Reverse proxy sso auth returns service 404, other auth type works #6247

bornav · 2026-05-22T10:55:42Z

bornav
May 22, 2026

Before posting

I searched existing discussions and issues for similar questions.
I reviewed the relevant NetBird documentation or troubleshooting guide.
I removed or anonymized sensitive data from logs, screenshots, and configuration.

Topic

Self-hosting, Identity provider / SSO

Deployment type

Self-hosted - quickstart script

Operating system or environment

Linux, Docker

NetBird version

server:0.71.3, dashboard:v2.38.1,proxy:0.71.3

Question

Why is it if i try to access reverse proxy protected resource with auth type SSO, it returns back 404 service not found netbird error, but if i use any other authentication type it works?

Desired outcome

i would expect it to work the same if login is successfull

What have you tried?

I am able to access netbird managment with my OAUTH(keycloak) and manage my users

if i rerun the quickinstall script in another domain, replicate the OAUTH config and expose the service, then im able to access the protected resource

Relevant environment details

config.yaml

server:
  disableAnonymousMetrics: true
  disableGeoliteUpdate: true
  listenAddress: ":80"
  exposedAddress: "https://netbird.icylair.com:443"
  stunPorts:
    - 3478
  metricsPort: 9090
  healthcheckAddress: ":9000"
  logLevel: "info"
  logFile: "console"

  authSecret: ""
  dataDir: "/var/lib/netbird"

  auth:
    issuer: "https://netbird.icylair.com/oauth2"
    signKeyRefreshEnabled: true
    dashboardRedirectURIs:
      - "https://netbird.icylair.com/nb-auth"
      - "https://netbird.icylair.com/nb-silent-auth"
    cliRedirectURIs:
      - "http://localhost:53000/"

  reverseProxy:
    trustedHTTPProxies:
      - "172.18.0.10/16"
  store:
    engine: "sqlite"
    encryptionKey: ""

proxy.yaml

NB_PROXY_DOMAIN=proxy.icylair.com
NB_PROXY_TOKEN=
NB_PROXY_MANAGEMENT_ADDRESS=http://netbird-server:80
NB_PROXY_ALLOW_INSECURE=true
NB_PROXY_ADDRESS=:8443
NB_PROXY_CERTIFICATE_DIRECTORY=/cert

#NB_PROXY_CERTIFICATE_FILE=tls.crt
#NB_PROXY_CERTIFICATE_KEY_FILE=tls.key

NB_PROXY_ACME_CERTIFICATES=true
NB_PROXY_WILDCARD_CERT_DIR=/cert

NB_LOG_LEVEL=debug
NB_PROXY_DEBUG_LOGS=true


NB_PROXY_FORWARDED_PROTO=https
NB_PROXY_PROXY_PROTOCOL=true
NB_PROXY_TRUSTED_PROXIES=172.18.0.10

dashboard.yaml

# Endpoints
NETBIRD_MGMT_API_ENDPOINT=https://netbird.icylair.com
NETBIRD_MGMT_GRPC_API_ENDPOINT=https://netbird.icylair.com
# OIDC - using embedded IdP
AUTH_AUDIENCE=netbird-dashboard
AUTH_CLIENT_ID=netbird-dashboard
AUTH_CLIENT_SECRET=
AUTH_AUTHORITY=https://netbird.icylair.com/oauth2
USE_AUTH0=false
AUTH_SUPPORTED_SCOPES=openid profile email groups
AUTH_REDIRECT_URI=/nb-auth
AUTH_SILENT_REDIRECT_URI=/nb-silent-auth
# SSL
NGINX_SSL_PORT=443
# Letsencrypt
LETSENCRYPT_DOMAIN=none

