Peer connection details show Docker gateway IP 172.30.0.1 as public IP when peer connects via IPv6

Community Support Self-Hosted
1

Hi everyone,

I’m running a self-hosted NetBird Management Server and recently made it reachable via both IPv4 and IPv6.

Since then, I noticed that in the connection details of a connected peer, the displayed Public IP is not the actual public IPv4 or IPv6 address of the peer. Instead, it shows: 172.30.0.1

This looks like the Docker network gateway address rather than the real public IP of the client.

An important detail: this only happens when the peer connects to the NetBird Management Server via IPv6.

When i delete the AAAA Record for the management server the peer connects via IPv4, the public IP appears to be shown correctly.

2

Where is it showing the public IP, in the interface of the machine or the netbird dashboard?

3

In the NetBird dashboard, the peer’s public IP is shown as 172.30.0.1, which appears to be the Docker bridge/gateway IP rather than the real public IP of the connecting peer.

This seems to be more than just a UI/display issue. It also affects access rule configuration, because connections coming from outside are reported as originating from 172.30.0.1 instead of the peer’s actual public IP address.

This makes IP-based access rules and auditing difficult or unreliable in a self-hosted Docker/reverse-proxy setup, especially when peers connect via IPv6.

4

See if you can add:

NB_PROXY_PROXY_PROTOCOL=true
NB_PROXY_TRUSTED_PROXIES=172.30.0.10

to your proxy.env

5

I think the entry was already there after the installation.

6

I am seeing the same issue on my end - i am unable to use geoblock on my Authentik which is proxied through netbird as when that IP pops up it blocks it and breaks the auth flow…

7

I’m glad I’m not the only one having this problem. Have you tried making the management server accessible only via IPv4? I just deleted the AAAA record, and then it worked.

8

The Quickstart only documents an A record and does not show an AAAA/dual-stack setup. Since the issue only appears when IPv6 is enabled, I’m wondering whether dual-stack is currently supported/tested for the self-hosted Reverse Proxy setup, or whether additional configuration is required.

9

Same issue here. I just deployed a new self-hosted instance for the first time on a dedicated VPS with public IPv4 and IPv6, created both A and AAAA records, and all peers show their public IP as 172.30.0.1 in the dashboard. Deleted the AAAA record, rebooted the server and reconnected all peers, they now report their correct IPv4 public addresses.

10

Thanks for confirming. This matches my findings as well.

With both A and AAAA records enabled for the self-hosted management domain, peers connecting via IPv6 are shown with the Docker gateway IP (172.30.0.1 / 172.30.0.x) as their public IP. After removing the AAAA record and forcing peers back to IPv4, the correct public IPv4 addresses are shown again.

It would be very helpful if someone from the NetBird team could look into this. The issue affects more than just the displayed peer details, because features such as Reverse Proxy Access Control and GeoIP-based rules depend on the detected public IP. It would also be useful to clarify whether dual-stack self-hosted setups are officially supported and what the recommended proxy/header configuration is.