starred/ProxmoxVE
1
0
Fork 0
mirror of https://github.com/community-scripts/ProxmoxVE.git synced 2026-03-01 11:19:48 +03:00
Code Issues 23 Packages Projects Releases 34 Wiki Activity

Netbird LXC: Connection loss after reboot due to Docker/Netbird race condition #2415

New Issue
Open
opened 2026-02-05 04:46:26 +03:00 by OVERLORD · 1 comment
OVERLORD commented 2026-02-05 04:46:26 +03:00
Owner
Copy Link

Originally created by @Koliham on GitHub (Jan 30, 2026).

✅ Have you read and understood the above guidelines?

yes

🔎 Did you run the script with verbose mode enabled?

Yes, verbose mode was enabled and the output is included below

📜 What is the name of the script you are using?

Netbird

📂 What was the exact command used to execute the script?

bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/tools/addon/add-netbird-lxc.sh)"

⚙️ What settings are you using?

  • Default Settings
  • Advanced Settings

🖥️ Which Linux distribution are you using?

Ubuntu 24.04

📈 Which Proxmox version are you on?

8.4.14

📝 Provide a clear and concise description of the issue.

Hi everyone,
I encountered an issue with the Netbird LXC (when Docker is also installed/running inside).
After a reboot, the Netbird connection was established, but traffic routing failed (peers could not reach the LXC services).

The Problem:
It seems to be a race condition between docker.service and netbird.service.
Docker initializes its iptables rules upon start and sets the FORWARD chain policy to DROP. If Netbird starts before Docker has finished this initialization, Docker overrides or blocks the Netbird routing rules, causing the connection to drop/timeout despite the tunnel being "up".

The Solution:
Manually restarting Netbird (netbird down && netbird up) fixed it temporarily.
The permanent fix is to ensure Netbird starts after Docker.
I added a systemd override: systemctl edit netbird

[Unit]
After=docker.service
Wants=docker.service

After this change, the routing works perfectly immediately after a reboot. Maybe this dependency could be added to the installation script or the default service file?

Best regards!

🔄 Steps to reproduce the issue.

Step 1. Configure and run Netbird that it works, that you can reach another service within the network with your smartphone.
Step 2: Restart the Netbird LXC Container: Try to reach the service again. It should fail.
Step 3: Run netbird down and then netbird up, it should work again.

❌ Paste the full error output (if available).

iptables -L FORWARD -v -n

Chain FORWARD (policy DROP 134 packets, 8040 bytes)

 pkts bytes target     prot opt in     out     source               destination         

  134  8040 DOCKER-USER  0    --  *      *       0.0.0.0/0            0.0.0.0/0           

  134  8040 DOCKER-FORWARD  0    --  *      *       0.0.0.0/0            0.0.0.0/0

🖼️ Additional context (optional).

No response

Originally created by @Koliham on GitHub (Jan 30, 2026). ### ✅ Have you read and understood the above guidelines? yes ### 🔎 Did you run the script with verbose mode enabled? Yes, verbose mode was enabled and the output is included below ### 📜 What is the name of the script you are using? Netbird ### 📂 What was the exact command used to execute the script? bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/tools/addon/add-netbird-lxc.sh)" ### ⚙️ What settings are you using? - [ ] Default Settings - [x] Advanced Settings ### 🖥️ Which Linux distribution are you using? Ubuntu 24.04 ### 📈 Which Proxmox version are you on? 8.4.14 ### 📝 Provide a clear and concise description of the issue. Hi everyone, I encountered an issue with the Netbird LXC (when Docker is also installed/running inside). After a reboot, the Netbird connection was established, but traffic routing failed (peers could not reach the LXC services). **The Problem:** It seems to be a race condition between `docker.service` and `netbird.service`. Docker initializes its iptables rules upon start and sets the FORWARD chain policy to DROP. If Netbird starts before Docker has finished this initialization, Docker overrides or blocks the Netbird routing rules, causing the connection to drop/timeout despite the tunnel being "up". **The Solution:** Manually restarting Netbird (netbird down && netbird up) fixed it temporarily. The permanent fix is to ensure Netbird starts after Docker. I added a systemd override: `systemctl edit netbird` ``` toml [Unit] After=docker.service Wants=docker.service ``` After this change, the routing works perfectly immediately after a reboot. Maybe this dependency could be added to the installation script or the default service file? Best regards! ### 🔄 Steps to reproduce the issue. Step 1. Configure and run Netbird that it works, that you can reach another service within the network with your smartphone. Step 2: Restart the Netbird LXC Container: Try to reach the service again. It should fail. Step 3: Run `netbird down` and then `netbird up`, it should work again. ### ❌ Paste the full error output (if available). iptables -L FORWARD -v -n ``` Chain FORWARD (policy DROP 134 packets, 8040 bytes) pkts bytes target prot opt in out source destination 134 8040 DOCKER-USER 0 -- * * 0.0.0.0/0 0.0.0.0/0 134 8040 DOCKER-FORWARD 0 -- * * 0.0.0.0/0 0.0.0.0/0 ``` ### 🖼️ Additional context (optional). _No response_
OVERLORD added the bug label 2026-02-05 04:46:26 +03:00
OVERLORD commented 2026-02-05 04:46:28 +03:00
Author
Owner
Copy Link

@michelroegl-brunner commented on GitHub (Jan 30, 2026):

Can you open a PR for that?

@michelroegl-brunner commented on GitHub (Jan 30, 2026): Can you open a PR for that?
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
Implemented in VED waiting push to Main
breaking change
bug
bug
bugfix
deferred
delete script
dependencies
enhancement
external
feature
github
help wanted
in project pipeline
invalid
investigation
json
maintenance
needs triage
new script
new script
nice to have
not a script issue
not planned
organization
pull-request
Mirrored from GitHub Pull Request
 question
refactor
rename script
security
update script
website
wontdo
🛑 Failure to comply with the guidelines
No Label bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
OVERLORD
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/ProxmoxVE#2415
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?