Domain names for Netbird peers not working on Debian 12 #587

@pascal-fischer commented on GitHub (Jan 22, 2024):

Hello @zwn,

we have different implementations for DNS depending on how DNS is managed on your device (e.g. by the network manager, systemd, resolvconf...) From the error message, I can see that it falls back to file-managed DNS. This way we require a nameserver to be configured that resolves all domains for our netbird resolver to work. To fix the issue you need to set a nameserver for all domains in the admin panel. You can assign a distribution group and limit the nameserver to only this peer if required.
Please let me know if this helps.

@pascal-fischer commented on GitHub (Jan 22, 2024): Hello @zwn, we have different implementations for DNS depending on how DNS is managed on your device (e.g. by the network manager, systemd, resolvconf...) From the error message, I can see that it falls back to file-managed DNS. This way we require a nameserver to be configured that resolves all domains for our netbird resolver to work. To fix the issue you need to set a nameserver for all domains in the admin panel. You can assign a distribution group and limit the nameserver to only this peer if required. Please let me know if this helps.

saavagebueno commented

@zbynekwinkler commented on GitHub (Jan 22, 2024):

It does make a difference. When I add the nameserver, the local resolver starts responding to requests. When I tried to query the resolver with dig directly, it used to time out.

However doing plain ping <fqdn> still returns Name or service not known.

This is freshly installed Debian system with no changes. Honestly, I a not even sure which way it is setup. Listing all units by systemctl suggests the system is using neither systemd-resolved nor resolvconf. First line in /etc/resolv.conf says

# Generated by NetworkManager

and the file contains only the resolvers supplied by DHCP.

Trying out nmcli c show wt0 | grep dns show there is no resolver and no search domain associated with the connection.

What else can I try?

@zbynekwinkler commented on GitHub (Jan 22, 2024): It does make a difference. When I add the nameserver, the local resolver starts responding to requests. When I tried to query the resolver with `dig` directly, it used to time out. However doing plain `ping <fqdn>` still returns `Name or service not known`. This is freshly installed Debian system with no changes. Honestly, I a not even sure which way it is setup. Listing all units by `systemctl` suggests the system is using neither `systemd-resolved` nor `resolvconf`. First line in `/etc/resolv.conf` says ``` # Generated by NetworkManager ``` and the file contains only the resolvers supplied by DHCP. Trying out `nmcli c show wt0 | grep dns` show there is no resolver and no search domain associated with the connection. What else can I try?

saavagebueno commented

@mlsmaycon commented on GitHub (Jan 22, 2024):

Hello @zwn it seems like there are two issues. First, the agent is not adding the configuration to the NetworkManager, and second, there seems to be an issue with connectivity with the DNS listener.

Can you please enable debug logs with:

sudo netbird service stop
sudo netbird service uninstall
sudo netbird service install --log-level debug
sudo netbird service start

Please share the new logs with us. (you can mask the IPs if you like it, too.

Can you also share the output of nftables: nft list ruleset?

@mlsmaycon commented on GitHub (Jan 22, 2024): Hello @zwn it seems like there are two issues. First, the agent is not adding the configuration to the NetworkManager, and second, there seems to be an issue with connectivity with the DNS listener. Can you please enable debug logs with: ```shell sudo netbird service stop sudo netbird service uninstall sudo netbird service install --log-level debug sudo netbird service start ``` Please share the new logs with us. (you can mask the IPs if you like it, too. Can you also share the output of nftables: `nft list ruleset`?

saavagebueno commented

@zbynekwinkler commented on GitHub (Jan 23, 2024):

Interesting. I have run the steps to enable debug logs and now.... it works. The contents of /etc/resolv.conf are now:

# Generated by NetBird
# If needed you can restore the original file by copying back /etc/resolv.conf.original.netbird

search netbird.cloud
nameserver 100.106.197.71
nameserver 1.1.1.1
nameserver 1.0.0.1

Oh, and I don't have nftables

$ nft
bash: nft: command not found

So I am all set now. If there is anything else I can do to help find the root cause of the problem, just let me know. I have a freshly installed Debian 12 system and to get netbird I have followed the steps at https://app.netbird.io/install which resulted in me being able to use only numeric IPs to get to the peers. Then I have added cloudflare nameserver in the admin console and removed and re-added the service as advised, after which everything works as expected.

@zbynekwinkler commented on GitHub (Jan 23, 2024): Interesting. I have run the steps to enable debug logs and now.... it works. The contents of `/etc/resolv.conf` are now: ``` # Generated by NetBird # If needed you can restore the original file by copying back /etc/resolv.conf.original.netbird search netbird.cloud nameserver 100.106.197.71 nameserver 1.1.1.1 nameserver 1.0.0.1 ``` Oh, and I don't have nftables ``` $ nft bash: nft: command not found ``` So I am all set now. If there is anything else I can do to help find the root cause of the problem, just let me know. I have a freshly installed Debian 12 system and to get netbird I have followed the steps at https://app.netbird.io/install which resulted in me being able to use only numeric IPs to get to the peers. Then I have added cloudflare nameserver in the admin console and removed and re-added the service as advised, after which everything works as expected.

saavagebueno commented

@zbynekwinkler commented on GitHub (Jan 24, 2024):

It seems to be related to sleep (suspend). After wakeup, /etc/resolv.conf is back to NetworkManager generated but netbird status says I am connected. Bring it down and up again gives me back Generated by NetBird resolv.conf - so far so good - but ping <name> still does not work. The netbird resolver works (responds to dig @<nebirdip> <name> correctly) but the system does not use it despite being listed in the resolv.conf now. After another down & up it works again. So maybe time for some logs? Which ones and how much?

