renstur@coopnet:~/blog$ ls -lt ./topics/networking/
networking/
NetBird, WireGuard, UniFi and Docker networks: reaching things safely, and finding out why traffic disappears.
-
Outbound IPv6 for Docker containers without restarting them
My NetBird reverse proxy logged a Docker address for every v6 visitor until I set enable_ipv6 on its own compose network. My app host got outbound v6 separately: an IPv6-only ULA network, attached live with docker network connect and declared external in compose.
-
My NetBird proxy relayed everything because of a Docker hairpin
My self-hosted NetBird proxy in Docker relayed everything. Its WireGuard port was random, and STUN on the same host handed back the Docker bridge address. On v0.82.0, pinning NB_PROXY_WG_PORT and setting NB_PROXY_EXTERNAL_IP_MAP to the public IP got it direct.
-
I'm fairly sure UniFi threat prevention was eating my traffic
A Proxmox NFS storage check kept timing out on port 111 while 2049 answered, which fits my own UniFi Threat Prevention dropping rpcbind. I didn't add an exception. I switched to a directory storage on the existing mount with is_mountpoint 1, and the timeouts stopped.
-
Upgrading a self-hosted NetBird server without dropping peers
Upgrading my selfhosted NetBird server is pull, recreate, check. The real risk was having no backup, so a weekly timer takes an online SQLite backup, verifies it and alerts on failure. After an upgrade I check for a 200 and a 401, remove orphaned proxy peers, and VACUUM monthly.
-
Splitting one Docker host into network tiers
Every container on my Docker host shared one bridge, so any app could reach the vault, the auth database and the mail relay. I split it into six networks, internal for the databases, with a /24 address pool. Always set the Compose project name on recreate or you get empty volumes.
-
Reaching LAN-only services through NetBird
My LAN only admin UIs threw certificate warnings over NetBird. I moved them to NetBird private services (NB_PROXY_PRIVATE=true on the proxy), so each gets a real hostname and a Let's Encrypt cert but answers one NetBird group. Every hostname lands in CT logs, so keep them boring.
-
My NetBird homelab: zero open ports
I wanted my lab reachable from anywhere with no port forwarded at home, so everything runs over a NetBird overlay and the only router rule is Plex. The exposure moves to the control plane VM, so I lock that down, write policies by role, and delete Default last.
-
Your mesh ACL check returned nothing because you asked the wrong firewall
I ran nft list table ip netbird on a peer, got empty output and exit 0, and nearly read that as no rules. The host was on iptables, so nftables had nothing to say. Detect the backend first, and test the check on a host you know has rules.