* docs: add routing-peer self-access and Active Directory guides New use-case guides: reaching a service on a routing peer's own LAN IP (route + peer-to-peer policy + NB_ENABLE_LOCAL_FORWARDING) and an end-to-end Active Directory / Windows file shares guide over NetBird. Clarify domain-resource DNS: with Routing Peer DNS Resolution on, the routing peer answers the client's A/AAAA lookups (a domain resource matches the exact name; use a wildcard for hostnames under a domain), but AD still needs a nameserver group for the SRV/DC-locator records. Add navigation entries, overlay-vs-LAN-IP notes, and ICMP/ping troubleshooting guidance. * docs: fix WireGuard anchor slug and sharpen local-forwarding caution The #why-wireguard-with-netbird anchor doesn't resolve — the heading slugifies to #why-wire-guard-with-net-bird (decamelized). Fix it in the networks intro and the netbird-vs-traditional-vpn self-link. Clarify the NB_ENABLE_LOCAL_FORWARDING caution: with it on, any permitted peer can reach services bound to the routing peer's own addresses, including 127.0.0.1, at the peer's NetBird IP. * docs: polish routing-peer and Active Directory guides - Correct the DC policy note: TCP/UDP need separate policies because a policy carries one protocol, not because of a first-rule limitation - Make internal-dns-servers the canonical A/AAAA-vs-SRV explanation; collapse the three duplicates to one-line pointers - Trim emphatic bold to enumerated requirements, ports, and flags - Reduce em-dash density and clarify the routing-peer SSH-management and HA cautions in the AD guide * docs: make Active Directory guide clearer for junior admins - Rewrite the Verify section to explain why (test as the signed-in domain user, port 445 vs ping, name vs IP) instead of assuming ICMP/Kerberos/NTLM knowledge - Clarify the SSH-management and HA cautions in Step 3 - Note Get-DfsnFolderTarget needs the DFS Management tools (RSAT), not just any domain-joined machine - Reduce em-dash density throughout * docs: Routing Peer DNS Resolution applies to all domain resources, not just wildcards * docs: refine Active Directory guide and nameserver terminology - Step 3 DC ports as a Port/Protocol/Needed-for table; promote 123 (time sync) and 464 (kpasswd) into the baseline - DFS step: derive each target server's FQDN for the domain resource - order the agent-placement and reachability shapes consistently (dedicated routing peer first) - drop the niche SSH-wedge caution and the premature masquerade note - tie the ping/ICMP caveat to the port-scoped policies - use "Nameserver" + "match domain" (the UI term) instead of "nameserver group" across the AD, internal-DNS, and reach-services pages * docs: scope the local-forwarding caution — loopback exposure is netstack-only Reaching the routing peer's own 127.0.0.1-bound services via its NetBird IP only happens on netstack-mode peers; on userspace-TUN (Windows/macOS) it does not (verified), and Linux kernel mode is a no-op. The general "exposes own addresses" caution stands; drop the over-broad 127.0.0.1/localhost specifics. * docs: trim DC-through-routing-peer section to the DNS-only reason and reorder AD subsections Drop the setup-flavored framing from 'Reaching a Domain Controller through a routing peer' (it lives on the AD use-case page), keeping the DNS reference fact: A/AAAA resolves on the routing peer but SRV/DC-locator records don't, so AD still needs a nameserver to the DC. Heading text is unchanged so the existing anchor still resolves. Reorder the AD & Domain Controllers subsections to lead with the recommended case (reach the DC through a separate routing peer), then the discouraged DC-as-routing-peer path, then its WireGuard port-conflict troubleshooting. * docs: drop redundant cross-link from AD Step 4 nameserver note The note already explains why a domain resource doesn't remove the nameserver requirement (SRV/DC-locator records). The trailing link to the DNS page's 'Reaching a Domain Controller through a routing peer' section just repeated that fact and linked back here, bouncing the reader. Step 4 already links to Internal DNS Servers for the general setup. * docs: restructure AD routing-peer guidance — least-privilege tiers, DC route/policy split, de-loop cross-links Active Directory & Windows File Shares: - Add a TL;DR linking to a new 'The four