I am currently testing NetBird selfhosted and I really like how it works, to I would like to do a proper network topology for my setup and I would need some guidance to achieve what I want.
Current Setup :
For the moment, I run NetBird on a IONOS VPS and I have a Proxmox server at home and it works well. I can expose services from my home network through NetBird just fine. So this part is working fine for me for running tests.
What I would like to do :
The majority of my traffic will be from the local network. For example, I am running a jellyfin server, and right now, since my NetBird is on a VPS, my route goes from my Home VLAN to then VPS then back to the Services VLAN, which doesn’t make much sense since the Home VLAN and the service VLAN are on the same physical firewall.
So what I would like to do is to host Netbird directly on my service VLAN then use the VPS as a tunnel for when I need to access externally, and point a DNS record locally for when I am home. The goal is to eventually expose services to friends and family, and I would also like to be able to access my services when I am not home.
My question :
Is it possible to host NetBird on my Service VLAN, and create a NetBird network to route the external traffic from my VPS to my Service VLAN ? The goal is to simply hide my home IP from the internet.
That way, I can create local overrides on my network for any devices that are located in my network, and when I access NetBird from another network, then it goes through my VPS to access my local services.
I hope that my question and context is clear, and thanks in advance for your help.
Hi! What you’re experiencing is a classic “hairpin routing” problem, and wanting to keep local traffic local while using a VPS.
The short answer is yes, absolutely, but you don’t actually need to move the NetBird management server/dashboard to your home network to achieve this. You can keep NetBird hosted on your VPS and use its native routing features to get exactly what you want.
These features should bring you on the right path, depending on your use case.
I guess I am missing a crucial element understanding how the traffic is routed through the NetBird instance.
Since my NetBird instance is on my VPS, won’t all the traffic from NetBird peer go through the VPS? So let’s say I expose service-1.example.com through the reverse proxy on the NetBird VPS, and both the client and the service are in the same subnet.
If the client type in service-1.example.com will go through the NetBird VPS, then resolve the reverse proxy and expose the service through the NetBird instance.
So unless the service and the client both have a running peer with the proper permission to communicate, then it won’t be possible to resolve the reverse proxy service address through a local connection, right?
So it’s 2 sided, if you are using the reverse proxy feature. Then yes, it has to go through NetBird on the VPS. Meaning it’ll route all the data through it.
However, when you are connecting from Netbird Client to Netbird Client (e.g. Client → Media Server or Client → Network Node), then you connect directly (if your network allows) through WIreGuard/Netbird to the other device. The VPS just becomes the control server.
Alternativly, you could make a control access rule for the network to block the network from taking over. And you could connect directly internally instead.
// This is from me *guessing* your infrastructure, so I'm not a 100% certain this would work in your use case
I wasn’t sure how wireguard was communicating underneath NetBird.
If my understanding is correct, the access controls are simply rewriting the wireguard configurations on the concerned peers. And this was the part missing for me.