 2025): `100.116.255.254` is correct. It's netbird's fake dns IP, the configured dns servers will be set as upstream internally. See `netbird status -d`
saavagebueno commented 2025-11-20 05:10:37 -05:00
Author
Owner
Copy Link

@florian-obradovic commented on GitHub (Jan 5, 2025):

Thanks @lixmal !

@florian-obradovic commented on GitHub (Jan 5, 2025): Thanks @lixmal !
saavagebueno commented 2025-11-20 05:10:37 -05:00
Author
Owner
Copy Link

@jackmusick commented on GitHub (Jan 22, 2025):

Bumping this, though I'm still experimenting. I've tried a lot of these suggestions. Basically what I'm experiencing is that I can't ping by name once joined to the domain. Is there a recommended setup here to avoid setting up a routing peer, or is this still an issue?

@jackmusick commented on GitHub (Jan 22, 2025): Bumping this, though I'm still experimenting. I've tried a lot of these suggestions. Basically what I'm experiencing is that I can't ping by name once joined to the domain. Is there a recommended setup here to avoid setting up a routing peer, or is this still an issue?
saavagebueno commented 2025-11-20 05:10:37 -05:00
Author
Owner
Copy Link

@the-project-group commented on GitHub (Jan 23, 2025):

The only "work-around" I tried and had "some kind of name resolution" working was by defining the same DNS server twice:

  • with match domain
  • catch all

Image

@the-project-group commented on GitHub (Jan 23, 2025): The only "work-around" I tried and had "some kind of name resolution" working was by defining the same DNS server twice: - with match domain - catch all ![Image](https://github.com/user-attachments/assets/5c884a22-33ba-48a8-8240-1f441b8358e6)
saavagebueno commented 2025-11-20 05:10:37 -05:00
Author
Owner
Copy Link

@lixmal commented on GitHub (Feb 13, 2025):

Hey folks, can you please try with v0.36.7 and if any issues remain get the logs plus the following in powershell when netbird is running:

ipconfig /all
Get-DnsClientGlobalSetting
Get-DnsClientNrptGlobal
Get-DnsClientNrptRule
Get-DnsClientNrptPolicy
Get-ChildItem -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters\DnsPolicyConfig"
Get-ChildItem -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient\DnsPolicyConfig"

Feel free to mask sensitive info.

thanks for the research @florian-obradovic

@lixmal commented on GitHub (Feb 13, 2025): Hey folks, can you please try with `v0.36.7` and if any issues remain get the logs plus the following in powershell when netbird is running: ```powershell ipconfig /all Get-DnsClientGlobalSetting Get-DnsClientNrptGlobal Get-DnsClientNrptRule Get-DnsClientNrptPolicy Get-ChildItem -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters\DnsPolicyConfig" Get-ChildItem -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient\DnsPolicyConfig" ``` Feel free to mask sensitive info. thanks for the research @florian-obradovic
saavagebueno commented 2025-11-20 05:10:37 -05:00
Author
Owner
Copy Link

@flotpg commented on GitHub (Feb 13, 2025):

@lixmal awesome work ❤️❤️❤️

Unfortunately it's not yet working for me:

Image
Image
Image

MS Edge:
Image

From a domain / hybrid joined machine:

 ipconfig /all

Windows IP Configuration

   Host Name . . . . . . . . . . . . : vWin11-KES01
   Primary Dns Suffix  . . . . . . . : domain.tpg.local
   Node Type . . . . . . . . . . . . : Hybrid
   IP Routing Enabled. . . . . . . . : No
   WINS Proxy Enabled. . . . . . . . : No
   DNS Suffix Search List. . . . . . : domain.tpg.local
                                       other.tpg.local
                                       another.tpg.local
                                       another.tpg.local

Unknown adapter wt0:

   Connection-specific DNS Suffix  . : onetpg
   Description . . . . . . . . . . . : WireGuard Tunnel
   Physical Address. . . . . . . . . :
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
   IPv4 Address. . . . . . . . . . . : 100.116.147.121(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.0.0
   Default Gateway . . . . . . . . . :
   NetBIOS over Tcpip. . . . . . . . : Enabled
   Connection-specific DNS Suffix Search List :
                                       onetpg

Ethernet adapter FritzBox:

   Connection-specific DNS Suffix  . : fritz.box
   Description . . . . . . . . . . . : Microsoft Hyper-V Network Adapter #2
   Physical Address. . . . . . . . . : 00-15-5D-7A-70-AC
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
   Link-local IPv6 Address . . . . . : fe80::a8f6:1589:3819:afc9%13(Preferred)
   IPv4 Address. . . . . . . . . . . : 192.168.178.36(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Lease Obtained. . . . . . . . . . : Donnerstag, 13. Februar 2025 22:41:52
   Lease Expires . . . . . . . . . . : Sonntag, 23. Februar 2025 22:41:52
   Default Gateway . . . . . . . . . : 192.168.178.1
   DHCP Server . . . . . . . . . . . : 192.168.178.1
   DHCPv6 IAID . . . . . . . . . . . : 486544733
   DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-2B-FE-A6-2B-00-1D-D8-B7-1D-28
   DNS Servers . . . . . . . . . . . : 192.168.178.1
   NetBIOS over Tcpip. . . . . . . . : Enabled