@zbynekwinkler commented on GitHub (Jan 24, 2024): It seems to be related to sleep (suspend). After wakeup, `/etc/resolv.conf` is back to NetworkManager generated but `netbird status` says I am connected. Bring it down and up again gives me back `Generated by NetBird` resolv.conf - so far so good - but `ping <name>` still does not work. The netbird resolver works (responds to `dig @<nebirdip> <name>` correctly) but the system does not use it despite being listed in the resolv.conf now. After another down & up it works again. So maybe time for some logs? Which ones and how much?

saavagebueno commented

@jorgeag68 commented on GitHub (Apr 4, 2024):

Same issue is happening on ubuntu 22.04.
Cannot get the DNS to work.

2024-04-04T09:22:03+01:00 ERRO client/internal/dns/server.go:323: unable to configure DNS for this peer using file manager without a nameserver group with all domains configured
2024-04-04T09:22:03+01:00 INFO client/internal/acl/manager.go:52: ACL rules processed in: 1.045913ms, total rules

@jorgeag68 commented on GitHub (Apr 4, 2024): Same issue is happening on ubuntu 22.04. Cannot get the DNS to work. 2024-04-04T09:22:03+01:00 ERRO client/internal/dns/server.go:323: unable to configure DNS for this peer using file manager without a nameserver group with all domains configured 2024-04-04T09:22:03+01:00 INFO client/internal/acl/manager.go:52: ACL rules processed in: 1.045913ms, total rules

saavagebueno commented

@lixmal commented on GitHub (Apr 4, 2024):

@zwn can you check if the issue still persists with newer versions? We've implemented a constant-overwrite for the file manager.

@lixmal commented on GitHub (Apr 4, 2024): @zwn can you check if the issue still persists with newer versions? We've implemented a constant-overwrite for the file manager.

saavagebueno commented

@lixmal commented on GitHub (Apr 4, 2024):

@jorgeag68 have you followed this comment https://github.com/netbirdio/netbird/issues/1483#issuecomment-1904282825

@lixmal commented on GitHub (Apr 4, 2024): @jorgeag68 have you followed this comment https://github.com/netbirdio/netbird/issues/1483#issuecomment-1904282825

saavagebueno commented

@jorgeag68 commented on GitHub (Apr 5, 2024):

@lixmal Thank you for pointing that out to me. I've configured a generic DNS for group All and then the specific DNS depending on other groups/locations. It now works as expected on ubuntu 22.04.

@jorgeag68 commented on GitHub (Apr 5, 2024): @lixmal Thank you for pointing that out to me. I've configured a generic DNS for group All and then the specific DNS depending on other groups/locations. It now works as expected on ubuntu 22.04.

saavagebueno commented

@zbynekwinkler commented on GitHub (Apr 8, 2024):

@lixmal Seems to be working now. Setting up the global nameserver as described https://github.com/netbirdio/netbird/issues/1483#issuecomment-1904282825 is required - but it is somewhat surprising - I am not sure how I would get this info were it not for this comment.

@zbynekwinkler commented on GitHub (Apr 8, 2024): @lixmal Seems to be working now. Setting up the global nameserver as described https://github.com/netbirdio/netbird/issues/1483#issuecomment-1904282825 is required - but it is somewhat surprising - I am not sure how I would get this info were it not for this comment.

saavagebueno commented

@cannonfodda commented on GitHub (Sep 10, 2024):

@zwn I'm with you on that one. I've spent days trying to work around this and if I hadn't stumbled across this issue I'd still be going. @lixmal It would be great to add this to the docs for those working on minimum installs without resolved.

@cannonfodda commented on GitHub (Sep 10, 2024): @zwn I'm with you on that one. I've spent days trying to work around this and if I hadn't stumbled across this issue I'd still be going. @lixmal It would be great to add this to the docs for those working on minimum installs without resolved.

saavagebueno commented

@lixmal commented on GitHub (Sep 10, 2024):

We mention it here https://docs.netbird.io/how-to/manage-dns-in-your-network#match-domains in the hint box but I guess it could be improved

@lixmal commented on GitHub (Sep 10, 2024): We mention it here https://docs.netbird.io/how-to/manage-dns-in-your-network#match-domains in the hint box but I guess it could be improved

saavagebueno commented

@cannonfodda commented on GitHub (Sep 10, 2024):

@lixmal Gotcha thanks👍.
I had seen that hint but given I wasn't trying to do anything fancy with nameservers or the like it never occurred to me that it might be the solution. We are working off a minimal debian install so it's only NetworkManager that is set up by default and I had assumed that local resolution would work out of the box as that's implied by the docs. It would good to add a statement to the docs for us simple people who aren't planning on running their own nameservers. 😄

Happy to help draft something if it's of use.

@cannonfodda commented on GitHub (Sep 10, 2024): @lixmal Gotcha thanks👍. I had seen that hint but given I wasn't trying to do anything fancy with nameservers or the like it never occurred to me that it might be the solution. We are working off a minimal debian install so it's only NetworkManager that is set up by default and I had assumed that local resolution would work out of the box as that's implied by the docs. It would good to add a statement to the docs for us simple people who aren't planning on running their own nameservers. 😄 Happy to help draft something if it's of use.

saavagebueno commented

@jakob1379 commented on GitHub (Oct 25, 2024):

We mention it here https://docs.netbird.io/how-to/manage-dns-in-your-network#match-domains in the hint box but I guess it could be improved

Out of the box, my domain matched nameserver was working on windows, but not for linux or android. Adding a global nameserver e.g. cloudflare made made netbird change the /etc/resolve.conf work across both linux and android. Before that with only my domain matched nameserver, netbird would not set the nameservers.