Logs or output

when I access the resource here are relevant logs


netbird-dashboard  | 172.18.0.10 - - [22/May/2026:10:39:43 +0000] "GET / HTTP/1.1" 200 2467 "-" "Uptime-Kuma/1.23.16" "213.240.76.164"
netbird-server-1   | 2026-05-22T10:39:48.814Z INFO [peer_id: sha-574Zlpx3xxQdtUUbw3BRjC/s08/i43i35Tv2XlRQedM=] relay/server/relay.go:150: peer connected from: 172.18.0.10:37732
netbird-proxy-1    | 2026-05-22T10:39:55.157Z DEBG proxy/internal/accesslog/middleware.go:28: request: request_id=d8834up1is2g00bool50 method=GET host=dockhand.proxy.icylair.com path=/
netbird-proxy-1    | 2026-05-22T10:39:55.157Z DEBG proxy/internal/auth/middleware.go:100: checking authentication for host: dockhand.proxy.icylair.com, exists: true
netbird-proxy-1    | 2026-05-22T10:39:55.185Z DEBG proxy/internal/accesslog/middleware.go:87: response: request_id=d8834up1is2g00bool50 method=GET host=dockhand.proxy.icylair.com path=/ status=401 duration=28ms source=213.240.76.164 origin=auth service=d861oa32pt6000bb3it0 account=d6cbe1r2pt6000cjb100
netbird-server-1   | 2026-05-22T10:39:57.724Z INFO [peer_id: sha-dq78yDTxQx7LES0s0tAfgGCHV5wlAk64m4vRGRtUYNU=] relay/server/relay.go:150: peer connected from: 172.18.0.10:50020
netbird-server-1   | 2026-05-22T10:39:57.767Z INFO [peer_id: sha-ekheD8YQkvqOJvCUPE7s9SBJ29oHwYOV9ZAsQVwvVlM=] relay/server/relay.go:150: peer connected from: 172.18.0.10:50028
netbird-server-1   | 2026-05-22T10:39:57.773Z INFO [peer_id: sha-UP2DA5Taqzy/56Nk9ZHXmTQw9L+cL+XiVCXM/7s+PTg=] relay/server/relay.go:150: peer connected from: 172.18.0.10:50032
netbird-server-1   | 2026-05-22T10:39:57.774Z INFO [peer_id: sha-ZpR0T0w9ceExhiYVkaBMs2V59gdiP6iRNfGB0K6ImzU=] relay/server/relay.go:150: peer connected from: 172.18.0.10:50034
netbird-proxy-1    | 2026-05-22T10:39:59.391Z DEBG proxy/internal/accesslog/middleware.go:28: request: request_id=d8834vp1is2g00bool5g method=GET host=netbird.icylair.com path=/oauth2/auth
netbird-proxy-1    | 2026-05-22T10:39:59.392Z DEBG proxy/internal/auth/middleware.go:100: checking authentication for host: netbird.icylair.com, exists: false
netbird-proxy-1    | 2026-05-22T10:39:59.392Z DEBG proxy/internal/proxy/servicemapping.go:70: no mapping found for host: netbird.icylair.com
netbird-proxy-1    | 2026-05-22T10:39:59.392Z DEBG proxy/internal/accesslog/middleware.go:87: response: request_id=d8834vp1is2g00bool5g method=GET host=netbird.icylair.com path=/oauth2/auth status=404 duration=0ms source=213.240.76.164 origin=no_route service= account=

