Hi there! I’d really appreciate some guidance on where to look and what to debug next. I’ve been working through this for a while and would love some fresh perspectives!
Describe the problem
Peers (tested with Linux and Android clients) can successfully log in, but the connection does not go up. The peers stay “grey” in the UI.
Expected behavior
Peers should connect and be reachable.
Are you using NetBird Cloud?
I am self-hosting, with this architecture:
Cloudflare Tunnel → Caddy → Authentik & NetBird Dashboard, Management, Signal
I am not using the NetBird Relay service, as UDP isn’t supported through Cloudflare Tunnels.
To Reproduce
- Create a Cloudflare Tunnel
- Self-host NetBird services behind Caddy, accessible through the Tunnel
- Try to connect a peer
Here are some parts of my setup. If you need more details, I can provide that too.
Caddyfile:
{
debug
servers :80,:443 {
protocols h1 h2c h2 h3
}
}
(security_headers) {
header * {
Strict-Transport-Security "max-age=3600; includeSubDomains; preload"
X-Content-Type-Options "nosniff"
X-Frame-Options "SAMEORIGIN"
X-XSS-Protection "1; mode=block"
-Server
Referrer-Policy strict-origin-when-cross-origin
}
}
# =============== AUTHENTIK ===============
auth.example.com:443 {
tls internal
import security_headers
reverse_proxy /* authentik-server:9000
}
# =============== NETBIRD ===============
netbird.example.com:443 {
tls internal
import security_headers
# Signal
reverse_proxy /ws-proxy/signal* netbird-signal:80
reverse_proxy /signalexchange.SignalExchange/* h2c://netbird-signal:10000
# Management
reverse_proxy /api/* netbird-management:80
reverse_proxy /ws-proxy/management* netbird-management:80
reverse_proxy /management.ManagementService/* h2c://netbird-management:80
reverse_proxy /oauth2/* netbird-management:80
# Dashboard
reverse_proxy /* netbird-dashboard:80
}
# =============== GRPCTEST ===============
grpctest.example.com:443 {
tls internal
import security_headers
reverse_proxy /* h2c://grpctest:50051 # Just a simple fortio gRPC test server
}
cloudflared/config.yml:
tunnel: [TUNNEL_ID_REDACTED]
credentials-file: /etc/cloudflared/[TUNNEL_ID_REDACTED].json
protocol: http2
ingress:
- hostname: "*.example.com"
service: https://caddy-cloudflared:443
originRequest:
http2Origin: true
noTLSVerify: true
matchSNItoHost: true
- service: http_status:404
NetBird version
$ netbird version
0.64.3
Is any other VPN software installed?
No
Debug output
To ensure gRPC connectivity through the Cloudflare Tunnel and Caddy (you don’t want to know how long this took to get working):
$ wget https://raw.githubusercontent.com/grpc/grpc/master/src/proto/grpc/health/v1/health.proto
$ grpcurl -proto health.proto -d '{}' grpctest.example.com:443 grpc.health.v1.Health/Check
{
"status": "SERVING"
}
$ timeout 60 netbird status -dA
Timeout after 60 seconds
I tried creating a debug bundle, but it did not generate a file or provide me with any kind of key/url for the upload. I can try again if needed.