@jakob1379 commented on GitHub (Oct 25, 2024): > We mention it here https://docs.netbird.io/how-to/manage-dns-in-your-network#match-domains in the hint box but I guess it could be improved Out of the box, my domain matched nameserver was working on windows, but not for linux or android. Adding a global nameserver e.g. cloudflare made made netbird change the `/etc/resolve.conf` work across both linux and android. Before that with only my domain matched nameserver, netbird would not set the nameservers.

saavagebueno commented

@astrograyt commented on GitHub (Dec 8, 2024):

I have a similar issue but with a Docker client running on a Linux peer. Please let me know if I should open a new issue for this, I just decided to put it here, as this issue seems relevant to mine.

On my NetBird server (v0.28.9), I've set up a custom DNS nameserver as such:

IP: 100.xxx.xxx.xxx (a peer running a DNS server--PiHole)
Port: 53
Distribution Group: All
Match Domains: None

I also have the default Access Policy conneting every pear to each other and no Network Routes.

Here's my NetBird client docker compose file:

services:
  netbird-client:
    image: netbirdio/netbird:latest # Alpine linux with systemd-resolved
    container_name: netbird-client
    privileged: true
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
      - SYS_RESOURCE
    environment:
      - NB_SETUP_KEY=${NB_SETUP_KEY}
      - NB_MANAGEMENT_URL=https://netbird.[mysite.com]
    volumes:
      - netbird-config:/etc/netbird
    network_mode: host
    restart: unless-stopped

volumes:
  netbird-config:

When bringing up the stack, I see these logs:

netbird-client  | 2024-12-08T10:20:20Z INFO client/internal/connect.go:113: starting NetBird client version 0.34.1 on linux/amd64
...
netbird-client  | 2024-12-08T10:20:20Z INFO client/internal/dns/host_unix.go:54: System DNS manager discovered: file
...
netbird-client  | 2024-12-08T10:20:20Z INFO client/internal/connect.go:271: Netbird engine started, the IP is: 100.xxx.xxx.xxx/16
...
netbird-client  | 2024-12-08T10:20:20Z WARN client/internal/dns/server.go:316: the DNS manager of this peer doesn't support custom port. Disabling primary DNS setup. Learn more at: https://docs.netbird.io/how-to/manage-dns-in-your-network#local-resolver
netbird-client  | 2024-12-08T10:20:20Z ERRO client/internal/dns/server.go:322: unable to configure DNS for this peer using file manager without a nameserver group with all domains configured

First of all, I see that the logs claim that the DNS manager of this peer doesn't support custom port. which is strange as my custom DNS runs on port 53. Secondly, I don't really understand this unable to configure DNS for this peer using file manager without a nameserver group with all domains configured. As mentioned above, I have a custom DNS for all domains.

From within the NetBird Client container, I can resolve domains through my custom DNS

# dig @100.xxx.xxx.xxx example.com
...
;; ANSWER SECTION:
example.com.		210	IN	A	93.184.215.14

;; Query time: 3 msec
...

However, looking at the resolv.conf within the NetBird Client container, I see that it hasn't properly set,

/ # cat /etc/resolv.conf
# Generated by Docker Engine.
# This file can be edited; Docker Engine will not make further changes once it
# has been modified.

nameserver 127.0.0.1
nameserver 192.168.2.1
nameserver fe80::1%3
search speedport.ip

# Based on host file: '/etc/resolv.conf'
# Overrides: []

From the Linux host, I can also resolve domains through my custom DNS and I'm connetced to all peers. The host resolve.conf has also not been overrriden by NetBird and it's still managed by systemd.

I've also checked my custom DNS against a Linux machine running the NetBird client executable, an Android phone, and an iOS phone, with no luck. I'm pretty sure I'm missing something here but after two days, I'm still desperate to find it. Any help would be much appreciated.

@astrograyt commented on GitHub (Dec 8, 2024): I have a similar issue but with a Docker client running on a Linux peer. Please let me know if I should open a new issue for this, I just decided to put it here, as this issue seems relevant to mine. On my NetBird server (v0.28.9), I've set up a custom DNS nameserver as such: - IP: 100.xxx.xxx.xxx (a peer running a DNS server--PiHole) - Port: 53 - Distribution Group: All - Match Domains: None I also have the default Access Policy conneting every pear to each other and no Network Routes. Here's my NetBird client docker compose file: ```yaml services: netbird-client: image: netbirdio/netbird:latest # Alpine linux with systemd-resolved container_name: netbird-client privileged: true cap_add: - NET_ADMIN - SYS_MODULE - SYS_RESOURCE environment: - NB_SETUP_KEY=${NB_SETUP_KEY} - NB_MANAGEMENT_URL=https://netbird.[mysite.com] volumes: - netbird-config:/etc/netbird network_mode: host restart: unless-stopped volumes: netbird-config: ``` When bringing up the stack, I see these logs: ``` netbird-client | 2024-12-08T10:20:20Z INFO client/internal/connect.go:113: starting NetBird client version 0.34.1 on linux/amd64 ... netbird-client | 2024-12-08T10:20:20Z INFO client/internal/dns/host_unix.go:54: System DNS manager discovered: file ... netbird-client | 2024-12-08T10:20:20Z INFO client/internal/connect.go:271: Netbird engine started, the IP is: 100.xxx.xxx.xxx/16 ... netbird-client | 2024-12-08T10:20:20Z WARN client/internal/dns/server.go:316: the DNS manager of this peer doesn't support custom port. Disabling primary DNS setup. Learn more at: https://docs.netbird.io/how-to/manage-dns-in-your-network#local-resolver netbird-client | 2024-12-08T10:20:20Z ERRO client/internal/dns/server.go:322: unable to configure DNS for this peer using file manager without a nameserver group with all domains configured ``` First of all, I see that the logs claim that `the DNS manager of this peer doesn't support custom port.` which is strange as my custom DNS runs on port 53. Secondly, I don't really understand this `unable to configure DNS for this peer using file manager without a nameserver group with all domains configured`. As mentioned above, I have a custom DNS for all domains. From within the NetBird Client container, I can resolve domains through my custom DNS ```bash # dig @100.xxx.xxx.xxx example.com ... ;; ANSWER SECTION: example.com. 210 IN A 93.184.215.14 ;; Query time: 3 msec ... ``` However, looking at the `resolv.conf` within the NetBird Client container, I see that it hasn't properly set, ```bash / # cat /etc/resolv.conf # Generated by Docker Engine. # This file can be edited; Docker Engine will not make further changes once it # has been modified. nameserver 127.0.0.1 nameserver 192.168.2.1 nameserver fe80::1%3 search speedport.ip # Based on host file: '/etc/resolv.conf' # Overrides: [] ``` From the Linux host, I can also resolve domains through my custom DNS and I'm connetced to all peers. The host `resolve.conf` has also not been overrriden by NetBird and it's still managed by `systemd`. I've also checked my custom DNS against a Linux machine running the NetBird client executable, an Android phone, and an iOS phone, with no luck. I'm pretty sure I'm missing something here but after two days, I'm still desperate to find it. Any help would be much appreciated.