which results in

here are logs if i use pin auth

netbird-proxy-1    | 2026-05-22T10:44:01.408Z DEBG proxy/internal/accesslog/middleware.go:28: request: request_id=d8836s91is2g00boon70 method=GET host=dockhand.proxy.icylair.com path=/
netbird-proxy-1    | 2026-05-22T10:44:01.408Z DEBG proxy/internal/auth/middleware.go:100: checking authentication for host: dockhand.proxy.icylair.com, exists: true
netbird-proxy-1    | 2026-05-22T10:44:01.427Z DEBG proxy/internal/accesslog/middleware.go:87: response: request_id=d8836s91is2g00boon70 method=GET host=dockhand.proxy.icylair.com path=/ status=401 duration=18ms source=213.240.76.164 origin=auth service=d861oa32pt6000bb3it0 account=d6cbe1r2pt6000cjb100
netbird-proxy-1    | ice DEBUG: 10:44:03.108809 agent.go:345: Started agent: isControlling? true, remoteUfrag: "qGCMjUnRPnkjIAAp", remotePwd: "TTYTyDckzTPRpZrNOFcHhhJZXfjsruJH"
netbird-proxy-1    | ice INFO: 2026/05/22 10:44:03 Setting new connection state: Checking
netbird-proxy-1    | ice WARNING: 2026/05/22 10:44:03 Failed to ping without candidate pairs. Connection is not possible yet.
netbird-proxy-1    | ice WARNING: 2026/05/22 10:44:03 SingleSocketUDPMux should not listening on unspecified address, use NewMultiUDPMuxFromPort instead
netbird-proxy-1    | ice WARNING: 2026/05/22 10:44:03 Failed get server reflexive address udp6 stun:netbird.icylair.com:3478: failed to send STUN packet: write udp6 [::]:51821->[2a01:4f8:c17:1ebf::1]:3478: sendto: network is unreachable
netbird-proxy-1    | ice WARNING: 2026/05/22 10:44:03 Failed to ping without candidate pairs. Connection is not possible yet.
netbird-proxy-1    | ice WARNING: 2026/05/22 10:44:03 Failed to ping without candidate pairs. Connection is not possible yet.
netbird-proxy-1    | 2026-05-22T10:44:08.481Z DEBG proxy/internal/accesslog/middleware.go:28: request: request_id=d8836u11is2g00boon7g method=POST host=dockhand.proxy.icylair.com path=/
netbird-proxy-1    | 2026-05-22T10:44:08.481Z DEBG proxy/internal/auth/middleware.go:100: checking authentication for host: dockhand.proxy.icylair.com, exists: true
netbird-proxy-1    | 2026-05-22T10:44:08.588Z DEBG proxy/internal/accesslog/middleware.go:87: response: request_id=d8836u11is2g00boon7g method=POST host=dockhand.proxy.icylair.com path=/ status=303 duration=106ms source=213.240.76.164 origin=auth service=d861oa32pt6000bb3it0 account=d6cbe1r2pt6000cjb100
netbird-proxy-1    | 2026-05-22T10:44:08.612Z DEBG proxy/internal/accesslog/middleware.go:28: request: request_id=d8836u11is2g00boon80 method=GET host=dockhand.proxy.icylair.com path=/
netbird-proxy-1    | 2026-05-22T10:44:08.612Z DEBG proxy/internal/auth/middleware.go:100: checking authentication for host: dockhand.proxy.icylair.com, exists: true
netbird-proxy-1    | 2026-05-22T10:44:08.612Z DEBG proxy/internal/proxy/servicemapping.go:81: matched host: dockhand.proxy.icylair.com, path: / -> http://10.2.11.201:13000/



### Additional context

of note, this was deployed before proxy domain migrated to same as netbird, so possible database corruption?

bornav · 2026-06-05T15:57:28Z

bornav
Jun 5, 2026
Author

i can still replicate it on v0.72.0

0 replies

bornav · 2026-06-06T10:39:47Z

bornav
Jun 6, 2026
Author

adding this as extra context

so if in incognito i open up dockhand.proxy.icylair.com

i get this

now without inputting anything if i navigate to netbird domain so netbird.icylair.com

i get netbird service not found

opening directly the netbird domain from fresh incognito works

and if i attempt auth it would work

my compose file

name: netbird
services:
 dashboard:
   image: docker.io/netbirdio/dashboard:v2.39.0
   container_name: netbird-dashboard
   restart: unless-stopped
   env_file:
     - ./dashboard.env
   networks:
     - netbird
   logging:
     driver: json-file
     options:
       max-size: "500m"
       max-file: "2"
   labels:
     - "traefik.enable=true"
     - "traefik.http.routers.netbird-dashboard.rule=Host(`netbird.icylair.com`)"
     - "traefik.http.routers.netbird-dashboard.entrypoints=websecure"
     - "traefik.http.routers.netbird-dashboard.tls=true"
     - "traefik.http.routers.netbird-dashboard.service=dashboard"
     - "traefik.http.routers.netbird-dashboard.priority=1"
     - "traefik.http.services.dashboard.loadbalancer.server.port=80"

