PMTU blackhole between macOS client and self-hosted NetBird-Only reverse-proxy peer causes stalls #6923

kurthw · 2026-07-27T17:45:17Z

kurthw
Jul 27, 2026

Before posting

I searched existing discussions and issues, including closed ones, and checked the relevant docs.
I believe this is a product bug rather than a configuration or setup question.
I can reproduce this issue, or for intermittent issues I've included trigger, frequency, and timing details below.
I removed or anonymized sensitive data from logs, screenshots, and configuration.

Affected area

Connectivity / Peer-to-peer (P2P) / MTU

Deployment type

Self-hosted - advanced/custom deployment

Operating system or environment

macOS

NetBird version and upgrade status

Client: not precisely tracked, workaround (--mtu 1150) was already in place in the 0.74.x range; the underlying MTU issue may predate that version
Management: 0.75.0 (self-hosted)
Signal: 0.75.0 (self-hosted)
Relay: 0.75.0 (self-hosted)

Did this work before?

Not sure

Regression details

N/A

Summary

When accessing a service behind a NetBird-Only access policy from a macOS client, larger payloads intermittently stall or fail while small requests succeed. Root cause traced to a PMTU blackhole on the path to the controlplane/reverse-proxy peer: packets exceeding the effective path MTU are silently dropped rather than triggering an ICMP "Fragmentation Needed" response, so the client's WireGuard interface never learns to reduce its packet size.

Current behavior

HTTPS requests to services behind the NetBird-Only policy intermittently stall or time out once payload size exceeds the effective path MTU. Small requests (e.g. simple API calls) succeed normally. No error is surfaced to the user beyond the stall/timeout itself.

Expected behavior

The client should perform automatic PMTU discovery/adjustment for the WireGuard interface, or at minimum surface a diagnostic/warning when a PMTU blackhole is detected, so users don't have to manually discover and set a lower MTU via netbird up --mtu <value>.

Steps to reproduce

Set up a NetBird-Only access policy on a reverse-proxy service (self-hosted management/signal/relay)
Connect from a macOS (Apple Silicon) client over a standard 1500-byte MTU path
Access the HTTPS service behind the NetBird-Only policy; requests with larger payloads (e.g. full page loads) intermittently stall or fail, while small requests succeed
Manually lower the WireGuard interface MTU (netbird up --mtu 1150) — issue disappears completely

Environment and topology

Peer A: macOS client (Apple Silicon M1), residential ISP connection (Swisscom), NAT + IPv6
Peer B: self-hosted reverse-proxy peer (Hetzner Cloud)
Same LAN or different networks: different networks, connected via NetBird P2P (ICE host/srflx)
NAT/CGNAT/corporate firewall/mobile network: residential NAT on client side

Self-hosted details, if available

Deployment method: Docker Compose
Management/signal/relay versions: 0.75.0
Reverse proxy: netbirdio/reverse-proxy image
IdP/provider: PocketID

Logs, status output, or debug evidence

netbird status -dA
Peers detail:
 pool.anon-JT6AM.domain:
  NetBird IP: 10.64.6.214
  NetBird IPv6: 2001:db8:ffff::
  Public key: XhKK7ckEEFMfB3XJ/7ctUptvG/nf/gMuhWQNAmH33iA=
  Status: Connecting
  -- detail --
  Connection type: -
  ICE candidate (Local/Remote): -/-
  ICE candidate endpoints (Local/Remote): -/-
  Relay server address:
  Last connection update: 29 seconds ago
  Last WireGuard handshake: -
  Transfer status (received/sent) 0 B/0 B
  Quantum resistance: false
  Networks: -
  Latency: 0s

 server.anon-JT6AM.domain:
  NetBird IP: 10.64.24.157
  NetBird IPv6: 2001:db8:ffff::1
  Public key: iu9gOLUpdeIl7CGbZAHP9O+6SMR9C6Mn/XO+svJ2yE8=
  Status: Connected
  -- detail --
  Connection type: P2P
  ICE candidate (Local/Remote): host/host
  ICE candidate endpoints (Local/Remote): 192.168.0.38:51820/192.168.0.34:51820
  Relay server address: rels://nb.anon-nqfyg.domain:443
  Last connection update: 29 seconds ago
  Last WireGuard handshake: 29 seconds ago
  Transfer status (received/sent) 5.5 KiB/7.0 KiB
  Quantum resistance: false
  Networks: -
  Latency: 154.878292ms