saavagebueno commented

@mlsmaycon commented on GitHub (Dec 8, 2024):

@astrograyt have you tried adding a nameserver configuration without any matching domain (which is the all resolver)?

@mlsmaycon commented on GitHub (Dec 8, 2024): @astrograyt have you tried adding a nameserver configuration without any matching domain (which is the all resolver)?

saavagebueno commented

@astrograyt commented on GitHub (Dec 8, 2024):

@mlsmaycon Yes, I've already tried that. Here's the turn of events so far:

A nameserver with no matching domains -> Failed
Added the ALL Network Route (just in case) -> Failed
Removed the Network Route and added some matching domains -> Failed
Switched to a global (Cloudflare) nameserver with no matching domains + an internal (PiHole) nameserver with some internal matching domains -> Failed
Reverted to the original single internal nameserver with no matching domains -> Failed

At this point, I realized that reading logs, documentation, and ChatGPT isn't going to resolve the issue, so reached out here.

Since the custom DNS setup fails across all devices (Docker, Linux, Android, and iOS), I think I'm missing something more fundamental. What's confusing me is that regardless of the configuration above, I always get the following error:

unable to configure DNS for this peer using file manager without a nameserver group with all domains configured

I've already tried restarting the server, removing the Docker client volume, setting up a new Docker client with a fresh access point and no previous configuration, etc., but nothing has worked so far. Even FQDN doesn't work (I forgot to mention this also)

I'm really confused about where I might be going wrong. Any insights would be greatly appreciated!

@astrograyt commented on GitHub (Dec 8, 2024): @mlsmaycon Yes, I've already tried that. Here's the turn of events so far: - A nameserver with no matching domains -> Failed - Added the ALL Network Route (just in case) -> Failed - Removed the Network Route and added some matching domains -> Failed - Switched to a global (Cloudflare) nameserver with no matching domains + an internal (PiHole) nameserver with some internal matching domains -> Failed - Reverted to the original single internal nameserver with no matching domains -> Failed At this point, I realized that reading logs, documentation, and ChatGPT isn't going to resolve the issue, so reached out here. Since the custom DNS setup fails across all devices (Docker, Linux, Android, and iOS), I think I'm missing something more fundamental. What's confusing me is that regardless of the configuration above, I always get the following error: ``` unable to configure DNS for this peer using file manager without a nameserver group with all domains configured ``` I've already tried restarting the server, removing the Docker client volume, setting up a new Docker client with a fresh access point and no previous configuration, etc., but nothing has worked so far. Even FQDN doesn't work (I forgot to mention this also) I'm really confused about where I might be going wrong. Any insights would be greatly appreciated!

saavagebueno commented

@scroguard commented on GitHub (Dec 16, 2024):

i am experiencing this issue as well in pop!os 22.04lts and a self-hosted netbird installation. while dns appears to be set properly per the logs, queries do not resolve to the correct ip addresses. i have configured as follows:

global nameserver setup for ALL domains (cloudflare) and ALL clients.
specific nameserver setup for specific domain, pushed out to clients in a specific group.

any possible network configuration tools like NetworkManager or systemd-resolved are default as this is a fresh installation. no matter what DNS settings i apply in the netbird admin ui, the dns servers received via dhcp always take priority and respond to the queries.

@scroguard commented on GitHub (Dec 16, 2024): i am experiencing this issue as well in pop!os 22.04lts and a self-hosted netbird installation. while dns appears to be set properly per the logs, queries do not resolve to the correct ip addresses. i have configured as follows: - global nameserver setup for ALL domains (cloudflare) and ALL clients. - specific nameserver setup for specific domain, pushed out to clients in a specific group. any possible network configuration tools like NetworkManager or systemd-resolved are default as this is a fresh installation. no matter what DNS settings i apply in the netbird admin ui, the dns servers received via dhcp always take priority and respond to the queries.

saavagebueno commented

@fruworg commented on GitHub (Feb 13, 2025):

same issue (rhel 9)

@fruworg commented on GitHub (Feb 13, 2025): same issue (rhel 9)

saavagebueno commented

@Kamaradeivanov commented on GitHub (Mar 3, 2025):

Hello, I'm experiencing the same issue.

