Cannot get a client/server to register with my self-hosted NetBird instance

[reddwarf666]

Describe the problem

I am trying to self-host NetBird but I face issues when I try to register servers

To Reproduce

netbird up --management-url https://netbird.example.com --setup-key 9ACAFB14-redacted

Expected behavior

A successful registration which shows in the Dashboard and have the server be part of the VPN network.

Are you using NetBird Cloud?

No, I use the Self-Hosted variant

NetBird version

netbird version : 0.66.2
Management : v0.66.2
Dashboard : v2.33.0

Is any other VPN software installed?

Yes, tailscale client is running on the servers.
I have to use that VPN because I cannot yet use NetBird to SSH into servers

Debug output

To help us resolve the problem, please attach the following anonymized status output

netbird status -dA

Daemon status: LoginFailed

Run UP command to log in with SSO (interactive login):

 netbird up 

If you are running a self-hosted version and no SSO provider has been configured in your Management Server,
you can use a setup-key:

 netbird up --management-url <YOUR_MANAGEMENT_URL> --setup-key <YOUR_SETUP_KEY>

More info: https://docs.netbird.io/how-to/register-machines-using-setup-keys

Create and upload a debug bundle, and share the returned file key:

netbird debug for 1m -AS -U

Results:
Error: failed to up: context deadline exceeded

Uploaded files are automatically deleted after 30 days.

Alternatively, create the file only and attach it here manually:

netbird debug for 1m -AS

Tried this one as well and got this message:

Error: failed to get status: failed while getting Management Service public key: failed while getting Management Service public key

Screenshots

If applicable, add screenshots to help explain your problem.

Additional context

I used the setup script as provided on the NetBird installation page
I'm running this on a VPS at Hetzner, the DNS is in CloudFlare.
I created an A record netbird.example.com and made sure the proxy setting is off on that record.
I previously used the cloud version of NetBird and I could connect that same server just fine with a setup key.
The proxy server (called Godoxy) and NetBird run on the same server in Docker and are both part of the same Docker network I created.
I also tried to use the same netbird up command on another server and I get the same results and error messages.
I also had to change the exposed ports in my compose file from 8080 and 8081 as it conflicted and so I used ports 9080 and 9081
I also disabled Tailscale on the server to see if that would help. To do this I temporarily allowed port 22 into my Hetzner server, this is now closed again of course. The results were the same

When I try and register a server with with the netbird up command:
netbird up --management-url https://netbird.example.com --setup-key 9ACAFB14-redacted

That command waits for a long time and finally stops with an error, a timeout it seems:
Error: daemon up failed: login backoff cycle failed: rpc error: code = Unknown desc = failed while getting Management Service public key

And the common theme in errors seems to be:
failed while getting Management Service public key

I can see in the proxy server log:

03-08 13:48 WRN not found: netbird.example.com:443 method=POST remote=<my public ip>:37046 url=/management.ManagementService/GetServerKey
03-08 13:48 WRN not found: netbird.example.com:443 method=POST remote=<my public ip>:52204 url=/management.ManagementService/GetServerKey
03-08 13:48 WRN not found: netbird.example.com:443 method=POST remote=<my public ip>:34010 url=/management.ManagementService/GetServerKey

This is my docker-compose file content:

networks:
  default:
    name: proxy
    external: true

services:

  netbird-dashboard:
    image: netbirdio/dashboard:latest
    container_name: netbird-dashboard
    restart: unless-stopped
    ports:
      - '127.0.0.1:9080:80'
    env_file:
      - ./dashboard.env
    labels:
      proxy.aliases: netbird
      proxy.netbird.port: 80
      proxy.netbird.scheme: http
      proxy.netbird.homepage: |
        name: NetBird
        icon: "@selfhst/netbird.svg"
        category: networking
      proxy.netbird.rules: |
        path glob(/signalexchange.SignalExchange/**) | path glob(/management.ManagementService/**) | path glob(/management.ProxyService/**) {
          route netbird-grpc
        }
        path glob(/relay*) | path glob(/ws-proxy/**) | path glob(/api*) | path glob(/oauth2*) {
          route netbird-api
        }
        default {
          pass
        }

