Netbird Proxy: Obfuscated or Custom HTTP error pages.

[MD7070B]

Before posting

• I searched existing discussions and issues for similar requests.
• I checked the documentation to confirm this is not already supported.
• This is a product idea or enhancement request, not a support question.
• I removed or anonymized sensitive details from examples and screenshots.

Product area

Dashboard / Admin UI, Other / not sure

Problem or use case

As someone using the NetBird Reverse Proxy to expose some web applications (taking advantage of the awesome auto-TLS-certificates, web UI management, etc), I would like to be able to customise, or use "obfuscated" error pages, when the origin server returns an error.

I have noticed that when an error occurs with the origin server (e.g., the reverse proxy can’t reach the origin server, or the origin server returns some kind of an error code). The client gets presented with a NetBird error page. This is quite nicely styled. However, it seems to be more targeted towards the NetBird administrator, with a link to documentation, rather than a random user who has hit an issue.
Furthermore, in some cases, it’s a bit of an information leak because it reveals that you’re using NetBird in the stack. Therefore, I would really appreciate if there was a functionality to be able to override the default NetBird error page, ideally, on a per service basis in the reverse proxy.

See this thread for more details.

Proposed solution

Section in the Proxy management UI where you can, ideally on a per-service basis, configure the error pages which NB will return if the origin server returns an error.

For example, a "generic HTTP error page" option could be useful, designed to return a basic, black and white (default Apache style) error page on errors, the idea being to hide the fact that a Netbird stack is being used to expose the service.

Or, more advanced, the facility to edit / upload custom error pages per service, so each service could have an on-brand error page.

Alternatives or workarounds considered

Not a lot. I have checked the docs and created a forum post to get help on this issue, so far I have not found a solution, and think that a feature needs to be added.

Community impact and priority

• Number of Users Affected: Only me as a "user", but I could argue that it affects all users who use the services exposed via Netbird Reverse Proxy, which is many more.

• Deployment Type: Self Hosted

• Frequency: As often as the origin server is unreachable or returns an error.

• Blocking production adoption: Mostly yes. I am not comfortable exposing proper production services via Netbird Reverse Proxy if i cannot customise the error pages, to at least "blank" them out, ideally customise them per service.

Examples from other tools or products

No response

Security, privacy, and compatibility considerations

The concern is that as well as causing bad UX, the default error pages leak information - a potential attacker hitting one of my services which happens to be unhealthy at the origin will receive a Netbird branded error page, and they then immediately know that a Netbird stack is hosting this service, and that they are likely to find open Management, STUN/TURN, etc ports on the same IP.

My proposed solution is just the same principle to how NGINX by default returns a header like this: Server: nginx/1.27.0 and how it is commonly removed via a line in config: more_clear_headers 'Server';

Implementation ideas

No response

Are you willing to help?

Yes, I can test or validate a proposed implementation.

Additional context

No response

[MD7070B]

Does anyone support this idea?

Is this something that could be implemented?