 proxy-d9d54kbu9otc73dshlc0-40-111.anon-JT6AM.domain:
  NetBird IP: 10.64.40.111
  NetBird IPv6: 2001:db8:ffff::2
  Public key: d76ABJnJ1VIHLhnPoRI2RhzPqMc2FDEB8ciK2KwKcG4=
  Status: Connecting
  -- detail --
  Connection type: -
  ICE candidate (Local/Remote): -/-
  ICE candidate endpoints (Local/Remote): -/-
  Relay server address:
  Last connection update: 29 seconds ago
  Last WireGuard handshake: -
  Transfer status (received/sent) 0 B/0 B
  Quantum resistance: false
  Networks: -
  Latency: 0s

 iphone.anon-JT6AM.domain:
  NetBird IP: 10.64.52.54
  NetBird IPv6: 2001:db8:ffff::3
  Public key: wpRezbrbRqN7z3edl3vddW29oIEFCCsjcS3xmrXeHQ4=
  Status: Connecting
  -- detail --
  Connection type: -
  ICE candidate (Local/Remote): -/-
  ICE candidate endpoints (Local/Remote): -/-
  Relay server address:
  Last connection update: 29 seconds ago
  Last WireGuard handshake: -
  Transfer status (received/sent) 0 B/0 B
  Quantum resistance: false
  Networks: -
  Latency: 0s

 home.anon-JT6AM.domain:
  NetBird IP: 10.64.55.186
  NetBird IPv6: 2001:db8:ffff::4
  Public key: q99PcEcsAm97kInOtAKbUb6Dl3PaG4VcW9K+nSd3EAA=
  Status: Connected
  -- detail --
  Connection type: P2P
  ICE candidate (Local/Remote): host/host
  ICE candidate endpoints (Local/Remote): 192.168.0.38:51820/192.168.0.33:51820
  Relay server address: rels://nb.anon-nqfyg.domain:443
  Last connection update: 29 seconds ago
  Last WireGuard handshake: 29 seconds ago
  Transfer status (received/sent) 180 B/156 B
  Quantum resistance: false
  Networks: -
  Latency: 157.421417ms

 ubuntu.anon-JT6AM.domain:
  NetBird IP: 10.64.59.120
  NetBird IPv6: 2001:db8:ffff::5
  Public key: JUhT0nwWn/yYP+L13mmhSrmaGLoy61xewx+1CvA9vD0=
  Status: Connecting
  -- detail --
  Connection type: -
  ICE candidate (Local/Remote): -/-
  ICE candidate endpoints (Local/Remote): -/-
  Relay server address:
  Last connection update: 29 seconds ago
  Last WireGuard handshake: -
  Transfer status (received/sent) 0 B/0 B
  Quantum resistance: false
  Networks: -
  Latency: 0s

 proxy-d9bfgfru9otc7380j5u0-72-121.anon-JT6AM.domain:
  NetBird IP: 10.64.72.121
  NetBird IPv6: 2001:db8:ffff::6
  Public key: pZceI+5Bvff0ZRJDbLM6Yp6tyvVjlqF8TexdUMEfCT8=
  Status: Connecting
  -- detail --
  Connection type: -
  ICE candidate (Local/Remote): -/-
  ICE candidate endpoints (Local/Remote): -/-
  Relay server address:
  Last connection update: 29 seconds ago
  Last WireGuard handshake: -
  Transfer status (received/sent) 0 B/0 B
  Quantum resistance: false
  Networks: -
  Latency: 0s