$ sudo NB_WG_KERNEL_DISABLED=true GRPC_GO_LOG_VERBOSITY_LEVEL=99 GRPC_GO_LOG_SEVERITY_LEVEL=info netbird service run --log-file console --log-level trace
2026-01-31T10:58:26+01:00 INFO client/cmd/service_controller.go:27: starting NetBird service
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: 2026/01/31 10:58:26 INFO: [core] [Server #1] Server created
2026-01-31T10:58:26+01:00 DEBG client/internal/profilemanager/service.go:109: default profile already exists at /var/lib/netbird/default.json, skipping copy
2026-01-31T10:58:26+01:00 INFO client/server/server.go:938: active profile config existed: true, err <nil>
2026-01-31T10:58:26+01:00 INFO client/cmd/service_controller.go:74: started daemon server: /var/run/netbird.sock
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: 2026/01/31 10:58:26 INFO: [core] [Server #1 ListenSocket #2] ListenSocket created
2026-01-31T10:58:26+01:00 TRAC client/server/server.go:1550: running client connection
2026-01-31T10:58:26+01:00 INFO client/internal/connect.go:133: starting NetBird client version 0.64.3 on linux/amd64
2026-01-31T10:58:26+01:00 DEBG client/net/dialer_dial.go:20: Dialing udp 127.0.0.1:9
2026-01-31T10:58:26+01:00 INFO client/net/env_linux.go:70: system supports advanced routing
2026-01-31T10:58:26+01:00 DEBG client/internal/connect.go:216: connecting to the Management service netbird.example.com:443
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: 2026/01/31 10:58:26 INFO: [core] original dial target is: "netbird.example.com:443"
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: 2026/01/31 10:58:26 INFO: [core] [Channel #3] Channel created for target "netbird.example.com:443"
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: 2026/01/31 10:58:26 INFO: [core] [Channel #3] parsed dial target is: resolver.Target{URL:url.URL{Scheme:"passthrough", Opaque:"", User:(*url.Userinfo)(nil), Host:"", Path:"/netbird.example.com:443", RawPath:"", OmitHost:false, ForceQuery:false, RawQuery:"", Fragment:"", RawFragment:""}}
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: 2026/01/31 10:58:26 INFO: [core] [Channel #3] Channel authority set to "netbird.example.com:443"
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: 2026/01/31 10:58:26 INFO: [core] [Channel #3] Resolver state updated: {
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: "Addresses": [
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: {
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: "Addr": "netbird.example.com:443",
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: "ServerName": "",
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: "Attributes": null,
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: "BalancerAttributes": null,
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: "Metadata": null
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: }
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: ],
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: "Endpoints": [
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: {
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: "Addresses": [
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: {
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: "Addr": "netbird.example.com:443",
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: "ServerName": "",
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: "Attributes": null,
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: "BalancerAttributes": null,
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: "Metadata": null
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: }
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: ],
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: "Attributes": null
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: }
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: ],
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: "ServiceConfig": null,
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: "Attributes": null
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: } (resolver returned new addresses)
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: 2026/01/31 10:58:26 INFO: [core] [Channel #3] Channel switches to new LB policy "pick_first"
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: 2026/01/31 10:58:26 INFO: [pick-first-leaf-lb] [pick-first-leaf-lb 0xc0004b4090] Received new config {
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: "shuffleAddressList": false
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: }, resolver state {
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: "Addresses": [
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: {
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: "Addr": "netbird.example.com:443",
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: "ServerName": "",
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: "Attributes": null,
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: "BalancerAttributes": null,
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: "Metadata": null
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: }
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: ],
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: "Endpoints": [
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: {
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: "Addresses": [
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: {
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: "Addr": "netbird.example.com:443",
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: "ServerName": "",
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: "Attributes": null,
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: "BalancerAttributes": null,
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: "Metadata": null
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: }
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: ],
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: "Attributes": null
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: }
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: ],
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: "ServiceConfig": null,
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: "Attributes": null
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: }
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: 2026/01/31 10:58:26 INFO: [core] [Channel #3] Channel Connectivity change to CONNECTING
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: 2026/01/31 10:58:26 INFO: [core] [Channel #3 SubChannel #4] Subchannel created
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: 2026/01/31 10:58:26 INFO: [core] [Channel #3] Channel exiting idle mode
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: 2026/01/31 10:58:26 INFO: [core] [Channel #3 SubChannel #4] Subchannel Connectivity change to CONNECTING
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: 2026/01/31 10:58:26 INFO: [core] [Channel #3 SubChannel #4] Subchannel picks a new address "netbird.example.com:443" to connect
2026-01-31T10:58:26+01:00 DEBG client/net/dialer_dial.go:20: Dialing tcp netbird.example.com:443
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: 2026/01/31 10:58:26 INFO: [core] [Channel #3 SubChannel #4] Subchannel Connectivity change to READY
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: 2026/01/31 10:58:26 INFO: [pick-first-leaf-lb] [pick-first-leaf-lb 0xc0004b4090] SubConn 0xc0006e2190 reported connectivity state READY and the health listener is disabled. Transitioning SubConn to READY.