PS C:\Users\floriano> Get-DnsClientGlobalSetting


UseSuffixSearchList : True
SuffixSearchList    : {domain.tpg.local, other.tpg.local, another.tpg.local, another.tpg.local}
UseDevolution       : True
DevolutionLevel     : 0



PS C:\Users\floriano> Get-DnsClientNrptGlobal

EnableDAForAllNetworks QueryPolicy SecureNameQueryFallback
---------------------- ----------- -----------------------
Disable                Disable     Disable


PS C:\Users\floriano> Get-DnsClientNrptRule


Name                             : VPN_AUTO_TPG AlwaysOn VPN v1.4_4f69d45d-1e6f-488c-973a-5b61e4ed611e
Version                          : 2
Namespace                        : {_ldap}
IPsecCARestriction               :
DirectAccessDnsServers           :
DirectAccessEnabled              : False
DirectAccessProxyType            :
DirectAccessProxyName            :
DirectAccessQueryIPsecEncryption :
DirectAccessQueryIPsecRequired   :
NameServers                      : {172.17.111.333, 172.17.111.444}
DnsSecEnabled                    : False
DnsSecQueryIPsecEncryption       :
DnsSecQueryIPsecRequired         :
DnsSecValidationRequired         :
NameEncoding                     : Disable
DisplayName                      :
Comment                          :

Name                             : VPN_AUTO_TPG AlwaysOn VPN v1.4_8a3a0cc6-a3ec-4410-a9cb-d7866c0eff3f
Version                          : 2
Namespace                        : {wpad}
IPsecCARestriction               :
DirectAccessDnsServers           :
DirectAccessEnabled              : False
DirectAccessProxyType            :
DirectAccessProxyName            :
DirectAccessQueryIPsecEncryption :
DirectAccessQueryIPsecRequired   :
NameServers                      : {172.17.111.333, 172.17.111.444}
DnsSecEnabled                    : False
DnsSecQueryIPsecEncryption       :
DnsSecQueryIPsecRequired         :
DnsSecValidationRequired         :
NameEncoding                     : Disable
DisplayName                      :
Comment                          :

Name                             : VPN_AUTO_TPG AlwaysOn VPN v1.4_ac72b6f3-8bd8-45a3-93a1-65b11a42482d
Version                          : 2
Namespace                        : {isatap}
IPsecCARestriction               :
DirectAccessDnsServers           :
DirectAccessEnabled              : False
DirectAccessProxyType            :
DirectAccessProxyName            :
DirectAccessQueryIPsecEncryption :
DirectAccessQueryIPsecRequired   :
NameServers                      : {172.17.111.333, 172.17.111.444}
DnsSecEnabled                    : False
DnsSecQueryIPsecEncryption       :
DnsSecQueryIPsecRequired         :
DnsSecValidationRequired         :
NameEncoding                     : Disable
DisplayName                      :
Comment                          :



PS C:\Users\floriano> Get-DnsClientNrptPolicy


Namespace                        : .onetpg
QueryPolicy                      :
SecureNameQueryFallback          :
DirectAccessIPsecCARestriction   :
DirectAccessProxyName            :
DirectAccessDnsServers           :
DirectAccessEnabled              :
DirectAccessProxyType            : NoProxy
DirectAccessQueryIPsecEncryption :
DirectAccessQueryIPsecRequired   : False
NameServers                      : 100.116.255.254
DnsSecIPsecCARestriction         :
DnsSecQueryIPsecEncryption       :
DnsSecQueryIPsecRequired         : False
DnsSecValidationRequired         : False
NameEncoding                     : Utf8WithoutMapping

Namespace                        : .another.tpg.local
QueryPolicy                      :
SecureNameQueryFallback          :
DirectAccessIPsecCARestriction   :
DirectAccessProxyName            :
DirectAccessDnsServers           :
DirectAccessEnabled              :
DirectAccessProxyType            : NoProxy
DirectAccessQueryIPsecEncryption :
DirectAccessQueryIPsecRequired   : False
NameServers                      : 100.116.255.254
DnsSecIPsecCARestriction         :
DnsSecQueryIPsecEncryption       :
DnsSecQueryIPsecRequired         : False
DnsSecValidationRequired         : False
NameEncoding                     : Utf8WithoutMapping

Namespace                        : .another.tpg.local
QueryPolicy                      :
SecureNameQueryFallback          :
DirectAccessIPsecCARestriction   :
DirectAccessProxyName            :
DirectAccessDnsServers           :
DirectAccessEnabled              :
DirectAccessProxyType            : NoProxy
DirectAccessQueryIPsecEncryption :
DirectAccessQueryIPsecRequired   : False
NameServers                      : 100.116.255.254
DnsSecIPsecCARestriction         :
DnsSecQueryIPsecEncryption       :
DnsSecQueryIPsecRequired         : False
DnsSecValidationRequired         : False
NameEncoding                     : Utf8WithoutMapping