  netbird-server:
    image: netbirdio/netbird-server:latest
    container_name: netbird-server
    restart: unless-stopped
    #networks: [netbird]
    ports:
      - '127.0.0.1:9081:80'
      - '3478:3478/udp'
    volumes:
      - ./data/netbird:/var/lib/netbird
      - ./config.yaml:/etc/netbird/config.yaml
    command: ["--config", "/etc/netbird/config.yaml"]
    labels:
      proxy.aliases: netbird-api, netbird-grpc
      proxy.netbird-api.port: 80
      proxy.netbird-api.scheme: http
      proxy.netbird-api.homepage: |
        show: false
        name: NetBird API
        icon: "@selfhst/netbird.svg"
      proxy.netbird-grpc.port: 80
      proxy.netbird-grpc.scheme: h2c
      proxy.netbird-grpc.homepage: |
        show: false
        name: NetBird gRPC
        icon: "@selfhst/netbird.svg"

And this is my config.yml file content:

# Combined NetBird Server Configuration (Simplified)
# Generated by getting-started.sh

server:
  listenAddress: ":80"
  exposedAddress: "https://netbird.example.com:443"
  stunPorts:
    - 3478
  metricsPort: 9090
  healthcheckAddress: ":9000"
  logLevel: "info"
  logFile: "console"

  authSecret: "redacted"
  dataDir: "/var/lib/netbird"

  auth:
    issuer: "https://netbird.example.com/oauth2"
    signKeyRefreshEnabled: true
    dashboardRedirectURIs:
      - "https://netbird.example.com/nb-auth"
      - "https://netbird.example.com/nb-silent-auth"
    cliRedirectURIs:
      - "http://localhost:53000/"

  reverseProxy:
    trustedHTTPProxies:
      - "172.30.0.10/32"
        
  store:
    engine: "sqlite"
    encryptionKey: "redacted"

And my dashboard.env file content:

# Endpoints
NETBIRD_MGMT_API_ENDPOINT=https://netbird.example.com
NETBIRD_MGMT_GRPC_API_ENDPOINT=https://netbird.example.com
# OIDC - using embedded IdP
AUTH_AUDIENCE=netbird-dashboard
AUTH_CLIENT_ID=netbird-dashboard
AUTH_CLIENT_SECRET=
AUTH_AUTHORITY=https://netbird.example.com/oauth2
USE_AUTH0=false
AUTH_SUPPORTED_SCOPES=openid profile email groups
AUTH_REDIRECT_URI=/nb-auth
AUTH_SILENT_REDIRECT_URI=/nb-silent-auth
# SSL
NGINX_SSL_PORT=443
# Letsencrypt
LETSENCRYPT_DOMAIN=none

Have you tried these troubleshooting steps?

• Reviewed client troubleshooting (if applicable)
• Checked for newer NetBird versions
• Searched for similar issues on GitHub (including closed ones)
• Restarted the NetBird client
• Disabled other VPN software
• Checked firewall settings

[Sergey842248]

Same Problem here, for me it seems this is also a problem with the cloud managed instance since this didn't work for me either.
Additionally I'm also at Cloudflare and have nearly the exact same setup (no VPS but a mini PC at my home). All outputs are exactly the same.

Thank you for posting the Issue I alreqdy thought I am the only one facing the Issue.

[Sergey842248]

