From 313c6e0645f9d3653b333cf0aa50879ff87b637b Mon Sep 17 00:00:00 2001 From: Riccardo Manfrin <3090891+riccardomanfrin@users.noreply.github.com> Date: Mon, 20 Jul 2026 09:41:47 +0200 Subject: [PATCH] Adds doc for NB_SOCKS5_LISTENER_ADDRESS (#860) --- src/pages/client/environment-variables.mdx | 1 + src/pages/use-cases/cloud/netbird-on-faas.mdx | 8 ++++++++ 2 files changed, 9 insertions(+) diff --git a/src/pages/client/environment-variables.mdx b/src/pages/client/environment-variables.mdx index 4ce0a783..754f70ae 100644 --- a/src/pages/client/environment-variables.mdx +++ b/src/pages/client/environment-variables.mdx @@ -46,6 +46,7 @@ To clear all saved service parameters (including env vars), run `sudo netbird se | `NB_USE_NETSTACK_MODE` | All | Run WireGuard on top of a userspace TCP/IP stack (gVisor netstack) instead of a TUN device. Required for environments without TUN support (e.g. unprivileged containers). | | `NB_NETSTACK_SKIP_PROXY` | All | When using netstack mode, do not start the built-in SOCKS5 proxy that exposes the WireGuard network to local applications. | | `NB_SOCKS5_LISTENER_PORT` | All | Override the port the netstack SOCKS5 proxy listens on (default: `1080`). Only relevant when netstack mode is active. | +| `NB_SOCKS5_LISTENER_ADDRESS` | All | Override the host/IP the netstack SOCKS5 proxy binds to (default: `127.0.0.1`). The proxy is unauthenticated and meant for local applications only, so it listens on loopback. Set this (e.g. to `0.0.0.0`) only when the proxy must be reachable from other hosts, such as a container gateway — this exposes an unauthenticated proxy on that address. Only relevant when netstack mode is active. | ## Firewall diff --git a/src/pages/use-cases/cloud/netbird-on-faas.mdx b/src/pages/use-cases/cloud/netbird-on-faas.mdx index fac1ca12..941ab1d9 100644 --- a/src/pages/use-cases/cloud/netbird-on-faas.mdx +++ b/src/pages/use-cases/cloud/netbird-on-faas.mdx @@ -36,6 +36,14 @@ docker run --rm --name PEER_NAME --hostname PEER_NAME -d \ ``` This is useful when you want to configure a simple routing peer without adding privileged permissions or linux capabilities. + +The SOCKS5 proxy binds to `127.0.0.1` by default, so it is reachable only from +within the same container. If your application runs in a **separate** container +and connects to the agent's proxy over the Docker network, set +`NB_SOCKS5_LISTENER_ADDRESS=0.0.0.0` on the agent so the proxy accepts those +connections. The proxy is unauthenticated, so only do this on trusted networks. + + ## How to use the SOCKS5 proxy? Once you have the agent running in netstack mode, you need to configure your application to use the SOCKS5 proxy. The following is an example of a python 3 application: ```python