Namespace                        : .other.tpg.local
QueryPolicy                      :
SecureNameQueryFallback          :
DirectAccessIPsecCARestriction   :
DirectAccessProxyName            :
DirectAccessDnsServers           :
DirectAccessEnabled              :
DirectAccessProxyType            : NoProxy
DirectAccessQueryIPsecEncryption :
DirectAccessQueryIPsecRequired   : False
NameServers                      : 100.116.255.254
DnsSecIPsecCARestriction         :
DnsSecQueryIPsecEncryption       :
DnsSecQueryIPsecRequired         : False
DnsSecValidationRequired         : False
NameEncoding                     : Utf8WithoutMapping

Namespace                        : .domain.tpg.local
QueryPolicy                      :
SecureNameQueryFallback          :
DirectAccessIPsecCARestriction   :
DirectAccessProxyName            :
DirectAccessDnsServers           :
DirectAccessEnabled              :
DirectAccessProxyType            : NoProxy
DirectAccessQueryIPsecEncryption :
DirectAccessQueryIPsecRequired   : False
NameServers                      : 100.116.255.254
DnsSecIPsecCARestriction         :
DnsSecQueryIPsecEncryption       :
DnsSecQueryIPsecRequired         : False
DnsSecValidationRequired         : False
NameEncoding                     : Utf8WithoutMapping

Namespace                        : .az.ontpg.com
QueryPolicy                      :
SecureNameQueryFallback          :
DirectAccessIPsecCARestriction   :
DirectAccessProxyName            :
DirectAccessDnsServers           :
DirectAccessEnabled              :
DirectAccessProxyType            : NoProxy
DirectAccessQueryIPsecEncryption :
DirectAccessQueryIPsecRequired   : False
NameServers                      : 100.116.255.254
DnsSecIPsecCARestriction         :
DnsSecQueryIPsecEncryption       :
DnsSecQueryIPsecRequired         : False
DnsSecValidationRequired         : False
NameEncoding                     : Utf8WithoutMapping


PS C:\Users\floriano> Get-ChildItem -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters\DnsPolicyConfig"


    Hive: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters\DnsPolicyConfig


Name                           Property
----                           --------
VPN_AUTO_TPG AlwaysOn VPN v1.4 Name              : {_ldap}
_4f69d45d-1e6f-488c-973a-5b61e ConfigOptions     : 8
4ed611e                        Version           : 2
                               GenericDNSServers : 172.17.111.333;172.17.111.444
                               VPNRequired       : 0
                               ProxyType         : 3
VPN_AUTO_TPG AlwaysOn VPN v1.4 Name              : {wpad}
_8a3a0cc6-a3ec-4410-a9cb-d7866 ConfigOptions     : 8
c0eff3f                        Version           : 2
                               GenericDNSServers : 172.17.111.333;172.17.111.444
                               VPNRequired       : 0
                               ProxyType         : 3
VPN_AUTO_TPG AlwaysOn VPN v1.4 Name              : {isatap}
_ac72b6f3-8bd8-45a3-93a1-65b11 ConfigOptions     : 8
a42482d                        Version           : 2
                               GenericDNSServers : 172.17.111.333;172.17.111.444
                               VPNRequired       : 0
                               ProxyType         : 3


PS C:\Users\floriano> Get-ChildItem -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient\DnsPolicyConfig"


    Hive: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient\DnsPolicyConfig


Name                           Property
----                           --------
NetBird-Match                  Version           : 2
                               Name              : {.az.ontpg.com, .domain.tpg.local, .other.tpg.local, .another.tpg.local...}
                               GenericDNSServers : 100.116.255.254
                               ConfigOptions     : 8

On another machine which is not domain joined, it doesn't set the policy but a rule < is this intended?

Get-ChildItem -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters\DnsPolicyConfig"


    Hive: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters\DnsPolicyConfig


Name                           Property
----                           --------
NetBird-Match                  Version           : 2
                               Name              : {.az.ontpg.com, .de.tpg.local, .tpg.local, .af.tpg.local...}
                               GenericDNSServers : 100.116.255.254
                               ConfigOptions     : 8


