Additional Access Control for Specific Reverse Proxy Paths

Feature Requests
1

Is your feature request related to a problem? Please describe.

Currently, NetBird’s reverse proxy allows me to publish a service and apply access restrictions (for example, based on allowed countries), which works very well.

However, I cannot apply additional authentication to specific paths of an application. As an example, with Vaultwarden I would like the main application to be accessible using the configured access rules, while protecting the /admin endpoint with an additional authentication layer.

Describe the solution you’d like

I would like to have path-based access control for the reverse proxy, allowing different authentication or protection methods for specific URL paths.

For example:

  • https://my-vaultwarden-domain/ → accessible using the configured NetBird access rules.

  • https://my-vaultwarden-domain/admin → protected with an additional password prompt (or another authentication method).

This would add an extra layer of security for sensitive endpoints without affecting the usability of the main application.

Describe alternatives you’ve considered

Pangolin already provides a similar capability, allowing additional protection for specific paths. Having comparable functionality in NetBird would make it much easier to secure administrative interfaces while keeping the main application easily accessible.

Additional context

I believe this feature would benefit many self-hosted applications that expose administrative interfaces under dedicated paths (for example, Vaultwarden and similar services).

2

I’ve been testing Netbird for a while now, and this is the one missing feature preventing me from deploying it in production. There should be per-path authentication flexibility: some paths might require additional authentication, some might require NO authentication.

Please guys, consider it! Thanks!