After some investigation, I found that in my case, I couldn't ping my custom DNS nameserver after running netbird up (which is Google's metadata server at 169.254.169.254 in my case). I also discovered that my Wi-Fi card automatically added the following route: 169.254.0.0/16 via wlan0.

Using nmcli, I noticed that a corresponding static route was added to wlan0. This prevented NetBird from properly adding the 169.254.169.254/32 route. The culprit was avahi-autoipd, which was adding this route via /etc/network/if-up.d/avahi-autoipd or .

To fix the issue, I removed it using the following command:

sudo apt remove avahi-autoipd

After that, everything worked as expected. Hope this helps others facing the same problem!

@Kamaradeivanov commented on GitHub (Mar 3, 2025): Hello, I'm experiencing the same issue. After some investigation, I found that in my case, I couldn't ping my custom DNS nameserver after running `netbird up` (which is Google's metadata server at 169.254.169.254 in my case). I also discovered that my Wi-Fi card automatically added the following route: `169.254.0.0/16` via `wlan0`. Using `nmcli`, I noticed that a corresponding static route was added to wlan0. This prevented NetBird from properly adding the `169.254.169.254/32` route. The culprit was avahi-autoipd, which was adding this route via `/etc/network/if-up.d/avahi-autoipd` or . To fix the issue, I removed it using the following command: ``` sudo apt remove avahi-autoipd ``` After that, everything worked as expected. Hope this helps others facing the same problem!

saavagebueno commented

@azdolinski commented on GitHub (Apr 2, 2025):

Just to explain this topic.. as I had the same problem on Debian 12.
Few remarks:

APT - resolvconf is not same as systemd-resolved - I'm using systemd-resolved

apt-get purge resolvconf
apt-get install systemd-resolved
systemctl restart systemd-resolved
systemctl status systemd-resolved
resolvectl status

Follow netbird instruction...

root@n:~# sudo ss -nlptu 'sport = 53' | grep netbird
udp   UNCONN 0      0      100.75.92.209:53        0.0.0.0:*    users:(("netbird",pid=91882,fd=17))
root@n:~# sudo netstat -ltnup | grep ':53' | grep netbird
udp        0      0 100.75.92.209:53        0.0.0.0:*                           91882/netbird

You should be able to see your netbird client running... and listening for DNS request on his internal IP

As this is an internal netbird IP... better is to change this to a static loopback IP...

sudo sed -i 's/"CustomDNSAddress": "",/"CustomDNSAddress": "127.0.0.153:53",/' /etc/netbird/config.json

.53 is busy... by systemd-resolved

you can do that also via command - but json edit is preferred as it will always stay in configuration:

netbird up --dns-resolver-address 127.0.0.153:53

and you should have now:

root@n:/etc/systemd/network# sudo netstat -ltnup | grep ':53' | grep netbird
udp        0      0 127.0.0.153:53          0.0.0.0:*                           1541/netbird

systemd-resolved - set your global DNS:

echo "DNS=192.168.1.1" >> /etc/systemd/resolved.conf
systemctl restart systemd-resolved

end check by command:

resolvectl status

Now the most problematic part... netbird domain... as we have netbird which you can query on local 127.0.0.153:53 - you can set in systemd-resolved this path to search domains inside netbird

# Set Internal Netbird DNS on wt0 interface
sudo resolvectl dns wt0 127.0.0.153
sudo resolvectl domain wt0 netbird.cloud 75.100.in-addr.arpa

# Check
sudo resolvectl dns
sudo resolvectl domain

# In case of any changes - you can always reset interface dns settings
sudo resolvectl revert wt0

The scope of search (when you check status by resolvectl status) should change for wt0 from none to DNS.
The problem now - is that when you will restart netbird... - this setting will not survey as the interface will be removed and a new wt0 will be added,

Quick option - add ExecStartPost to serviced:

root@netbird1:~# cat /etc/systemd/system/netbird.service
[Unit]
Description=A WireGuard-based mesh network that connects your devices into a single private network.
ConditionFileIsExecutable=/usr/bin/netbird

After=network.target syslog.target

[Service]
StartLimitInterval=5
StartLimitBurst=10
ExecStart=/usr/bin/netbird "service" "run" "--config" "/etc/netbird/config.json" "--log-level" "info" "--daemon-addr" "unix:///var/run/netbird.sock" "--log-file" "/var/log/netbird/client.log"

ExecStartPost=sleep 5
ExecStartPost=resolvectl dns wt0 127.0.0.153
ExecStartPost=resolvectl domain wt0 netbird.cloud 75.100.in-addr.arpa


StandardOutput=file:/var/log/netbird/netbird.out
StandardError=file:/var/log/netbird/netbird.err