PS C:\Users\floriano> Get-ChildItem -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient\DnsPolicyConfig"
Get-ChildItem : Cannot find path 'HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient\DnsPolicyConfig' because it does not exist.
@flotpg commented on GitHub (Feb 13, 2025): @lixmal awesome work ❤️❤️❤️ Unfortunately it's not yet working for me: ![Image](https://github.com/user-attachments/assets/9d955893-57cd-42b1-b304-0535703490ff) ![Image](https://github.com/user-attachments/assets/c38a19e4-bedd-4d70-94b5-1b80ffaef14b) ![Image](https://github.com/user-attachments/assets/c0a43266-90d5-4532-b871-cfef203d924c) MS Edge: ![Image](https://github.com/user-attachments/assets/be68396e-9077-4b40-b86a-5beab93c4389) From a domain / hybrid joined machine: ``` ipconfig /all Windows IP Configuration Host Name . . . . . . . . . . . . : vWin11-KES01 Primary Dns Suffix . . . . . . . : domain.tpg.local Node Type . . . . . . . . . . . . : Hybrid IP Routing Enabled. . . . . . . . : No WINS Proxy Enabled. . . . . . . . : No DNS Suffix Search List. . . . . . : domain.tpg.local other.tpg.local another.tpg.local another.tpg.local Unknown adapter wt0: Connection-specific DNS Suffix . : onetpg Description . . . . . . . . . . . : WireGuard Tunnel Physical Address. . . . . . . . . : DHCP Enabled. . . . . . . . . . . : No Autoconfiguration Enabled . . . . : Yes IPv4 Address. . . . . . . . . . . : 100.116.147.121(Preferred) Subnet Mask . . . . . . . . . . . : 255.255.0.0 Default Gateway . . . . . . . . . : NetBIOS over Tcpip. . . . . . . . : Enabled Connection-specific DNS Suffix Search List : onetpg Ethernet adapter FritzBox: Connection-specific DNS Suffix . : fritz.box Description . . . . . . . . . . . : Microsoft Hyper-V Network Adapter #2 Physical Address. . . . . . . . . : 00-15-5D-7A-70-AC DHCP Enabled. . . . . . . . . . . : Yes Autoconfiguration Enabled . . . . : Yes Link-local IPv6 Address . . . . . : fe80::a8f6:1589:3819:afc9%13(Preferred) IPv4 Address. . . . . . . . . . . : 192.168.178.36(Preferred) Subnet Mask . . . . . . . . . . . : 255.255.255.0 Lease Obtained. . . . . . . . . . : Donnerstag, 13. Februar 2025 22:41:52 Lease Expires . . . . . . . . . . : Sonntag, 23. Februar 2025 22:41:52 Default Gateway . . . . . . . . . : 192.168.178.1 DHCP Server . . . . . . . . . . . : 192.168.178.1 DHCPv6 IAID . . . . . . . . . . . : 486544733 DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-2B-FE-A6-2B-00-1D-D8-B7-1D-28 DNS Servers . . . . . . . . . . . : 192.168.178.1 NetBIOS over Tcpip. . . . . . . . : Enabled PS C:\Users\floriano> Get-DnsClientGlobalSetting UseSuffixSearchList : True SuffixSearchList : {domain.tpg.local, other.tpg.local, another.tpg.local, another.tpg.local} UseDevolution : True DevolutionLevel : 0 PS C:\Users\floriano> Get-DnsClientNrptGlobal EnableDAForAllNetworks QueryPolicy SecureNameQueryFallback ---------------------- ----------- ----------------------- Disable Disable Disable PS C:\Users\floriano> Get-DnsClientNrptRule Name : VPN_AUTO_TPG AlwaysOn VPN v1.4_4f69d45d-1e6f-488c-973a-5b61e4ed611e Version : 2 Namespace : {_ldap} IPsecCARestriction : DirectAccessDnsServers : DirectAccessEnabled : False DirectAccessProxyType : DirectAccessProxyName : DirectAccessQueryIPsecEncryption : DirectAccessQueryIPsecRequired : NameServers : {172.17.111.333, 172.17.111.444} DnsSecEnabled : False DnsSecQueryIPsecEncryption : DnsSecQueryIPsecRequired : DnsSecValidationRequired : NameEncoding : Disable DisplayName : Comment : Name : VPN_AUTO_TPG AlwaysOn VPN v1.4_8a3a0cc6-a3ec-4410-a9cb-d7866c0eff3f Version : 2 Namespace : {wpad} IPsecCARestriction : DirectAccessDnsServers : DirectAccessEnabled : False DirectAccessProxyType : DirectAccessProxyName : DirectAccessQueryIPsecEncryption : DirectAccessQueryIPsecRequired : NameServers : {172.17.111.333, 172.17.111.444} DnsSecEnabled : False DnsSecQueryIPsecEncryption : DnsSecQueryIPsecRequired : DnsSecValidationRequired : NameEncoding : Disable DisplayName : Comment : Name : VPN_AUTO_TPG AlwaysOn VPN v1.4_ac72b6f3-8bd8-45a3-93a1-65b11a42482d Version : 2 Namespace : {isatap} IPsecCARestriction : DirectAccessDnsServers : DirectAccessEnabled : False DirectAccessProxyType : DirectAccessProxyName : DirectAccessQueryIPsecEncryption : DirectAccessQueryIPsecRequired : NameServers : {172.17.111.333, 172.17.111.444} DnsSecEnabled : False DnsSecQueryIPsecEncryption : DnsSecQueryIPsecRequired : DnsSecValidationRequired : NameEncoding : Disable DisplayName : Comment : PS C:\Users\floriano> Get-DnsClientNrptPolicy Namespace : .onetpg QueryPolicy : SecureNameQueryFallback : DirectAccessIPsecCARestriction : DirectAccessProxyName : DirectAccessDnsServers : DirectAccessEnabled : DirectAccessProxyType : NoProxy DirectAccessQueryIPsecEncryption : DirectAccessQueryIPsecRequired : False NameServers : 100.116.255.254 DnsSecIPsecCARestriction : DnsSecQueryIPsecEncryption : DnsSecQueryIPsecRequired : False DnsSecValidationRequired : False NameEncoding : Utf8WithoutMapping Namespace : .another.tpg.local QueryPolicy : SecureNameQueryFallback : DirectAccessIPsecCARestriction : DirectAccessProxyName : DirectAccessDnsServers : DirectAccessEnabled : DirectAccessProxyType : NoProxy DirectAccessQueryIPsecEncryption : DirectAccessQueryIPsecRequired : False NameServers : 100.116.255.254 DnsSecIPsecCARestriction : DnsSecQueryIPsecEncryption : DnsSecQueryIPsecRequired : False DnsSecValidationRequired : False NameEncoding : Utf8WithoutMapping Namespace : .another.tpg.local QueryPolicy : SecureNameQueryFallback : DirectAccessIPsecCARestriction : DirectAccessProxyName : DirectAccessDnsServers : DirectAccessEnabled : DirectAccessProxyType : NoProxy DirectAccessQueryIPsecEncryption : DirectAccessQueryIPsecRequired : False NameServers : 100.116.255.254 DnsSecIPsecCARestriction : DnsSecQueryIPsecEncryption : DnsSecQueryIPsecRequired : False DnsSecValidationRequired : False NameEncoding : Utf8WithoutMapping Namespace : .other.tpg.local QueryPolicy : SecureNameQueryFallback : DirectAccessIPsecCARestriction : DirectAccessProxyName : DirectAccessDnsServers : DirectAccessEnabled : DirectAccessProxyType : NoProxy DirectAccessQueryIPsecEncryption : DirectAccessQueryIPsecRequired : False NameServers : 100.116.255.254 DnsSecIPsecCARestriction : DnsSecQueryIPsecEncryption : DnsSecQueryIPsecRequired : False DnsSecValidationRequired : False NameEncoding : Utf8WithoutMapping Namespace : .domain.tpg.local QueryPolicy : SecureNameQueryFallback : DirectAccessIPsecCARestriction : DirectAccessProxyName : DirectAccessDnsServers : DirectAccessEnabled : DirectAccessProxyType : NoProxy DirectAccessQueryIPsecEncryption : DirectAccessQueryIPsecRequired : False NameServers : 100.116.255.254 DnsSecIPsecCARestriction : DnsSecQueryIPsecEncryption : DnsSecQueryIPsecRequired : False DnsSecValidationRequired : False NameEncoding : Utf8WithoutMapping Namespace : .az.ontpg.com QueryPolicy : SecureNameQueryFallback : DirectAccessIPsecCARestriction : DirectAccessProxyName : DirectAccessDnsServers : DirectAccessEnabled : DirectAccessProxyType : NoProxy DirectAccessQueryIPsecEncryption : DirectAccessQueryIPsecRequired : False NameServers : 100.116.255.254 DnsSecIPsecCARestriction : DnsSecQueryIPsecEncryption : DnsSecQueryIPsecRequired : False DnsSecValidationRequired : False NameEncoding : Utf8WithoutMapping PS C:\Users\floriano> Get-ChildItem -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters\DnsPolicyConfig" Hive: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters\DnsPolicyConfig Name Property ---- -------- VPN_AUTO_TPG AlwaysOn VPN v1.4 Name : {_ldap} _4f69d45d-1e6f-488c-973a-5b61e ConfigOptions : 8 4ed611e Version : 2 GenericDNSServers : 172.17.111.333;172.17.111.444 VPNRequired : 0 ProxyType : 3 VPN_AUTO_TPG AlwaysOn VPN v1.4 Name : {wpad} _8a3a0cc6-a3ec-4410-a9cb-d7866 ConfigOptions : 8 c0eff3f Version : 2 GenericDNSServers : 172.17.111.333;172.17.111.444 VPNRequired : 0 ProxyType : 3 VPN_AUTO_TPG AlwaysOn VPN v1.4 Name : {isatap} _ac72b6f3-8bd8-45a3-93a1-65b11 ConfigOptions : 8 a42482d Version : 2 GenericDNSServers : 172.17.111.333;172.17.111.444 VPNRequired : 0 ProxyType : 3 PS C:\Users\floriano> Get-ChildItem -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient\DnsPolicyConfig" Hive: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient\DnsPolicyConfig Name Property ---- -------- NetBird-Match Version : 2 Name : {.az.ontpg.com, .domain.tpg.local, .other.tpg.local, .another.tpg.local...} GenericDNSServers : 100.116.255.254 ConfigOptions : 8 ``` On another machine which is not domain joined, it doesn't set the policy but a rule < is this intended? ``` Get-ChildItem -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters\DnsPolicyConfig" Hive: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters\DnsPolicyConfig Name Property ---- -------- NetBird-Match Version : 2 Name : {.az.ontpg.com, .de.tpg.local, .tpg.local, .af.tpg.local...} GenericDNSServers : 100.116.255.254 ConfigOptions : 8 PS C:\Users\floriano> Get-ChildItem -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient\DnsPolicyConfig" Get-ChildItem : Cannot find path 'HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient\DnsPolicyConfig' because it does not exist. ```
saavagebueno commented 2025-11-20 05:10:38 -05:00
Author
Owner
Copy Link