With the docker connection command I got some logs, maybe they help

2026-03-10T04:28:48+00:00 INFO /usr/local/bin/netbird-entrypoint.sh:96: registered new service process 'netbird service run', currently running: '7'
2026-03-10T04:28:48+00:00 INFO /usr/local/bin/netbird-entrypoint.sh:41: waiting for log line 'started daemon server' for 5 seconds...
2026-03-10T04:28:48.818Z INFO client/cmd/service_controller.go:27: starting NetBird service
2026-03-10T04:28:48.818Z INFO client/cmd/service_controller.go:27: starting NetBird service
2026-03-10T04:28:48.828Z INFO client/server/server.go:961: active profile config existed: true, err <nil>
2026-03-10T04:28:48.828Z INFO client/server/server.go:961: active profile config existed: true, err <nil>
2026-03-10T04:28:48.829Z INFO client/cmd/service_controller.go:74: started daemon server: /var/run/netbird.sock
2026-03-10T04:28:48.829Z INFO client/cmd/service_controller.go:74: started daemon server: /var/run/netbird.sock
2026-03-10T04:28:48.829Z INFO client/internal/connect.go:134: starting NetBird client version 0.66.3 on linux/amd64
2026-03-10T04:28:48.829Z INFO client/internal/connect.go:134: starting NetBird client version 0.66.3 on linux/amd64
2026-03-10T04:28:48.830Z INFO client/net/env_linux.go:70: system supports advanced routing
2026-03-10T04:28:48.830Z INFO client/net/env_linux.go:70: system supports advanced routing
2026-03-10T04:28:48.945Z ERRO shared/management/client/grpc.go:460: failed while getting Management Service public key: rpc error: code = Unimplemented desc = unexpected HTTP status code received from server: 404 (Not Found); transport: received unexpected content-type "text/plain; charset=utf-8"
2026-03-10T04:28:48.945Z ERRO shared/management/client/grpc.go:460: failed while getting Management Service public key: rpc error: code = Unimplemented desc = unexpected HTTP status code received from server: 404 (Not Found); transport: received unexpected content-type "text/plain; charset=utf-8"
2026-03-10T04:28:49+00:00 INFO /usr/local/bin/netbird-entrypoint.sh:41: waiting for log line 'peer has been successfully registered|management connection state READY' for 5 seconds...
2026-03-10T04:28:50.460Z ERRO shared/management/client/grpc.go:460: failed while getting Management Service public key: rpc error: code = Unimplemented desc = unexpected HTTP status code received from server: 404 (Not Found); transport: received unexpected content-type "text/plain; charset=utf-8"
2026-03-10T04:28:50.460Z ERRO shared/management/client/grpc.go:460: failed while getting Management Service public key: rpc error: code = Unimplemented desc = unexpected HTTP status code received from server: 404 (Not Found); transport: received unexpected content-type "text/plain; charset=utf-8"
2026-03-10T04:28:51.417Z ERRO shared/management/client/grpc.go:460: failed while getting Management Service public key: rpc error: code = Unimplemented desc = unexpected HTTP status code received from server: 404 (Not Found); transport: received unexpected content-type "text/plain; charset=utf-8"
2026-03-10T04:28:51.417Z ERRO shared/management/client/grpc.go:460: failed while getting Management Service public key: rpc error: code = Unimplemented desc = unexpected HTTP status code received from server: 404 (Not Found); transport: received unexpected content-type "text/plain; charset=utf-8"
2026-03-10T04:28:54+00:00 INFO /usr/local/bin/netbird-entrypoint.sh:87: logging in...
Error: unable to get daemon status: rpc error: code = FailedPrecondition desc = failed while getting Management Service public key: failed while getting Management Service public key
2026-03-10T04:28:54+00:00 INFO /usr/local/bin/netbird-entrypoint.sh:26: Shutting down NetBird daemon...
2026-03-10T04:28:54+00:00 INFO /usr/local/bin/netbird-entrypoint.sh:28: terminating service process IDs: '7'
2026-03-10T04:28:54.834Z INFO client/cmd/root.go:207: shutdown signal received
2026-03-10T04:28:54.834Z INFO client/cmd/root.go:207: shutdown signal received
2026-03-10T04:28:54.834Z INFO client/server/server.go:877: service is down
2026-03-10T04:28:54.834Z INFO client/server/server.go:877: service is down
2026-03-10T04:28:57.350Z INFO client/cmd/service_controller.go:100: stopped NetBird service
2026-03-10T04:28:57.350Z INFO client/cmd/service_controller.go:100: stopped NetBird service

[Sergey842248]

@reddwarf666 Did you find a solution or a workaround for this?