Restart=always

RestartSec=120
EnvironmentFile=-/etc/sysconfig/netbird

[Install]
WantedBy=multi-user.target

then

systemctl daemon-reload
systemctl restart netbird
resolvectl status

and you should see that resolvectl for wt0 reports correct settings

Remember to change IP range ->
100.75.x.x -> 75.100.in-addr.arpa

@azdolinski commented on GitHub (Apr 2, 2025): Just to explain this topic.. as I had the same problem on Debian 12. Few remarks: 1) APT - `resolvconf` is not same as `systemd-resolved` - I'm using systemd-resolved ```bash apt-get purge resolvconf apt-get install systemd-resolved systemctl restart systemd-resolved systemctl status systemd-resolved resolvectl status ``` 2) Follow `netbird` instruction... ```bash root@n:~# sudo ss -nlptu 'sport = 53' | grep netbird udp UNCONN 0 0 100.75.92.209:53 0.0.0.0:* users:(("netbird",pid=91882,fd=17)) root@n:~# sudo netstat -ltnup | grep ':53' | grep netbird udp 0 0 100.75.92.209:53 0.0.0.0:* 91882/netbird ``` You should be able to see your `netbird` client running... and listening for DNS request on his internal IP 3) As this is an internal `netbird` IP... better is to change this to a static loopback IP... ```bash sudo sed -i 's/"CustomDNSAddress": "",/"CustomDNSAddress": "127.0.0.153:53",/' /etc/netbird/config.json ``` .53 is busy... by `systemd-resolved` you can do that also via command - but json edit is preferred as it will always stay in configuration: ```bash netbird up --dns-resolver-address 127.0.0.153:53 ``` and you should have now: ```bash root@n:/etc/systemd/network# sudo netstat -ltnup | grep ':53' | grep netbird udp 0 0 127.0.0.153:53 0.0.0.0:* 1541/netbird ``` 4) `systemd-resolved` - set your global DNS: ```bash echo "DNS=192.168.1.1" >> /etc/systemd/resolved.conf systemctl restart systemd-resolved ``` end check by command: ```bash resolvectl status ``` 5) Now the most problematic part... `netbird domain`... as we have `netbird` which you can query on local 127.0.0.153:53 - you can set in `systemd-resolved` this path to search domains inside `netbird` ```bash # Set Internal Netbird DNS on wt0 interface sudo resolvectl dns wt0 127.0.0.153 sudo resolvectl domain wt0 netbird.cloud 75.100.in-addr.arpa # Check sudo resolvectl dns sudo resolvectl domain # In case of any changes - you can always reset interface dns settings sudo resolvectl revert wt0 ``` The scope of search (when you check status by `resolvectl status`) should change for wt0 from `none` to `DNS`. The problem now - is that when you will restart netbird... - this setting will not survey as the interface will be removed and a new wt0 will be added, Quick option - add `ExecStartPost` to serviced: ``` root@netbird1:~# cat /etc/systemd/system/netbird.service [Unit] Description=A WireGuard-based mesh network that connects your devices into a single private network. ConditionFileIsExecutable=/usr/bin/netbird After=network.target syslog.target [Service] StartLimitInterval=5 StartLimitBurst=10 ExecStart=/usr/bin/netbird "service" "run" "--config" "/etc/netbird/config.json" "--log-level" "info" "--daemon-addr" "unix:///var/run/netbird.sock" "--log-file" "/var/log/netbird/client.log" ExecStartPost=sleep 5 ExecStartPost=resolvectl dns wt0 127.0.0.153 ExecStartPost=resolvectl domain wt0 netbird.cloud 75.100.in-addr.arpa StandardOutput=file:/var/log/netbird/netbird.out StandardError=file:/var/log/netbird/netbird.err Restart=always RestartSec=120 EnvironmentFile=-/etc/sysconfig/netbird [Install] WantedBy=multi-user.target ``` then ```bash systemctl daemon-reload systemctl restart netbird resolvectl status ``` and you should see that `resolvectl` for `wt0` reports correct settings Remember to change IP range -> 100.`75`.x.x -> `75`.100.in-addr.arpa

saavagebueno commented

@nazarewk commented on GitHub (Apr 3, 2025):

@azdolinski
The Netbird client daemon should be registering with systemd-resolved without additional interaction.
If it's not doing that there might be some kind of issue with the DNS manager detection at
09243a0fe0/client/internal/dns/host_unix.go (L77-L123)
it's basically parsing the /etc/resolv.conf searching for pieces of information added by the specific implementation:

does not start with a comment # -> fileManager
does it contain NetworkManager -> NetworkManager
does it contain systemd-resolved?
1. does it contain 127.0.0.53 entry? -> systemd-resolved
2. -> fileManager
does it contain resolvconf?
1. is it resolved running in ResolvConf mode? -> systemd-resolved
2. -> resolvconf
fileManager

Could you validate the presence of a log message containing System DNS manager discovered: and whether it reports systemd?

If it does not return systemd it would help us tremendously to figure out why it is selecting the wrong DNS manager. You can try to do this by yourself, or we could schedule a live debugging session.

@nazarewk commented on GitHub (Apr 3, 2025): @azdolinski The Netbird client daemon should be registering with `systemd-resolved` without additional interaction. If it's not doing that there might be some kind of issue with the DNS manager detection at https://github.com/netbirdio/netbird/blob/09243a0fe0c66fa4cac6c4ebbb1878e24da91228/client/internal/dns/host_unix.go#L77-L123 it's basically parsing the `/etc/resolv.conf` searching for pieces of information added by the specific implementation: 1. does not start with a comment `#` -> fileManager 2. does it contain `NetworkManager` -> NetworkManager 3. does it contain `systemd-resolved`? 1. does it contain `127.0.0.53` entry? -> systemd-resolved 2. -> fileManager 4. does it contain `resolvconf`? 1. is it `resolved` running in ResolvConf mode? -> systemd-resolved 2. -> resolvconf 5. fileManager Could you validate the presence of a log message containing `System DNS manager discovered: ` and whether it reports `systemd`? If it does not return `systemd` it would help us tremendously to figure out why it is selecting the wrong DNS manager. You can try to do this by yourself, or we could schedule a live debugging session.

saavagebueno commented

@azdolinski commented on GitHub (Apr 3, 2025):

@nazarewk

Based on what I understood from code - and I'm not so much go experience.
You check 3 types of DNS managers:

NetworkManager
systemd-resolved < my case
resolvconf

If it finds "systemd-resolved" and confirms the service is running (isSystemdResolvedRunning):
A) It further checks if systemd-resolved is using its "stub" mode (checkStub(), often meaning /etc/resolv.conf points to 127.0.0.53). If yes, it returns systemdManager.
B) If systemd-resolved is running but not in stub mode, it defaults back to fileManager (implying /etc/resolv.conf might be static or managed differently despite systemd-resolved running).