@jbford1919 commented on GitHub (Feb 19, 2025):

I'm using Netbird to connect domain joined windows PC to our domain controllers through a routing peer with success. The latest version works for me as long as I have a namserver group that as "ALL" domains captured. Previously I just had one nameserver group that matched our local domain but DNS to local domain stopped working. However, after adding a second nameserver group to capture ALL domains the issue was resolved. Now my domain joined windows PC work as expected resolving DNS.

To be clear, I don't have netbird on my DC's. I use routing peer and have DC's listed as resources in Networks.

@jbford1919 commented on GitHub (Feb 19, 2025): I'm using Netbird to connect domain joined windows PC to our domain controllers through a routing peer with success. The latest version works for me as long as I have a namserver group that as "ALL" domains captured. Previously I just had one nameserver group that matched our local domain but DNS to local domain stopped working. However, after adding a second nameserver group to capture ALL domains the issue was resolved. Now my domain joined windows PC work as expected resolving DNS. To be clear, I don't have netbird on my DC's. I use routing peer and have DC's listed as resources in Networks.
saavagebueno commented 2025-11-20 05:10:38 -05:00
Author
Owner
Copy Link

@saule1508 commented on GitHub (Feb 24, 2025):

Not working for me and my colleagues, it is broken since 0.36.7

https://github.com/netbirdio/netbird/issues/3332

PS C:\Windows\System32\WindowsPowerShell\v1.0> ipconfig /all

Windows IP Configuration

Host Name . . . . . . . . . . . . : WL-BFVVDL3
Primary Dns Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
DNS Suffix Search List. . . . . . : elisa.net
fr01.awl.mycorporate.net
deac.awl.mycorporate.net
wl.corp-group.net

Ethernet adapter Ethernet:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Intel(R) Ethernet Connection (13) I219-LM
Physical Address. . . . . . . . . : 00-BE-43-21-ED-ED
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes

Ethernet adapter Ethernet 8:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Realtek USB GbE Family Controller #2
Physical Address. . . . . . . . . : 00-BE-43-21-ED-EE
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes

Unknown adapter wt0:

Connection-specific DNS Suffix . : netbird.giservices
Description . . . . . . . . . . . : WireGuard Tunnel
Physical Address. . . . . . . . . :
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
IPv4 Address. . . . . . . . . . . : 100.67.175.125(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.0.0
Default Gateway . . . . . . . . . :
NetBIOS over Tcpip. . . . . . . . : Enabled
Connection-specific DNS Suffix Search List :
netbird.giservices

Wireless LAN adapter Local Area Connection* 1:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Microsoft Wi-Fi Direct Virtual Adapter
Physical Address. . . . . . . . . : F0-57-A6-7C-54-67
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes

Wireless LAN adapter Local Area Connection* 2:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Microsoft Wi-Fi Direct Virtual Adapter #2
Physical Address. . . . . . . . . : F2-57-A6-7C-54-66
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes

Ethernet adapter Ethernet 2:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Fortinet Virtual Ethernet Adapter (NDIS 6.30)
Physical Address. . . . . . . . . : 00-09-0F-FE-00-01
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes

Wireless LAN adapter Wi-Fi:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Intel(R) Wi-Fi 6 AX201 160MHz
Physical Address. . . . . . . . . : F0-57-A6-7C-54-66
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
Link-local IPv6 Address . . . . . : fe80::b2e5:c493:5d45:af3a%20(Preferred)
IPv4 Address. . . . . . . . . . . : 10.171.81.29(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Lease Obtained. . . . . . . . . . : Tuesday, 25 February 2025 09:23:57
Lease Expires . . . . . . . . . . : Wednesday, 26 February 2025 09:23:57
Default Gateway . . . . . . . . . : 10.171.81.1
DHCP Server . . . . . . . . . . . : 10.171.81.1
DHCPv6 IAID . . . . . . . . . . . : 133191590
DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-29-A0-72-A9-00-BE-43-21-ED-ED
DNS Servers . . . . . . . . . . . : 10.173.173.173
NetBIOS over Tcpip. . . . . . . . : Enabled

Ethernet adapter Bluetooth Network Connection:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Bluetooth Device (Personal Area Network)
Physical Address. . . . . . . . . : F0-57-A6-7C-54-6A
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
PS C:\Windows\System32\WindowsPowerShell\v1.0> Get-DnsClientGlobalSetting

UseSuffixSearchList : True
SuffixSearchList : {elisa.net, fr01.xxx.mycorporate.net, deac.xxx.mycorporate.net, xx.xxx.net}
UseDevolution : True
DevolutionLevel : 0

PS C:\Windows\System32\WindowsPowerShell\v1.0> Get-DnsClientNrptGlobal

EnableDAForAllNetworks QueryPolicy SecureNameQueryFallback

Disable Disable Disable

PS C:\Windows\System32\WindowsPowerShell\v1.0> Get-DnsClientNrptRule
PS C:\Windows\System32\WindowsPowerShell\v1.0> Get-DnsClientNrptPolicy
PS C:\Windows\System32\WindowsPowerShell\v1.0> Get-ChildItem -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters\DnsPolicyConfig"
PS C:\Windows\System32\WindowsPowerShell\v1.0> Get-ChildItem -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient\DnsPolicyConfig"