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: 2026/01/31 10:58:26 INFO: [core] [Channel #3] Channel Connectivity change to READY
2026-01-31T10:58:26+01:00 DEBG client/internal/connect.go:224: connected to the Management service netbird.example.com:443
2026-01-31T10:58:26+01:00 DEBG client/iface/device/kernel_module_linux.go:90: WireGuard kernel module disabled because the NB_WG_KERNEL_DISABLED env is set to true
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: 2026/01/31 10:58:26 INFO: [core] original dial target is: "netbird.example.com:443"
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: 2026/01/31 10:58:26 INFO: [core] [Channel #6] Channel created for target "netbird.example.com:443"
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: 2026/01/31 10:58:26 INFO: [core] [Channel #6] parsed dial target is: resolver.Target{URL:url.URL{Scheme:"passthrough", Opaque:"", User:(*url.Userinfo)(nil), Host:"", Path:"/netbird.example.com:443", RawPath:"", OmitHost:false, ForceQuery:false, RawQuery:"", Fragment:"", RawFragment:""}}
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: 2026/01/31 10:58:26 INFO: [core] [Channel #6] Channel authority set to "netbird.example.com:443"
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: 2026/01/31 10:58:26 INFO: [core] [Channel #6] Resolver state updated: {
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: "Addresses": [
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: {
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: "Addr": "netbird.example.com:443",
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: "ServerName": "",
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: "Attributes": null,
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: "BalancerAttributes": null,
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: "Metadata": null
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: }
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: ],
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: "Endpoints": [
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: {
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: "Addresses": [
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: {
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: "Addr": "netbird.example.com:443",
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: "ServerName": "",
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: "Attributes": null,
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: "BalancerAttributes": null,
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: "Metadata": null
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: }
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: ],
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: "Attributes": null
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: }
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: ],
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: "ServiceConfig": null,
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: "Attributes": null
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: } (resolver returned new addresses)
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: 2026/01/31 10:58:26 INFO: [core] [Channel #6] Channel switches to new LB policy "pick_first"
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: 2026/01/31 10:58:26 INFO: [pick-first-leaf-lb] [pick-first-leaf-lb 0xc0005bbdd0] Received new config {
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: "shuffleAddressList": false
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: }, resolver state {
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: "Addresses": [
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: {
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: "Addr": "netbird.example.com:443",
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: "ServerName": "",
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: "Attributes": null,
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: "BalancerAttributes": null,
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: "Metadata": null
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: }
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: ],
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: "Endpoints": [
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: {
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: "Addresses": [
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: {
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: "Addr": "netbird.example.com:443",
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: "ServerName": "",
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: "Attributes": null,
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: "BalancerAttributes": null,
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: "Metadata": null
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: }
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: ],
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: "Attributes": null
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: }
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: ],
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: "ServiceConfig": null,
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: "Attributes": null
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: }
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: 2026/01/31 10:58:26 INFO: [core] [Channel #6] Channel Connectivity change to CONNECTING
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: 2026/01/31 10:58:26 INFO: [core] [Channel #6 SubChannel #7] Subchannel created
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: 2026/01/31 10:58:26 INFO: [core] [Channel #6] Channel exiting idle mode
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: 2026/01/31 10:58:26 INFO: [core] [Channel #6 SubChannel #7] Subchannel Connectivity change to CONNECTING
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: 2026/01/31 10:58:26 INFO: [core] [Channel #6 SubChannel #7] Subchannel picks a new address "netbird.example.com:443" to connect
2026-01-31T10:58:26+01:00 DEBG client/net/dialer_dial.go:20: Dialing tcp netbird.example.com:443
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: 2026/01/31 10:58:26 INFO: [core] [Channel #6 SubChannel #7] Subchannel Connectivity change to READY
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: 2026/01/31 10:58:26 INFO: [pick-first-leaf-lb] [pick-first-leaf-lb 0xc0005bbdd0] SubConn 0xc000819860 reported connectivity state READY and the health listener is disabled. Transitioning SubConn to READY.