I checked and /run/systemd/resolve/stub-resolv.conf is configured correctly:

nameserver 127.0.0.53
options edns0 trust-ad
search netbird.cloud 75.100.in-addr.arpa

But as I'm using Proxmox container LXC - and it is by default overwritten always /etc/resolv.conf - so in my case always option B would be selected - and I can't change they way how proxmox manage DNS section as this is hardcoded in pve system.

cat /etc/resolv.conf
# --- BEGIN PVE ---
search local
nameserver 192.168.1.1
# --- END PVE ---

In that situation, I found on proxmox forum workaround:

touch /etc/.pve-ignore.resolv.conf
rm /etc/resolv.conf
ln -s /run/systemd/resolve/stub-resolv.conf /etc/resolv.conf
nano /etc/systemd/resolved.conf                                      -> check DNS server is defined

Which is also resolve problem.

@azdolinski commented on GitHub (Apr 3, 2025): @nazarewk Based on what I understood from code - and I'm not so much `go` experience. You check 3 types of DNS managers: - NetworkManager - systemd-resolved `< my case` - resolvconf If it finds "systemd-resolved" and confirms the service is running (isSystemdResolvedRunning): A) It further checks if systemd-resolved is using its "stub" mode (checkStub(), often meaning /etc/resolv.conf points to 127.0.0.53). If yes, it returns systemdManager. B) If systemd-resolved is running but not in stub mode, it defaults back to fileManager (implying /etc/resolv.conf might be static or managed differently despite systemd-resolved running). I checked and `/run/systemd/resolve/stub-resolv.conf` is configured correctly: ```bash nameserver 127.0.0.53 options edns0 trust-ad search netbird.cloud 75.100.in-addr.arpa ``` But as I'm using Proxmox container LXC - and it is by default overwritten always `/etc/resolv.conf` - so in my case always option B would be selected - and I can't change they way how proxmox manage DNS section as this is hardcoded in pve system. ```bash cat /etc/resolv.conf # --- BEGIN PVE --- search local nameserver 192.168.1.1 # --- END PVE --- ``` In that situation, I found on proxmox forum workaround: ```bash touch /etc/.pve-ignore.resolv.conf rm /etc/resolv.conf ln -s /run/systemd/resolve/stub-resolv.conf /etc/resolv.conf nano /etc/systemd/resolved.conf -> check DNS server is defined ``` Which is also resolve problem.

saavagebueno commented

https://github.com/CachyOS/CachyOS-Settings/blob/master/usr/lib/NetworkManager/conf.d/dns.conf

@olanystrom commented on GitHub (Apr 12, 2025):

I have a similar problem with CachyOS
NetworkManager uses systemd-resolved as resolver, but since the resolv.conf does not include the text systemd-resolved it fails to see that.

2025-04-12T22:19:44+02:00 INFO client/internal/dns/host_unix.go:54: System DNS manager discovered: file

so my /etc/resolv.conf looks like

# Generated by NetworkManager
search int.MYDOMAIN
nameserver 127.0.0.53
options edns0 trust-ad

@olanystrom commented on GitHub (Apr 12, 2025): I have a similar problem with CachyOS NetworkManager uses systemd-resolved as resolver, but since the resolv.conf does not include the text systemd-resolved it fails to see that. `2025-04-12T22:19:44+02:00 INFO client/internal/dns/host_unix.go:54: System DNS manager discovered: file` https://github.com/CachyOS/CachyOS-Settings/blob/master/usr/lib/NetworkManager/conf.d/dns.conf so my /etc/resolv.conf looks like ``` # Generated by NetworkManager search int.MYDOMAIN nameserver 127.0.0.53 options edns0 trust-ad ```

saavagebueno commented

@olanystrom commented on GitHub (Apr 13, 2025):

I resolved my problem by just doing (as root)

cd /etc
rm resolv.conf && ln -s ../run/systemd/resolve/stub-resolv.conf resolv.conf

@olanystrom commented on GitHub (Apr 13, 2025): I resolved my problem by just doing (as root) ``` cd /etc rm resolv.conf && ln -s ../run/systemd/resolve/stub-resolv.conf resolv.conf ```

saavagebueno commented

@alkeryn commented on GitHub (Apr 24, 2025):

hey i thought this may be relevent to people browsing here that still cannot make it work.
turns out i just needed to disable dnsovertls with :

sudo resolvectl dnsovertls wt0 no

and it worked.

you could make the setting permanent too.

though it may not apply to you if you don't use dns over tls.

@alkeryn commented on GitHub (Apr 24, 2025): hey i thought this may be relevent to people browsing here that still cannot make it work. turns out i just needed to disable dnsovertls with : ``` sudo resolvectl dnsovertls wt0 no ``` and it worked. you could make the setting permanent too. though it may not apply to you if you don't use dns over tls.

saavagebueno commented

@bannert1337 commented on GitHub (May 14, 2025):

I resolved my problem by just doing (as root)
cd /etc
rm resolv.conf && ln -s ../run/systemd/resolve/stub-resolv.conf resolv.conf

This also has resolved the issue for me on CachyOS. Thank you!