Hive: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient\DnsPolicyConfig

Name Property

NetBird-Match Version : 2
Name : {.corp.net, .corporarw.com, .nyservices.io, .netbird.giservices}
GenericDNSServers : 100.67.255.254
ConfigOptions : 8

@saule1508 commented on GitHub (Feb 24, 2025): Not working for me and my colleagues, it is broken since 0.36.7 https://github.com/netbirdio/netbird/issues/3332 PS C:\Windows\System32\WindowsPowerShell\v1.0> ipconfig /all Windows IP Configuration Host Name . . . . . . . . . . . . : WL-BFVVDL3 Primary Dns Suffix . . . . . . . : Node Type . . . . . . . . . . . . : Hybrid IP Routing Enabled. . . . . . . . : No WINS Proxy Enabled. . . . . . . . : No DNS Suffix Search List. . . . . . : elisa.net fr01.awl.mycorporate.net deac.awl.mycorporate.net wl.corp-group.net Ethernet adapter Ethernet: Media State . . . . . . . . . . . : Media disconnected Connection-specific DNS Suffix . : Description . . . . . . . . . . . : Intel(R) Ethernet Connection (13) I219-LM Physical Address. . . . . . . . . : 00-BE-43-21-ED-ED DHCP Enabled. . . . . . . . . . . : Yes Autoconfiguration Enabled . . . . : Yes Ethernet adapter Ethernet 8: Media State . . . . . . . . . . . : Media disconnected Connection-specific DNS Suffix . : Description . . . . . . . . . . . : Realtek USB GbE Family Controller #2 Physical Address. . . . . . . . . : 00-BE-43-21-ED-EE DHCP Enabled. . . . . . . . . . . : Yes Autoconfiguration Enabled . . . . : Yes Unknown adapter wt0: Connection-specific DNS Suffix . : netbird.giservices Description . . . . . . . . . . . : WireGuard Tunnel Physical Address. . . . . . . . . : DHCP Enabled. . . . . . . . . . . : No Autoconfiguration Enabled . . . . : Yes IPv4 Address. . . . . . . . . . . : 100.67.175.125(Preferred) Subnet Mask . . . . . . . . . . . : 255.255.0.0 Default Gateway . . . . . . . . . : NetBIOS over Tcpip. . . . . . . . : Enabled Connection-specific DNS Suffix Search List : netbird.giservices Wireless LAN adapter Local Area Connection* 1: Media State . . . . . . . . . . . : Media disconnected Connection-specific DNS Suffix . : Description . . . . . . . . . . . : Microsoft Wi-Fi Direct Virtual Adapter Physical Address. . . . . . . . . : F0-57-A6-7C-54-67 DHCP Enabled. . . . . . . . . . . : Yes Autoconfiguration Enabled . . . . : Yes Wireless LAN adapter Local Area Connection* 2: Media State . . . . . . . . . . . : Media disconnected Connection-specific DNS Suffix . : Description . . . . . . . . . . . : Microsoft Wi-Fi Direct Virtual Adapter #2 Physical Address. . . . . . . . . : F2-57-A6-7C-54-66 DHCP Enabled. . . . . . . . . . . : No Autoconfiguration Enabled . . . . : Yes Ethernet adapter Ethernet 2: Media State . . . . . . . . . . . : Media disconnected Connection-specific DNS Suffix . : Description . . . . . . . . . . . : Fortinet Virtual Ethernet Adapter (NDIS 6.30) Physical Address. . . . . . . . . : 00-09-0F-FE-00-01 DHCP Enabled. . . . . . . . . . . : Yes Autoconfiguration Enabled . . . . : Yes Wireless LAN adapter Wi-Fi: Connection-specific DNS Suffix . : Description . . . . . . . . . . . : Intel(R) Wi-Fi 6 AX201 160MHz Physical Address. . . . . . . . . : F0-57-A6-7C-54-66 DHCP Enabled. . . . . . . . . . . : Yes Autoconfiguration Enabled . . . . : Yes Link-local IPv6 Address . . . . . : fe80::b2e5:c493:5d45:af3a%20(Preferred) IPv4 Address. . . . . . . . . . . : 10.171.81.29(Preferred) Subnet Mask . . . . . . . . . . . : 255.255.255.0 Lease Obtained. . . . . . . . . . : Tuesday, 25 February 2025 09:23:57 Lease Expires . . . . . . . . . . : Wednesday, 26 February 2025 09:23:57 Default Gateway . . . . . . . . . : 10.171.81.1 DHCP Server . . . . . . . . . . . : 10.171.81.1 DHCPv6 IAID . . . . . . . . . . . : 133191590 DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-29-A0-72-A9-00-BE-43-21-ED-ED DNS Servers . . . . . . . . . . . : 10.173.173.173 NetBIOS over Tcpip. . . . . . . . : Enabled Ethernet adapter Bluetooth Network Connection: Media State . . . . . . . . . . . : Media disconnected Connection-specific DNS Suffix . : Description . . . . . . . . . . . : Bluetooth Device (Personal Area Network) Physical Address. . . . . . . . . : F0-57-A6-7C-54-6A DHCP Enabled. . . . . . . . . . . : Yes Autoconfiguration Enabled . . . . : Yes PS C:\Windows\System32\WindowsPowerShell\v1.0> Get-DnsClientGlobalSetting UseSuffixSearchList : True SuffixSearchList : {elisa.net, fr01.xxx.mycorporate.net, deac.xxx.mycorporate.net, xx.xxx.net} UseDevolution : True DevolutionLevel : 0 PS C:\Windows\System32\WindowsPowerShell\v1.0> Get-DnsClientNrptGlobal EnableDAForAllNetworks QueryPolicy SecureNameQueryFallback ---------------------- ----------- ----------------------- Disable Disable Disable PS C:\Windows\System32\WindowsPowerShell\v1.0> Get-DnsClientNrptRule PS C:\Windows\System32\WindowsPowerShell\v1.0> Get-DnsClientNrptPolicy PS C:\Windows\System32\WindowsPowerShell\v1.0> Get-ChildItem -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters\DnsPolicyConfig" PS C:\Windows\System32\WindowsPowerShell\v1.0> Get-ChildItem -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient\DnsPolicyConfig" Hive: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient\DnsPolicyConfig Name Property ---- -------- NetBird-Match Version : 2 Name : {.corp.net, .corporarw.com, .nyservices.io, .netbird.giservices} GenericDNSServers : 100.67.255.254 ConfigOptions : 8
saavagebueno commented 2025-11-20 05:10:38 -05:00
Author
Owner
Copy Link

