NetBird - FOSS noconf Mesh VPN using Wireguard, alternative to ZeroTier, Tailscale, OmniEdge, Netmaker etc
-
Sounds great. Is the Reverse Proxy working „out of the box“ this way? (By adding custom Domains)
@sponch if I understand question, yes, just install as e.g. netbird.domain.tld and client connects as ‘netbird up -m https://netbird.domain.tld:33073 -k <setup key from app ui>
-
Ah. No, thinking about the Reverse Proxy. (Custom public domains pointing to a Netbird device). The proxy is a non default opition during installation and can be also installed afterwards manually. You can find it in Dashboard under Reverse Proxy -> Custer
If not instaded -
Ah. No, thinking about the Reverse Proxy. (Custom public domains pointing to a Netbird device). The proxy is a non default opition during installation and can be also installed afterwards manually. You can find it in Dashboard under Reverse Proxy -> Custer
If not instaded@sponch ah, sorry, misunderstood, my mistake.
I've only used Netbird previously as a peer registration solution.I see the Reverse Proxy in the left sidebar of the management app.
But I don't think it is enabled or working despite saying 'Create Service'.NetBird Reverse Proxy feature This is a separate NetBird feature for exposing services behind peers to the public internet through NetBird, with auth/TLS rules. NetBird documents it as requiring: - a NetBird reverse-proxy component/cluster - Traefik with TLS passthrough in front of it NetBird says self-hosted deployments must use Traefik for this feature because TLS passthrough is required [source: NetBird Reverse Proxy docs].I will have to look into whether this is possible. It might not be on Cloudron, so if it is important for your use case, a more traditional VPS docker plus Traefik might be needed.
Indie app dev, huge fan of Cloudron PaaS, scratching my itches : communityapps.appx.uk
-
@sponch ah, sorry, misunderstood, my mistake.
I've only used Netbird previously as a peer registration solution.I see the Reverse Proxy in the left sidebar of the management app.
But I don't think it is enabled or working despite saying 'Create Service'.NetBird Reverse Proxy feature This is a separate NetBird feature for exposing services behind peers to the public internet through NetBird, with auth/TLS rules. NetBird documents it as requiring: - a NetBird reverse-proxy component/cluster - Traefik with TLS passthrough in front of it NetBird says self-hosted deployments must use Traefik for this feature because TLS passthrough is required [source: NetBird Reverse Proxy docs].I will have to look into whether this is possible. It might not be on Cloudron, so if it is important for your use case, a more traditional VPS docker plus Traefik might be needed.
hi @timconsidine, thanks. I've already got that extra VPS with proxy running - just could save some bugs a month if could replace it with a cloudron version of netbird
-
"Cloudron does not currently expose the kind of per-app TLS passthrough on 443 that NetBird Reverse Proxy needs."
It's a cool feature, though, so I'm going to have a think about a workaround.
EDIT #1 : The only Netbird-like alternative supporting this Reverse Proxy functionality is Tunnet, according to my research. But it is much younger than Netbird.
EDIT #2 : Because Cloudron platform (not base image) owns 443, unless/until there is more traffic pass-through from the platform nginx, I don't think Netbird Reverse Proxy is deliverable on Cloudron. Don't hold your breathe !
Indie app dev, huge fan of Cloudron PaaS, scratching my itches : communityapps.appx.uk
-
"Cloudron does not currently expose the kind of per-app TLS passthrough on 443 that NetBird Reverse Proxy needs."
It's a cool feature, though, so I'm going to have a think about a workaround.
EDIT #1 : The only Netbird-like alternative supporting this Reverse Proxy functionality is Tunnet, according to my research. But it is much younger than Netbird.
EDIT #2 : Because Cloudron platform (not base image) owns 443, unless/until there is more traffic pass-through from the platform nginx, I don't think Netbird Reverse Proxy is deliverable on Cloudron. Don't hold your breathe !
@timconsidine maybe something the team can address for v10+.
-
@timconsidine maybe something the team can address for v10+.
-
AI's reply. Not tested, but seems good:
@timconsidine @sponch thanks for investigating and documenting the transport issue.
I’ve now published v2.0.16, which adopts the dedicated native-client transport model:
- Dashboard, API and OIDC remain on normal Cloudron HTTPS/443.
- NetBird management, signal and relay traffic use a dedicated TLS/HTTP2 TCP port.
- The default external port is 33073, but use whichever TCP port is configured in Cloudron.
Client example:
sudo netbird up
--management-url https://netbird.example.com:33073
--setup-key YOUR_SETUP_KEYThe selected TCP port must be reachable through the server firewall. NetBird’s own configurable UDP STUN port is also retained. I did not use Cloudron’s TURN addon because its relay credential model is incompatible with NetBird’s built-in relay.
Internally, the native listener maps to container port 33074, because current NetBird releases reserve 33073 for their legacy gRPC listener.
Reverse Proxy clusters are still not included. That feature requires raw TLS passthrough on public port 443, which Cloudron does not currently provide per app. The dedicated client port fixes peer registration but does not remove that separate platform constraint.
Release: https://github.com/marcusquinn/cloudron-netbird-app/releases/tag/v2.0.16
Community app: https://ca.cloudron.io/app/netbirdLocal runtime tests passed first-run setup, TLS validation, HTTP/2 negotiation, restart and persistence checks. I still need confirmation from a real Cloudron installation, so please let me know whether a native client now registers successfully.
Web Design & Development: https://www.evergreen.je
Technology & Apps: https://www.marcusquinn.com -
AI's reply. Not tested, but seems good:
@timconsidine @sponch thanks for investigating and documenting the transport issue.
I’ve now published v2.0.16, which adopts the dedicated native-client transport model:
- Dashboard, API and OIDC remain on normal Cloudron HTTPS/443.
- NetBird management, signal and relay traffic use a dedicated TLS/HTTP2 TCP port.
- The default external port is 33073, but use whichever TCP port is configured in Cloudron.
Client example:
sudo netbird up
--management-url https://netbird.example.com:33073
--setup-key YOUR_SETUP_KEYThe selected TCP port must be reachable through the server firewall. NetBird’s own configurable UDP STUN port is also retained. I did not use Cloudron’s TURN addon because its relay credential model is incompatible with NetBird’s built-in relay.
Internally, the native listener maps to container port 33074, because current NetBird releases reserve 33073 for their legacy gRPC listener.
Reverse Proxy clusters are still not included. That feature requires raw TLS passthrough on public port 443, which Cloudron does not currently provide per app. The dedicated client port fixes peer registration but does not remove that separate platform constraint.
Release: https://github.com/marcusquinn/cloudron-netbird-app/releases/tag/v2.0.16
Community app: https://ca.cloudron.io/app/netbirdLocal runtime tests passed first-run setup, TLS validation, HTTP/2 negotiation, restart and persistence checks. I still need confirmation from a real Cloudron installation, so please let me know whether a native client now registers successfully.
@marcusquinn thank you !
Will test tomorrow.
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login