@bannert1337 commented on GitHub (May 14, 2025): > I resolved my problem by just doing (as root) > > ``` > cd /etc > rm resolv.conf && ln -s ../run/systemd/resolve/stub-resolv.conf resolv.conf > ``` This also has resolved the issue for me on CachyOS. Thank you!

saavagebueno commented

@sodennis commented on GitHub (May 17, 2025):

Nice find! I had been stuck on this DNS issue for months even though Netbird was running on a Linux server running systemd-resolved.

Only MacOS, Windows 10+, and Linux running systemd-resolved support nameservers with only match domains. For a better experience, we recommend setting at least a nameserver group without match domains to be applied to the All group.

Netbird thought the DNS nameservers were managed by a file. That's why we relied on having a nameserver group without match domains.

It is what the default /etc/resolv.conf contains:

# This is /run/systemd/resolve/resolv.conf managed by man:systemd-resolved(8).
# Do not edit.
#
# This file might be symlinked as /etc/resolv.conf. If you're looking at
# /etc/resolv.conf and seeing this text, you have followed the symlink.
#
# This is a dynamic resolv.conf file for connecting local clients directly to
# all known uplink DNS servers. This file lists all configured search domains.
#
# Third party programs should typically not access this file directly, but only
# through the symlink at /etc/resolv.conf. To manage man:resolv.conf(5) in a
# different way, replace this symlink by a static file or a different symlink.
#
# See man:systemd-resolved.service(8) for details about the supported modes of
# operation for /etc/resolv.conf.

nameserver 192.168.0.1
nameserver 192.168.0.2
search .

> systemctl status systemd-resolved
● systemd-resolved.service - Network Name Resolution
     Loaded: loaded (/lib/systemd/system/systemd-resolved.service; enabled; preset: enabled)
     Active: active (running) since Sat 2025-05-17 03:57:05 UTC; 50min ago

> sudo cat /var/log/netbird/client.log | grep "System DNS manager discovered:"

2025-05-17T04:10:02Z INFO client/internal/dns/host_unix.go:54: System DNS manager discovered: file
2025-05-17T04:12:00Z INFO client/internal/dns/host_unix.go:54: System DNS manager discovered: file

After replacing the /etc/resolv.conf with /run/systemd/resolve/stub-resolv.conf, Netbird detected the DNS namerservers were being managed by systemd-resolved. .netbird.cloud and the match domains started to resolve.

touch /etc/.pve-ignore.resolv.conf
rm /etc/resolv.conf
ln -s /run/systemd/resolve/stub-resolv.conf /etc/resolv.conf
nano /etc/systemd/resolved.conf

> sudo cat /var/log/netbird/client.log | grep "System DNS manager discovered:"
2025-05-17T04:35:20Z INFO client/internal/dns/host_unix.go:54: System DNS manager discovered: systemd

We should add some troubleshooting steps in the documentation: https://docs.netbird.io/how-to/manage-dns-in-your-network#creating-a-nameserver-for-specific-domains

@sodennis commented on GitHub (May 17, 2025): Nice find! I had been stuck on this DNS issue for months even though Netbird was running on a Linux server running systemd-resolved. > Only MacOS, Windows 10+, and Linux running systemd-resolved support nameservers with only match domains. For a better experience, we recommend setting at least a nameserver group without match domains to be applied to the All group. Netbird thought the DNS nameservers were managed by a file. That's why we relied on having a nameserver group without match domains. It is what the default `/etc/resolv.conf` contains: ``` # This is /run/systemd/resolve/resolv.conf managed by man:systemd-resolved(8). # Do not edit. # # This file might be symlinked as /etc/resolv.conf. If you're looking at # /etc/resolv.conf and seeing this text, you have followed the symlink. # # This is a dynamic resolv.conf file for connecting local clients directly to # all known uplink DNS servers. This file lists all configured search domains. # # Third party programs should typically not access this file directly, but only # through the symlink at /etc/resolv.conf. To manage man:resolv.conf(5) in a # different way, replace this symlink by a static file or a different symlink. # # See man:systemd-resolved.service(8) for details about the supported modes of # operation for /etc/resolv.conf. nameserver 192.168.0.1 nameserver 192.168.0.2 search . ``` ```bash > systemctl status systemd-resolved ● systemd-resolved.service - Network Name Resolution Loaded: loaded (/lib/systemd/system/systemd-resolved.service; enabled; preset: enabled) Active: active (running) since Sat 2025-05-17 03:57:05 UTC; 50min ago ``` ```bash > sudo cat /var/log/netbird/client.log | grep "System DNS manager discovered:" 2025-05-17T04:10:02Z INFO client/internal/dns/host_unix.go:54: System DNS manager discovered: file 2025-05-17T04:12:00Z INFO client/internal/dns/host_unix.go:54: System DNS manager discovered: file ``` After replacing the `/etc/resolv.conf` with `/run/systemd/resolve/stub-resolv.conf`, Netbird detected the DNS namerservers were being managed by systemd-resolved. `.netbird.cloud` and the match domains started to resolve. ``` touch /etc/.pve-ignore.resolv.conf rm /etc/resolv.conf ln -s /run/systemd/resolve/stub-resolv.conf /etc/resolv.conf nano /etc/systemd/resolved.conf ``` ``` > sudo cat /var/log/netbird/client.log | grep "System DNS manager discovered:" 2025-05-17T04:35:20Z INFO client/internal/dns/host_unix.go:54: System DNS manager discovered: systemd ``` We should add some troubleshooting steps in the documentation: https://docs.netbird.io/how-to/manage-dns-in-your-network#creating-a-nameserver-for-specific-domains

saavagebueno commented