 netbird-server:
   container_name: netbird-server
   image: docker.io/netbirdio/netbird-server:0.72.0
   restart: unless-stopped
   command: ["--config", "/etc/netbird/config.yaml"]
   ports:
     - "3478:3478/udp"
   volumes:
     - ./data:/var/lib/netbird
     - ./config.yaml:/etc/netbird/config.yaml 
   networks:
     - netbird
   logging:
     driver: json-file
     options:
       max-size: "500m"
       max-file: "2"
   labels:
     - "traefik.enable=true"
     # gRPC router
     - "traefik.http.routers.netbird-grpc.rule=Host(`netbird.icylair.com`) && (PathPrefix(`/signalexchange.SignalExchange/`) || PathPrefix(`/management.ManagementService/`) || PathPrefix(`/management.ProxyService/`))"
     - "traefik.http.routers.netbird-grpc.entrypoints=websecure"
     - "traefik.http.routers.netbird-grpc.tls=true"
     - "traefik.http.routers.netbird-grpc.service=netbird-server-h2c"
     - "traefik.http.routers.netbird-grpc.priority=100"
     # Backend router
     - "traefik.http.routers.netbird-backend.rule=Host(`netbird.icylair.com`) && (PathPrefix(`/relay`) || PathPrefix(`/ws-proxy/`) || PathPrefix(`/api`) || PathPrefix(`/oauth2`))"
     - "traefik.http.routers.netbird-backend.entrypoints=websecure"
     - "traefik.http.routers.netbird-backend.tls=true"
     - "traefik.http.routers.netbird-backend.service=netbird-server"
     - "traefik.http.routers.netbird-backend.priority=100"
     # Services
     - "traefik.http.services.netbird-server.loadbalancer.server.port=80"
     - "traefik.http.services.netbird-server-h2c.loadbalancer.server.port=80"
     - "traefik.http.services.netbird-server-h2c.loadbalancer.server.scheme=h2c"

 netbird-proxy:
   container_name: netbird-proxy
   image: docker.io/netbirdio/reverse-proxy:0.72.0
   restart: unless-stopped
   depends_on:
     - netbird-server
   env_file:
     - ./proxy.env
   environment:
     PIONS_LOG_DEBUG: "all"
     NB_LOG_LEVEL: "debug"
   ports:
     - "127.0.0.1:8443:8443"
   volumes:
     - /cert:/cert
   networks:
     - netbird
   logging:
     driver: json-file
     options:
       max-size: "500m"
       max-file: "2"
   labels:
     - "traefik.enable=true"
     - "traefik.tcp.routers.proxy-passthrough.entrypoints=websecure"
     - "traefik.tcp.routers.proxy-passthrough.rule=HostSNI(`*`)"
     - "traefik.tcp.routers.proxy-passthrough.tls.passthrough=true"
     - "traefik.tcp.routers.proxy-passthrough.service=proxy-tls"
     - "traefik.tcp.routers.proxy-passthrough.priority=1"
     - "traefik.tcp.services.proxy-tls.loadbalancer.server.port=8443"
     # - "traefik.tcp.services.proxy-tls.loadbalancer.serverstransport=pp-v2@file"

networks:
 netbird:
   driver: bridge
   ipam:
     config:
       - subnet: 172.30.0.0/24
         gateway: 172.30.0.1

0 replies

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Reverse proxy sso auth returns service 404, other auth type works #6247

Uh oh!

{{title}}

Uh oh!

Replies: 2 comments

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

Uh oh!

Reverse proxy sso auth returns service 404, other auth type works #6247

Uh oh!

bornav May 22, 2026

Before posting

Topic

Deployment type

Operating system or environment

NetBird version

Question

Desired outcome

What have you tried?

Relevant environment details

Logs or output

Replies: 2 comments

Uh oh!

bornav Jun 5, 2026 Author

Uh oh!

bornav Jun 6, 2026 Author

bornav
May 22, 2026

bornav
Jun 5, 2026
Author

bornav
Jun 6, 2026
Author