iOS client remains connected but DNS and all tunnel traffic stop until reconnect

[lantura]

Before posting

• I searched existing discussions and issues, including closed ones, and checked the relevant docs.
• I believe this is a product bug rather than a configuration or setup question.
• I can reproduce this issue, or for intermittent issues I've included trigger, frequency, and timing details below.
• I removed or anonymized sensitive data from logs, screenshots, and configuration.

Affected area

Client / Agent, DNS, Self-hosting / Deployment

Deployment type

Self-hosted - advanced/custom deployment

Operating system or environment

iOS

NetBird version and upgrade status

• iOS client version: 0.3.3
• iOS version: 26.6
• Self-hosted management version: 0.77.1
• Dashboard version: 2.91.1

Did this work before?

Yes, this worked before

Regression details

• Last known working version: Unknown
• First known broken version: Unknown
• Recent changes: No specific client or server change has been identified.
• Frequency: Intermittent
• Workaround: Manually disconnecting and reconnecting the NetBird iOS client restores connectivity.

Summary

The NetBird iOS app remains in the “Connected” state and continues to display peers and resources, but DNS resolution and all traffic through the NetBird tunnel stop working. A manual disconnect and reconnect is required to restore connectivity.

Current behavior

While the issue is present:

• The NetBird app displays “Connected”.
• iOS displays “NetBird Network Extension” as connected.
• Peers and resources are visible in the app.
• The iPhone is assigned to the correct NetBird distribution group.
• The self-hosted NetBird management domain remains reachable.
• Public domains fail with ERR_NAME_NOT_RESOLVED.
• Internal hostnames fail.
• Internal IP addresses fail with ERR_CONNECTION_TIMED_OUT.
• No traffic appears to pass through the NetBird data tunnel.

The advanced settings at the time of the failure were:

• Enable Rosenpass: Disabled
• Permissive mode: Disabled
• Force relay connection: Enabled
• Disable IPv6: Enabled

Disabling “Force relay connection” while the tunnel was already in the broken state did not restore connectivity. The iOS Network Extension remained connected, but DNS and internal connections continued to fail.

Expected behavior

After standby, screen wake, or a network-state change, NetBird should keep the data tunnel operational or automatically rebuild it.
The app should not display “Connected” when only the management connection is available but DNS and traffic through the NetBird tunnel are no longer working.

Steps to reproduce

1. Connect the iPhone to the self-hosted NetBird deployment.
2. Use the iPhone over cellular data. Wi-Fi is enabled but not associated with a Wi-Fi network.
3. Leave NetBird connected, including during normal screen lock and standby.
4. Later, open a public website or an internal service.
5. Observe that the NetBird app still reports “Connected” and lists peers and resources.
6. Observe that public domains fail with ERR_NAME_NOT_RESOLVED.
7. Observe that internal IP addresses and internal hostnames time out.
8. Disconnect and reconnect NetBird.
9. Observe that connectivity is restored.

Environment and topology

• Client: iPhone 17 pro
• Operating system: iOS 26.6
• NetBird iOS app: 0.3.3
• Network at the time of failure: Cellular data
• Wi-Fi status: Enabled but not connected
• VPN status: NetBird Network Extension connected
• Deployment: Self-hosted NetBird
• Reverse proxy: Traefik
• The NetBird management endpoint remained reachable during the failure.
• Internal resources are accessed through NetBird network resources and a routing peer.
• DNS is distributed to the iPhone through NetBird.
• Other VPN software on the iPhone: None
• iCloud Private Relay: [DISABLED/ENABLED]

Self-hosted details, if available

• Deployment method: Docker Compose
• Reverse proxy: Traefik
• Management version: 0.77.1
• Dashboard version: 2.91.1
• Hosting environment: VPS IONOS Ubuntu Server 24.04
• Recent server-side changes: None known that coincide with the issue.

Logs, status output, or debug evidence

Trace logging and anonymization were enabled in the iOS app while the problem was present.

An NB debug bundle was created and uploaded before reconnecting the client.

Upload key: a909a839076f947d2b90f6f0e90e50ff9fec7c4aadce3a1d12f29111167ed6f7/a67b5677-e0ad-4be7-baec-ecb845a91176
Approximate creation time: 23.08.2026, 22:40 CEST
Anonymize data: Enabled
Trace logs: Enabled

Related issues or discussions

Similar iOS report where the client appears connected but peers are unreachable:

• Connection issues on iOS #3453
• Related report concerning “Force relay connection” on iOS:
  https://github.com/netbirdio/netbird/issues/55

This report may differ because the app displays peers and resources correctly, while both public DNS and all internal IP traffic fail until the NetBird connection is restarted.

Impact

• Affected users/peers: One iPhone currently observed
• Impact: Public internet access and access to all internal NetBird resources stop working while NetBird remains connected.
• Workaround: Open the NetBird app, disconnect, wait briefly, and reconnect.
• The misleading “Connected” status makes it difficult to recognize that the data tunnel has failed.

Additional context

The debug bundle was intentionally created while the failure was still active and before manually reconnecting NetBird.

Disabling “Force relay connection” did not repair the already broken tunnel without a reconnect. It remains to be determined whether keeping this option disabled prevents the issue from recurring.

The exact trigger is still under observation. Possible triggers include iOS standby, screen wake, or a network-state transition.