2026-01-31T10:58:26+01:00 INFO ./caller_not_available:0: 2026/01/31 10:58:26 INFO: [core] [Channel #6] Channel Connectivity change to READY
2026-01-31T10:58:26+01:00 DEBG shared/signal/client/grpc.go:74: connected to Signal Service: netbird.example.com:443
2026-01-31T10:58:26+01:00 INFO client/internal/engine.go:273: I am: [PEER_ID_REDACTED]
2026-01-31T10:58:26+01:00 DEBG client/internal/engine.go:1983: Sync response persistence is set to true
2026-01-31T10:58:26+01:00 DEBG client/iface/device/kernel_module_linux.go:90: WireGuard kernel module disabled because the NB_WG_KERNEL_DISABLED env is set to true
2026-01-31T10:58:26+01:00 INFO client/iface/device/device_usp_unix.go:34: using userspace bind mode
2026-01-31T10:58:26+01:00 INFO client/iface/wgproxy/factory_usp.go:15: WireGuard Proxy Factory will produce bind proxy
2026-01-31T10:58:26+01:00 INFO client/internal/dns/mgmt/mgmt.go:169: looking up IP for mgmt domain=netbird.example.com
2026-01-31T10:58:26+01:00 INFO client/internal/dns/mgmt/mgmt.go:195: done looking up IP for mgmt domain=netbird.example.com
2026-01-31T10:58:26+01:00 DEBG client/internal/dns/mgmt/mgmt.go:162: added domain=netbird.example.com with 2 A records and 2 AAAA records
2026-01-31T10:58:26+01:00 INFO client/internal/dns/mgmt/mgmt.go:169: looking up IP for mgmt domain=netbird.example.com
2026-01-31T10:58:26+01:00 INFO client/internal/dns/mgmt/mgmt.go:195: done looking up IP for mgmt domain=netbird.example.com
2026-01-31T10:58:26+01:00 DEBG client/internal/dns/mgmt/mgmt.go:162: added domain=netbird.example.com with 2 A records and 2 AAAA records
2026-01-31T10:58:26+01:00 DEBG client/internal/dns/mgmt/mgmt.go:361: added/updated management cache domain=netbird.example.com
2026-01-31T10:58:26+01:00 INFO client/internal/dns/mgmt/mgmt.go:169: looking up IP for mgmt domain=stun.l.google.com
2026-01-31T10:58:26+01:00 INFO client/internal/dns/mgmt/mgmt.go:195: done looking up IP for mgmt domain=stun.l.google.com
2026-01-31T10:58:26+01:00 DEBG client/internal/dns/mgmt/mgmt.go:162: added domain=stun.l.google.com with 1 A records and 1 AAAA records
2026-01-31T10:58:26+01:00 DEBG client/internal/dns/mgmt/mgmt.go:361: added/updated management cache domain=stun.l.google.com
2026-01-31T10:58:26+01:00 DEBG client/internal/dns/server.go:237: registering handler MgmtCacheResolver with priority 150 for [netbird.example.com stun.l.google.com]
2026-01-31T10:58:26+01:00 DEBG client/internal/dns/handler_chain.go:111: adding handler pattern: domain=netbird.example.com. original: domain=netbird.example.com. wildcard=false match_subdomain=false priority=150
2026-01-31T10:58:26+01:00 TRAC client/internal/dns/handler_chain.go:188: handler chain (1):
- pattern: domain=netbird.example.com. original: domain=netbird.example.com. wildcard=false match_subdomain=false priority=150
2026-01-31T10:58:26+01:00 DEBG client/internal/dns/handler_chain.go:111: adding handler pattern: domain=stun.l.google.com. original: domain=stun.l.google.com. wildcard=false match_subdomain=false priority=150
2026-01-31T10:58:26+01:00 TRAC client/internal/dns/handler_chain.go:188: handler chain (2):
- pattern: domain=netbird.example.com. original: domain=netbird.example.com. wildcard=false match_subdomain=false priority=150
- pattern: domain=stun.l.google.com. original: domain=stun.l.google.com. wildcard=false match_subdomain=false priority=150
2026-01-31T10:58:26+01:00 INFO client/internal/routemanager/manager.go:236: Routing setup complete
2026-01-31T10:58:26+01:00 INFO client/iface/device/device_usp_unix.go:47: create tun interface