 pi5.anon-JT6AM.domain:
  NetBird IP: 10.64.100.202
  NetBird IPv6: 2001:db8:ffff::7
  Public key: 1oAvnmyKVSJ+h9agv4rvgj4kPr/j4nwyU/1cRU+IVWs=
  Status: Connecting
  -- detail --
  Connection type: -
  ICE candidate (Local/Remote): -/-
  ICE candidate endpoints (Local/Remote): -/-
  Relay server address:
  Last connection update: 29 seconds ago
  Last WireGuard handshake: -
  Transfer status (received/sent) 0 B/0 B
  Quantum resistance: false
  Networks: -
  Latency: 0s

 rss.anon-JT6AM.domain:
  NetBird IP: 10.64.124.190
  NetBird IPv6: 2001:db8:ffff::8
  Public key: Cr28Bm+RsO/RZUs6+8mQGnE2YZd6ldLMSS5nRrxuH0A=
  Status: Connecting
  -- detail --
  Connection type: -
  ICE candidate (Local/Remote): -/-
  ICE candidate endpoints (Local/Remote): -/-
  Relay server address:
  Last connection update: 29 seconds ago
  Last WireGuard handshake: -
  Transfer status (received/sent) 0 B/0 B
  Quantum resistance: false
  Networks: -
  Latency: 0s

 proxy-d9hpsg3u9otc738b6ivg-138-197.anon-JT6AM.domain:
  NetBird IP: 10.64.138.197
  NetBird IPv6: 2001:db8:ffff::9
  Public key: liSUZxmMLsjwptj6elPCPacIPR8Us+rWCkg8D02pGXM=
  Status: Connected
  -- detail --
  Connection type: P2P
  ICE candidate (Local/Remote): host/prflx
  ICE candidate endpoints (Local/Remote): 192.168.0.38:51820/192.168.0.47:39037
  Relay server address: rels://nb.anon-nqfyg.domain:443
  Last connection update: 29 seconds ago
  Last WireGuard handshake: 30 seconds ago
  Transfer status (received/sent) 180 B/156 B
  Quantum resistance: false
  Networks: -
  Latency: 134.930917ms

 homelab.anon-JT6AM.domain:
  NetBird IP: 10.64.158.251
  NetBird IPv6: 2001:db8:ffff::c
  Public key: AVqTAwti+C6zGweQ0pJIjEEE/M9mBHTPffjJVHY0lFc=
  Status: Connected
  -- detail --
  Connection type: P2P
  ICE candidate (Local/Remote): host/prflx
  ICE candidate endpoints (Local/Remote): 2001:db8:ffff::a:51820/2001:db8:ffff::b:51820
  Relay server address: rels://nb.anon-nqfyg.domain:443
  Last connection update: 28 seconds ago
  Last WireGuard handshake: 30 seconds ago
  Transfer status (received/sent) 156 B/212 B
  Quantum resistance: false
  Networks: -
  Latency: 7.122417ms

 controlplane.anon-JT6AM.domain:
  NetBird IP: 10.64.210.67
  NetBird IPv6: 2001:db8:ffff::f
  Public key: j/YX6jghP8ppYNfBDJK+nDFpe+cQ2c1ercIpBdTxWyo=
  Status: Connected
  -- detail --
  Connection type: P2P
  ICE candidate (Local/Remote): host/srflx
  ICE candidate endpoints (Local/Remote): 2001:db8:ffff::d:51820/2001:db8:ffff::e:51820
  Relay server address: rels://nb.anon-nqfyg.domain:443
  Last connection update: 29 seconds ago
  Last WireGuard handshake: 30 seconds ago
  Transfer status (received/sent) 212 B/156 B
  Quantum resistance: false
  Networks: 172.28.20.0/24
  Latency: 183.670792ms

 ipad.anon-JT6AM.domain:
  NetBird IP: 10.64.218.219
  NetBird IPv6: 2001:db8:ffff::10
  Public key: ZPzyDDA0z/jSbA7ifA5sPLdeNMxFXqjUSqGUsCUiBS4=
  Status: Connecting
  -- detail --
  Connection type: -
  ICE candidate (Local/Remote): -/-
  ICE candidate endpoints (Local/Remote): -/-
  Relay server address:
  Last connection update: 29 seconds ago
  Last WireGuard handshake: -
  Transfer status (received/sent) 0 B/0 B
  Quantum resistance: false
  Networks: -
  Latency: 0s