[steven-git-oca]

@Sergey842248 Nope, never found a solution for this. My current workaround is to keep using the free cloud offering for now. I also face some rather annoying DNS issues with NetBird where a server cannot resolve hostnames of other connected nodes. I will try and focus on that as I think solving that will be easier then this problem we talk about. Seems we have to figure that out on our own, alas. Well, they do not owe us anything I guess so I will accept that I will fail in self hosting NetBird.

Self hosting NetBird would be great but perhaps beyond my reach and capabilities. 🤷🏼

[mlsmaycon]

Hello Folks,

This error is usually linked to a reverse proxy misconfiguration, or in the case of Cloudflare, a DNS configuration with proxy enabled.

For the latter, better to just disable Cloudflare's proxy or check how to set it up for gRPC connections.

For a reverse proxy configuration, we recommend reviewing the settings. You will find a few examples in the link below:

https://docs.netbird.io/selfhosted/reverse-proxy

You can also share your current configuration so we can help you troubleshoot.

[Sergey842248]

Hi @reddwarf666 thank you for your answer,

My current workaround is to keep using the free cloud offering for now.

This is strange because for me it gives me the same error for the cloud environment too (so I guess no reverse proxy issue).

netbird up --setup-key 6AE10759-redacted - l debug
Error: unable to get daemon status: rpc error: code = FailedPrecondition desc = failed while getting Management Service public key: failed while getting Management Service public key

[steven-git-oca]

@Sergey842248 sorry, I cannot help you with that, for me registering a server with NB cloud seems to work

@mlsmaycon thanks for the offer to help! In my tickets description I think I gave everything you asked for. Can you tell me what is missing so I can give that to you to help analyze this issue? Thanks!

[steven-git-oca]

@mlsmaycon I was wondering if you need more info or perhaps have some idea on what actions I could take to make self-hosting NetBird a reality.

[reddwarf666]

@mlsmaycon did you have a chance to look at the information sent? Is there anything I can do to make this work?

[reddwarf666]

Anybody who sees this, what is the best way to get some help for problems like these?

[azrikahar]

Huge disclaimer that I've never actually used Godoxy, but since I had success setting it up with Caddy, I wonder if using the Content-Type header for route matching that Caddy is using would also work in Godoxy?

To be specific, this would mean for your existing rule:

path glob(/signalexchange.SignalExchange/**) | path glob(/management.ManagementService/**) | path glob(/management.ProxyService/**) {
  route netbird-grpc
}

can you try replacing it with this instead:

header Content-Type glob(application/grpc**) {
  route netbird-grpc
}

I referred the header matching syntax from https://docs.godoxy.dev/docs/godoxy/advanced-topics/rule-based-routing, hopefully that's a 1-to-1 translation of syntax as expected.

---

Another side question is may I know was there any source reference for your following rule:

path glob(/relay*) | path glob(/ws-proxy/**) | path glob(/api*) | path glob(/oauth2*) {
  route netbird-api
}

I assume it's from netbird's traefik examples?

From a quick glance in https://docs.godoxy.dev/docs/godoxy/advanced-topics/rule-based-routing/Conditions#glob-patterns, I wonder should you ensure to use ** instead of * only as well? single asterisk in Godoxy might not be the same as in other reverse proxies. This means updating your rule to:

path glob(/relay**) | path glob(/ws-proxy/**) | path glob(/api**) | path glob(/oauth2**) {
  route netbird-api
}

(updated relay, api, and oauth2 glob to use double asterisks instead of one asterisk)

[reddwarf666]

Thanks @azrikahar , appreciate the effort you take to help me out with this.