2026-01-31T10:58:26+01:00 DEBG client/iface/device/wg_link_linux.go:115: adding address 100.68.235.71/16 to interface: wt0
2026-01-31T10:58:26+01:00 DEBG client/iface/configurer/usp.go:58: adding Wireguard private key
2026-01-31T10:58:26+01:00 INFO client/firewall/create_linux.go:73: creating an nftables firewall manager
2026-01-31T10:58:26+01:00 DEBG client/firewall/nftables/router_linux.go:1029: added iptables forward rule: [-i wt0 -j ACCEPT]
2026-01-31T10:58:26+01:00 DEBG client/firewall/nftables/router_linux.go:1029: added iptables forward rule: [-o wt0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT]
2026-01-31T10:58:26+01:00 DEBG client/firewall/nftables/router_linux.go:1037: added iptables input rule: [-i wt0 -j ACCEPT]
2026-01-31T10:58:26+01:00 DEBG client/firewall/nftables/router_linux.go:1006: Used iptables to add accept forward and input rules
2026-01-31T10:58:26+01:00 DEBG client/firewall/uspfilter/log/log.go:85: New uspfilter logger created with loglevel TRAC
2026-01-31T10:58:26+01:00 DEBG client/internal/statemanager/manager.go:286: persisted states: [nftables_state], took 80.424µs
2026-01-31T10:58:26+01:00 DEBG client/firewall/uspfilter/localip.go:156: Local IPv4 addresses: [100.68.235.71 127.0.0.1 192.168.178.20 172.17.0.1 172.18.0.1 172.19.0.1 172.20.0.1 172.21.0.1]
2026-01-31T10:58:26+01:00 DEBG client/iface/device/device_usp_unix.go:94: device is ready to use: wt0
2026-01-31T10:58:26+01:00 DEBG client/internal/dns/network_manager_unix.go:332: network manager constraints [>= 1.16, < 1.27 | >= 1.44, < 1.45] met: false
2026-01-31T10:58:26+01:00 INFO client/internal/dns/host_unix.go:54: System DNS manager discovered: file
2026-01-31T10:58:26+01:00 INFO client/internal/conn_mgr.go:62: lazy connection manager is disabled
2026-01-31T10:58:26+01:00 DEBG client/internal/peer/guard/ice_monitor.go:35: prepare ICE monitor with period: 5m0s
2026-01-31T10:58:26+01:00 DEBG shared/signal/client/grpc.go:138: signal connection state READY
2026-01-31T10:58:26+01:00 DEBG client/internal/peer/guard/ice_monitor.go:79: Gathering ICE candidates
2026-01-31T10:58:26+01:00 TRAC client/internal/peer/guard/ice_monitor.go:93: Got candidate: udp4 host 192.168.178.20:51820 (resolved: 192.168.178.20:51820) candidate:X4TGxq8QAi2JdfjPMX7cL/N3YHY5k58g
2026-01-31T10:58:26+01:00 TRAC client/internal/peer/guard/ice_monitor.go:93: Got candidate: udp6 host [fd04:22b9:d10e:0:2ed0:1da1:c78:f0b]:51820 (resolved: [fd04:22b9:d10e:0:2ed0:1da1:c78:f0b]:51820) candidate:9A8nns4IPEWKwm/OR3Vu2r46KFSJMGO5
2026-01-31T10:58:26+01:00 TRAC client/internal/peer/guard/ice_monitor.go:93: Got candidate: udp6 host [2003:e9:af08:4900:70b8:9375:c72a:f02d]:51820 (resolved: [2003:e9:af08:4900:70b8:9375:c72a:f02d]:51820) candidate:uWfnAuR4iPNsaYPo6DQcraEKvWzjLnAN
2026-01-31T10:58:26+01:00 TRAC client/internal/peer/guard/ice_monitor.go:93: Got candidate: <nil>
2026-01-31T10:58:26+01:00 TRAC client/internal/peer/guard/ice_monitor.go:119: Got candidates: [udp4 host 192.168.178.20:51820 (resolved: 192.168.178.20:51820) candidate:X4TGxq8QAi2JdfjPMX7cL/N3YHY5k58g udp6 host [fd04:22b9:d10e:0:2ed0:1da1:c78:f0b]:51820 (resolved: [fd04:22b9:d10e:0:2ed0:1da1:c78:f0b]:51820) candidate:9A8nns4IPEWKwm/OR3Vu2r46KFSJMGO5 udp6 host [2003:e9:af08:4900:70b8:9375:c72a:f02d]:51820 (resolved: [2003:e9:af08:4900:70b8:9375:c72a:f02d]:51820) candidate:uWfnAuR4iPNsaYPo6DQcraEKvWzjLnAN]
2026-01-31T10:58:26+01:00 TRAC New egress UDP connection: 100.68.235.71:5353 → 224.0.0.251:5353
2026-01-31T10:59:11+01:00 TRAC Removed UDP connection 100.68.235.71:5353 → 224.0.0.251:5353 (timeout) [in: 0 Pkts/0 B, out: 5 Pkts/463 B]