 proxy-d9hgb5ru9otc73eie1ig-224-195.anon-JT6AM.domain:
  NetBird IP: 10.64.224.195
  NetBird IPv6: 2001:db8:ffff::11
  Public key: IVQ+tK7xQDp4BNyB5C6JOW7SH+659ShoIfCUYFxQEW8=
  Status: Connecting
  -- detail --
  Connection type: -
  ICE candidate (Local/Remote): -/-
  ICE candidate endpoints (Local/Remote): -/-
  Relay server address:
  Last connection update: 29 seconds ago
  Last WireGuard handshake: -
  Transfer status (received/sent) 0 B/0 B
  Quantum resistance: false
  Networks: -
  Latency: 0s

 ngx.anon-JT6AM.domain:
  NetBird IP: 10.64.236.23
  NetBird IPv6: 2001:db8:ffff::12
  Public key: 5DLAdLd+RYax6e/aX7PQ4xSC69MRq+Ju18UiCxZgG34=
  Status: Connecting
  -- detail --
  Connection type: -
  ICE candidate (Local/Remote): -/-
  ICE candidate endpoints (Local/Remote): -/-
  Relay server address:
  Last connection update: 29 seconds ago
  Last WireGuard handshake: -
  Transfer status (received/sent) 0 B/0 B
  Quantum resistance: false
  Networks: -
  Latency: 0s

 unbound.anon-JT6AM.domain:
  NetBird IP: 10.64.239.103
  NetBird IPv6: 2001:db8:ffff::13
  Public key: cPBGDzqKXakja37u72vsMbebxqNagGTmRebpQXTs2V8=
  Status: Connecting
  -- detail --
  Connection type: -
  ICE candidate (Local/Remote): -/-
  ICE candidate endpoints (Local/Remote): -/-
  Relay server address:
  Last connection update: 29 seconds ago
  Last WireGuard handshake: -
  Transfer status (received/sent) 0 B/0 B
  Quantum resistance: false
  Networks: -
  Latency: 0s

 woodie.anon-JT6AM.domain:
  NetBird IP: 10.64.239.131
  NetBird IPv6: 2001:db8:ffff::14
  Public key: 4mNXZ3QtPO3jVWxBJXUZwSmWkj6EkRX1QjAqk6YR8TU=
  Status: Connected
  -- detail --
  Connection type: P2P
  ICE candidate (Local/Remote): host/host
  ICE candidate endpoints (Local/Remote): 192.168.0.38:51820/192.168.0.47:51820
  Relay server address: rels://nb.anon-nqfyg.domain:443
  Last connection update: 29 seconds ago
  Last WireGuard handshake: 24 seconds ago
  Transfer status (received/sent) 124 B/476 B
  Quantum resistance: false
  Networks: -
  Latency: 151.793833ms

 cloud.anon-JT6AM.domain:
  NetBird IP: 10.64.248.27
  NetBird IPv6: 2001:db8:ffff::16
  Public key: 3JOhzYget4D4AQdm5KfrSkPCnG311k42x2Q1Hx1LDRM=
  Status: Connected
  -- detail --
  Connection type: P2P
  ICE candidate (Local/Remote): host/host
  ICE candidate endpoints (Local/Remote): 2001:db8:ffff::d:51820/2001:db8:ffff::15:51820
  Relay server address: rels://nb.anon-nqfyg.domain:443
  Last connection update: 29 seconds ago
  Last WireGuard handshake: 30 seconds ago
  Transfer status (received/sent) 732 B/1.2 KiB
  Quantum resistance: false
  Networks: -
  Latency: 184.45125ms