Unfortunately, the settings did not work.
I have this configuration now. I tried lots of changes and guesses. I added double asterisk everywhere, added the header Content-Type and only that one, added the path glob back, etc. Nothing works.

services:

  netbird-dashboard:
    image: netbirdio/dashboard:latest
    container_name: netbird-dashboard
    restart: unless-stopped
    #networks: [netbird]
    ports:
      - '127.0.0.1:9080:80'
    env_file:
      - ./dashboard.env
    logging:
      driver: "json-file"
      options:
        max-size: "500m"
        max-file: "2"
    labels:
      proxy.aliases: netbird
      proxy.netbird.port: 80
      proxy.netbird.scheme: http
      proxy.netbird.homepage: |
        name: NetBird
        icon: "@selfhst/netbird.svg"
        category: networking
      proxy.netbird.rules: |
        path glob(/signalexchange.SignalExchange/**) | path glob(/management.ManagementService/**) | path glob(/management.ProxyService/**) {
          route netbird-grpc
        }
        header Content-Type glob(application/grpc**) {
          route netbird-grpc
        }
        path glob(/relay**) | path glob(/ws-proxy/**) | path glob(/api*) | path glob(/oauth2**) {
          route netbird-api
        }
        default {
          pass
        }

  netbird-server:
    image: netbirdio/netbird-server:latest
    container_name: netbird-server
    restart: unless-stopped
    #networks: [netbird]
    ports:
      - '127.0.0.1:9081:80'
      - '3478:3478/udp'
    volumes:
      - ./data/netbird:/var/lib/netbird
      - ./config.yaml:/etc/netbird/config.yaml
    command: ["--config", "/etc/netbird/config.yaml"]
    logging:
      driver: "json-file"
      options:
        max-size: "500m"
        max-file: "2"
    labels:
      proxy.aliases: netbird-api, netbird-grpc
      proxy.netbird-api.port: 80
      proxy.netbird-api.scheme: http
      proxy.netbird-api.homepage: |
        show: false
        name: NetBird API
        icon: "@selfhst/netbird.svg"
      proxy.netbird-grpc.port: 80
      proxy.netbird-grpc.scheme: h2c
      proxy.netbird-grpc.homepage: |
        show: false
        name: NetBird gRPC
        icon: "@selfhst/netbird.svg"

Testing by removing the Cloud setup and then trying to connect to my self hosted netbird is painful tbh. I never know if something is left hanging or whatnot. But the real pain is in after trying this all, I want to reconnect to the Cloud netbird version and that fails every single time. It takes a long time of trial and error to get back to a working situation.
This makes me hesitant to mess it all up again, see it fail and then having to get the cloud version working again is really taking a toll on me. I have been trying to get netbird self hosting to work for months and months now and the constant failures and difficulty of getting back to a working cloud setup is getting to me tbh.

I have no idea what to do now and I honestly think this is just not going to work for me, for whatever reason. It's probably my ineptitude of it all.

It would seriously help if there was a tool from netbird that scans every step and tells you what fails. You can argue that it is already telling you it failed but I mean some sort of guidance on what to fix, I dunno. Probably impossible with all the variables involved. Man, I feel empty right now. My home server is not connecting to the netbird cloud anymore as I cannot find how to get that bit working again. Ah well

Hey, sorry for the ranting, I really appreciate the heck out of your efforts to try to help on this so this ranting is not towards you, it is frustration on someting bugging me for 6+ months now (I have had earlier effforts with netbird and failed)

EDIT: I could of course run a Debian container and test netbird connections within that one, that should work, right? Just run netbird up --management-url https://netbird.example.com:443 --setup-key <setup key>

[azrikahar]

Finally got around to trying out Godoxy, and since netbird server grpc also listens on port 33073 to be backwards compatible, I tried using your original labels but with just a single change on the port for netbird-grpc, like so:

     labels:
       proxy.aliases: netbird-api, netbird-grpc
       proxy.netbird-api.port: 80
       proxy.netbird-api.scheme: http
       proxy.netbird-api.homepage: |
         show: false
         name: NetBird API
         icon: "@selfhst/netbird.svg"
-      proxy.netbird-grpc.port: 80
+      proxy.netbird-grpc.port: 33073
       proxy.netbird-grpc.scheme: h2c
       proxy.netbird-grpc.homepage: |
         show: false
         name: NetBird gRPC
         icon: "@selfhst/netbird.svg"

It seems like the setup key works now, at least from my testing. We can actually see the peer showing up in the management dashboard.

However... the peer now just gets stuck at "connecting" when actually trying to establish the connection.