2026-01-31T11:00:31+01:00 WARN shared/signal/client/grpc.go:153: disconnected from the Signal Exchange due to an error: didn't receive a registration header from the Signal server whille connecting to the streams
2026-01-31T11:00:32+01:00 DEBG shared/signal/client/grpc.go:138: signal connection state READY
2026-01-31T11:02:37+01:00 WARN shared/signal/client/grpc.go:153: disconnected from the Signal Exchange due to an error: didn't receive a registration header from the Signal server whille connecting to the streams
2026-01-31T11:02:37+01:00 DEBG shared/signal/client/grpc.go:138: signal connection state READY
2026-01-31T11:02:47+01:00 INFO ./caller_not_available:0: 2026/01/31 11:02:47 INFO: [transport] [client-transport 0xc0004da248] Closing: connection error: desc = "error reading from server: read tcp [2003:e9:af08:4900:70b8:9375:c72a:f02d]:42386->[2606:4700:3034::6815:30f7]:443: read: connection timed out"
2026-01-31T11:02:47+01:00 INFO ./caller_not_available:0: 2026/01/31 11:02:47 INFO: [core] [Channel #3 SubChannel #4] Subchannel Connectivity change to IDLE
2026-01-31T11:02:47+01:00 INFO ./caller_not_available:0: 2026/01/31 11:02:47 INFO: [transport] [client-transport 0xc0004da248] loopyWriter exiting with error: connection error: desc = "error reading from server: read tcp [2003:e9:af08:4900:70b8:9375:c72a:f02d]:42386->[2606:4700:3034::6815:30f7]:443: read: connection timed out"
2026-01-31T11:02:47+01:00 INFO ./caller_not_available:0: 2026/01/31 11:02:47 INFO: [core] [Channel #3] Channel Connectivity change to IDLE
2026-01-31T11:03:26+01:00 DEBG client/internal/peer/guard/ice_monitor.go:79: Gathering ICE candidates
2026-01-31T11:03:26+01:00 TRAC client/internal/peer/guard/ice_monitor.go:93: Got candidate: udp4 host 192.168.178.20:51820 (resolved: 192.168.178.20:51820) candidate:h3NKu69Fg8UaX+iXkHjsNM8x8nDwRelZ
2026-01-31T11:03:26+01:00 TRAC client/internal/peer/guard/ice_monitor.go:93: Got candidate: udp6 host [fd04:22b9:d10e:0:2ed0:1da1:c78:f0b]:51820 (resolved: [fd04:22b9:d10e:0:2ed0:1da1:c78:f0b]:51820) candidate:nisULaFCG1bY8Cs2wkKj+lVG30m6FYgL
2026-01-31T11:03:26+01:00 TRAC client/internal/peer/guard/ice_monitor.go:93: Got candidate: udp6 host [2003:e9:af08:4900:70b8:9375:c72a:f02d]:51820 (resolved: [2003:e9:af08:4900:70b8:9375:c72a:f02d]:51820) candidate:Dqfkhxn8WrqTLLLb+jaW/7dCXDa1C+4F
2026-01-31T11:03:26+01:00 TRAC client/internal/peer/guard/ice_monitor.go:93: Got candidate: <nil>
2026-01-31T11:03:26+01:00 TRAC client/internal/peer/guard/ice_monitor.go:119: Got candidates: [udp6 host [fd04:22b9:d10e:0:2ed0:1da1:c78:f0b]:51820 (resolved: [fd04:22b9:d10e:0:2ed0:1da1:c78:f0b]:51820) candidate:nisULaFCG1bY8Cs2wkKj+lVG30m6FYgL udp6 host [2003:e9:af08:4900:70b8:9375:c72a:f02d]:51820 (resolved: [2003:e9:af08:4900:70b8:9375:c72a:f02d]:51820) candidate:Dqfkhxn8WrqTLLLb+jaW/7dCXDa1C+4F udp4 host 192.168.178.20:51820 (resolved: 192.168.178.20:51820) candidate:h3NKu69Fg8UaX+iXkHjsNM8x8nDwRelZ]
^C [KeyboardInterrupt]
These two log lines appear repeatedly every couple of minutes in the log:
2026-01-31T11:02:37+01:00 WARN shared/signal/client/grpc.go:153: disconnected from the Signal Exchange due to an error: didn't receive a registration header from the Signal server whille connecting to the streams
2026-01-31T11:02:37+01:00 DEBG shared/signal/client/grpc.go:138: signal connection state READY
Have you tried these troubleshooting steps?
- Reviewed client troubleshooting (if applicable)
- Checked for newer NetBird versions
- Searched for similar issues on GitHub (including closed ones)
- Restarted the NetBird client
- Disabled other VPN software
- Checked firewall settings