Events:
  [INFO] SYSTEM (60310da0-9ccd-4f54-9ee5-df09adff2f05)
    Message: New version available
    Time: 2 hours, 14 minutes ago
    Metadata: new_version_available: 0.75.0
  [INFO] SYSTEM (59afdeb8-8aac-47aa-b848-f8af9f303a3c)
    Message: New version available
    Time: 2 hours, 14 minutes ago
    Metadata: new_version_available: 0.75.0
  [INFO] SYSTEM (db2a086c-06fb-4482-b202-e5392f3573a2)
    Message: daemon config changed (source=up_rpc)
    Time: 1 hour, 2 minutes ago
    Metadata: source: up_rpc, type: config_changed
  [INFO] SYSTEM (6d1aa474-7674-4a79-b7b8-1d30f641c9a8)
    Message: New version available
    Time: 1 hour, 2 minutes ago
    Metadata: new_version_available: 0.75.0
  [INFO] SYSTEM (e807e975-7887-46d5-a18c-9a4d8b8a78c3)
    Message: Network map updated
    Time: 1 hour, 2 minutes ago
  [INFO] SYSTEM (6321dcbb-dcc6-4eac-8a99-9c32f42aaae7)
    Message: New version available
    Time: 38 minutes, 27 seconds ago
    Metadata: new_version_available: 0.75.0
  [INFO] SYSTEM (dc49bd32-0e97-4e35-8ce1-95c137f0f0e4)
    Message: New version available
    Time: 38 minutes, 26 seconds ago
    Metadata: new_version_available: 0.75.0
  [INFO] SYSTEM (83718d29-78dd-4ec3-bdd4-f3378576adb7)
    Message: daemon config changed (source=up_rpc)
    Time: 32 seconds ago
    Metadata: source: up_rpc, type: config_changed
  [INFO] SYSTEM (ef2ccf50-37a9-493d-b869-7965ae5c2f4c)
    Message: New version available
    Time: 30 seconds ago
    Metadata: new_version_available: 0.75.0
  [INFO] SYSTEM (a3799c21-a34f-4e23-b07c-589a87fff1dc)
    Message: Network map updated
    Time: 29 seconds ago
OS: darwin/arm64
Daemon version: 0.74.7
CLI version: 0.74.7
Profile: default
Management: Connected to https://nb.anon-nqfyg.domain:443
Signal: Connected to https://nb.anon-nqfyg.domain:443
Relays:
  [stun:nb.anon-nqfyg.domain:3478] is Available
  [rels://nb.anon-nqfyg.domain:443] is Available via ws
Nameservers:
  [10.64.158.251:53, 192.168.0.11:53] for [anon-doGhD.domain] is Available
  [10.64.248.27:5335] for [anon-JT6AM.domain] is Available
  [198.51.100.0:53, 198.51.100.1:53, 2001:db8:ffff::18:53] for [.] is Available
  [192.168.0.47:53, 192.168.0.9:53] for [anon-Ftba0.domain, anon-UnN8h.domain] is Available
FQDN: m1.anon-JT6AM.domain
NetBird IP: 10.64.148.247/16
NetBird IPv6: 2001:db8:ffff::17/64
Interface type: Userspace
Wireguard port: 51820
Quantum resistance: false
Lazy connection: false
SSH Server: Disabled
Networks: -
Peers count: 7/18 Connected

Related issues or discussions

N/A — not found in existing search

Impact

Affected users/peers: single macOS client observed, likely affects any peer on a path with a PMTU blackhole
Business or production impact: low — workaround available
Workaround available: yes, manually setting netbird up --mtu 1150

Additional context

No response

Navigation Menu

Uh oh!

Uh oh!

PMTU blackhole between macOS client and self-hosted NetBird-Only reverse-proxy peer causes stalls #6923

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Replies: 0 comments

Select a reply

Uh oh!

Uh oh!

Uh oh!

PMTU blackhole between macOS client and self-hosted NetBird-Only reverse-proxy peer causes stalls #6923

Uh oh!

Uh oh!

kurthw Jul 27, 2026

Before posting

Affected area

Deployment type

Operating system or environment

NetBird version and upgrade status

Did this work before?

Regression details

Summary

Current behavior

Expected behavior

Steps to reproduce

Environment and topology

Self-hosted details, if available

Logs, status output, or debug evidence

Related issues or discussions

Impact

Additional context

Replies: 0 comments

kurthw
Jul 27, 2026