When I try a Caddy setup with (almost) a one-to-one map from Godoxy config & route rules to Caddyfile config (using caddy cloudflare dns plugin), assuming a setup of Godoxy autocert cloudflare provider with domain *.[example.com](http://example.com/):

• .env

   EMAIL=email@example.com
   DOMAIN=example.com
   CLOUDFLARE_API_TOKEN=<same token used in Godoxy's config.yaml>

• Caddyfile

  @netbird-grpc and @netbird-api are like Godoxy's labels and route rules

   {
           email {$EMAIL}
           acme_dns cloudflare {env.CLOUDFLARE_API_TOKEN}
   }
   
   *.{$DOMAIN} {
           # Native gRPC (needs HTTP/2 cleartext to server)
           @netbird-grpc {
                   host netbird.{$DOMAIN}
                   header Content-Type application/grpc*
           }
           reverse_proxy @netbird-grpc h2c://netbird-server:80
   
           # Combined server paths (relay, signal, management, OAuth2)
           @netbird-api {
                   host netbird.{$DOMAIN}
                   path /relay* /ws-proxy/* /api/* /oauth2/*
           }
           reverse_proxy @netbird-api netbird-server:80
   
           # Dashboard (everything else)
           @netbird-dashboard {
                   host netbird.{$DOMAIN}
           }
           reverse_proxy @netbird-dashboard netbird-dashboard:80
   }
  

The Caddy setup works without any problem at all.

I think for Godoxy, it it somehow having issues with it comes to grpc and/or websocket? Other reverse proxies requires specific configs to extend timeouts etc to prevent such issues specifically, as seen in Netbird's script for each of them:

• Traefik

  netbird/infrastructure_files/getting-started.sh

  Lines 689 to 692 in d6f08e4

  	# Disable timeouts for long-lived gRPC streams
  	- "--entrypoints.websecure.transport.respondingTimeouts.readTimeout=0"
  	- "--entrypoints.websecure.transport.respondingTimeouts.writeTimeout=0"
  	- "--entrypoints.websecure.transport.respondingTimeouts.idleTimeout=0"

  netbird/infrastructure_files/getting-started.sh

  Lines 700 to 702 in d6f08e4

  	# gRPC transport settings
  	- "--serverstransport.forwardingtimeouts.responseheadertimeout=0s"
  	- "--serverstransport.forwardingtimeouts.idleconntimeout=0s"

• Nginx

  netbird/infrastructure_files/getting-started.sh

  Line 1126 in d6f08e4

  proxy_read_timeout 1d;

  netbird/infrastructure_files/getting-started.sh

  Lines 1132 to 1134 in d6f08e4

  	grpc_read_timeout 1d;
  	grpc_send_timeout 1d;
  	grpc_socket_keepalive on;

• Caddy

  Currently Caddy v2 doesn't require anything else, as shown in my sample Caddyfile above which is heavily referenced from Netbird's:

  netbird/infrastructure_files/getting-started.sh

  Lines 1173 to 1182 in d6f08e4

  	# Native gRPC (needs HTTP/2 cleartext to backend)
  	@grpc header Content-Type application/grpc*
  	reverse_proxy @grpc h2c://${server_addr}
  	# Combined server paths (relay, signal, management, OAuth2)
  	@backend path /relay* /ws-proxy/* /api/* /oauth2/*
  	reverse_proxy @backend ${server_addr}
  	# Dashboard (everything else)
  	reverse_proxy /* ${dashboard_addr}

  but IIRC Caddy v1 required some configs as well when it comes to websocket.

So unfortunately I think Godoxy requires similar configurations but they may not be exposed at the moment.

[reddwarf666]

Hi @azrikahar !

Incredible, I appreciate all your effort so, so much!

I see the same as you I think, the peer shows up in the WebUI but the client fails after a minute or 2 with:
Error: daemon up failed: call service up method: rpc error: code = DeadlineExceeded desc = context deadline exceeded

I have informed the developer of Godoxy of this thread, perhaps he can shed a light on this problem. It feels like we are so close...