@tobiasplagge commented on GitHub (Jul 19, 2025):

Can you tell me how you solved the problem?

My DCs are accessible via a routing peer.
DNS is actually running fine, but domain availability is not there.
However, domain join does not allow user login.
For some reason my DNS is being routed incorrectly.
In order for it to work at all, I had to manually make DNS entries in the main network card.

What approach should actually work?

Thank you.

@tobiasplagge commented on GitHub (Jul 19, 2025): Can you tell me how you solved the problem? My DCs are accessible via a routing peer. DNS is actually running fine, but domain availability is not there. However, domain join does not allow user login. For some reason my DNS is being routed incorrectly. In order for it to work at all, I had to manually make DNS entries in the main network card. What approach should actually work? Thank you.
saavagebueno commented 2025-11-20 05:10:38 -05:00
Author
Owner
Copy Link

@al-dubois commented on GitHub (Sep 23, 2025):

Can you tell me how you solved the problem?

My DCs are accessible via a routing peer. DNS is actually running fine, but domain availability is not there. However, domain join does not allow user login. For some reason my DNS is being routed incorrectly. In order for it to work at all, I had to manually make DNS entries in the main network card.

What approach should actually work?

Thank you.

Any luck on your side since July 19th ? @tobiasplagge

@al-dubois commented on GitHub (Sep 23, 2025): > Can you tell me how you solved the problem? > > My DCs are accessible via a routing peer. DNS is actually running fine, but domain availability is not there. However, domain join does not allow user login. For some reason my DNS is being routed incorrectly. In order for it to work at all, I had to manually make DNS entries in the main network card. > > What approach should actually work? > > Thank you. Any luck on your side since July 19th ? @tobiasplagge
saavagebueno commented 2025-11-20 05:10:38 -05:00
Author
Owner
Copy Link

@flotpg commented on GitHub (Oct 28, 2025):

Today I tried it on a Windows 11 25H2 machine (which is only Entra ID joined, no local onprem AD join) and suddenly it's also broken there as well.
I only get DNS if I set the DNS server to match ALL domains but I don't want to push every DNS query through the tunnel.

@lixmal / @mlsmaycon do you want a debugging session?

@flotpg commented on GitHub (Oct 28, 2025): Today I tried it on a Windows 11 25H2 machine (which is only Entra ID joined, no local onprem AD join) and suddenly it's also broken there as well. I only get DNS if I set the DNS server to match ALL domains but I don't want to push every DNS query through the tunnel. @lixmal / @mlsmaycon do you want a debugging session?
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
2021 Q4
2022 Q1
2022 Q1
accessibility
acl
agent
agent
Android
Android
api
authentik
automation
azure
battery-usage
bug
cache
client
client-ui
cloud
cloud-only
cloudflare
community
compatibility
config-idp
config-issue
connection
contribution
coturn
cross-vpn
dashboard
data-usage
distribution
dns
docker
documentation
duplicate
enhancement
enhancement
event-stream
feature-request
freebsd
getting-started
go
good first issue
gui
help wanted
home-assistant
idp
inconsistency
integration
integrations
ios
ipv6
jwt
k8s
keycloak
linux
login
macos
management-service
missing-docs
mobile
moved-internal
needs-review
netbird-ui
networking
new-platform
nginx
notification
okta
openwrt
packaging
peer-management
peer-management
peer-management
performance
postgres
posture-checks
psk
pull-request
Mirrored from GitHub Pull Request
 question
refactor
relay
release
rfc
routes
security
security-related
self-hosting
server
signal
sleep-issue
ssh
ssl
status
store
synology
system-compatibility-issue
test-suite
third-party-integration
triage
triage-needed
troubleshooting
UX
waiting-feedback
windows
wontfix
zitadel
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
saavagebueno
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: SVI/netbird#383
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?