settings' checklist at the bottom. - Split Step 3 into Step 3 (route the DC) and Step 4 (allow the AD ports); DNS becomes Step 5. Keeps the route distinct from the access policies. - Step 2: break each routing-peer case into sub-bullets of what's needed; point the self-access case to Reach Services on the Routing Peer. - Step 3: present /32 or apex domain as the granular default and the *.corp.example.com wildcard as the least-privilege opt-in — and spell out the wildcard's one-policy-scope cost (uniform ports across the whole domain). Reach Services on the Routing Peer: - Tighten the setup steps; concrete DNS-nameserver instruction for AD/DFS; state the Linux kernel-mode default for NB_ENABLE_LOCAL_FORWARDING. - 'recipe' -> 'setup' throughout. Internal DNS Servers: - Clarify nameserver vs plain share: A/AAAA via the routing peer needs no nameserver; AD needs one for SRV records and because the resolver won't fall back. Distribute the nameserver to the routing peer's group *and* client groups that resolve directly; only when the peer can't resolve on its own. Reorder AD subsections; fix the overbroad distribution note. How Routing Peers Work / cross-links: - Remove redundant/circular cross-links across the four pages (the HRPW -> Internal DNS -> Active Directory -> HRPW loop). * docs: use "NetBird client"/"clientless" wording in AD and self-access guides Replace 'the agent'/'agentless' with the preferred 'NetBird client'/'clientless' terms, and add the missing blank line before the Step 2 heading. * docs: lower altitude of routing-peer/AD guides for junior admins - Unify the overlay address as 'NetBird IP' and the local one as 'LAN IP' across the routing-peer/DNS pages; add a 2-line two-address primer to the two crux pages. - Replace the dense userspace/netstack/kernel forwarding sentence with a platform table framed to the self-access case, plus a netstack-override footnote. - Demote the wildcard policy-scope trade-off in the AD guide to a Note, keeping the granular-first nudge in the main flow. - Split the 'Reaching a DC through a routing peer' paragraph into what-it-needs / why-a-domain-resource-isn't-enough bullets. - De-duplicate the self-access section: it now owns the mental model and points to the use-case page for the concrete setup. * docs: clarify the forwarding section for junior admins - Disambiguate NB_ENABLE_LOCAL_FORWARDING from the IP-forwarding sysctl by naming the setting explicitly before the table. - Split local forwarding into its own '### Local forwarding' subheading, distinct from '### IP forwarding'; repoint the #local-forwarding cross-link. - Drop the netstack-specific override footnote — edge-case reference material that doesn't help the target reader (the row already names the correct flag). * docs: apply review feedback to routing-peer/AD guides - AD Step 4: list the AD ports per TCP/UDP access control policy instead of a dense one-rule-per-policy sentence; add 123 to the four-settings recap. - De-duplicate the route+policy+local-forwarding triad within how-routing-peers-work (Local forwarding now points to the canonical statement); render the LAN-IP requirements as a sub-list. - Plain-language rewrite of why a domain resource isn't enough for AD DNS. - Qualify Global Catalog 3268/3269 to multi-domain forests; state the default branch in AD Step 1. - Fix the Networks Tiles description to say 'NetBird client', not 'agent'. - Add DNS troubleshooting Issue 7 for the AD symptom (login/DFS fails but file-by-IP works), cross-linked to the AD guide and the DC section. * docs: recast AD "four settings" as an explicit NetBird config checklist Rename the summary to 'What you configure in NetBird' and list the discrete NetBird objects: routing peer, a route (resource) to the file server and to the DC, separate access control policies for each, and a DNS nameserver. Keep the full AD port set in Step 4 only; update the TL;DR link to the new (decamelized) anchor. * docs: clarify the self-access setup steps - Identify NB_ENABLE_LOCAL_FORWARDING as an environment variable and link the Client Environment Variables reference. - Front-load the platform on step 3 (Windows/macOS need the flag; Linux kernel forwarding doesn't, only netstack) and soften the 'all three required' framing accordingly. - Explain that steps 1 and 3 exist only because clients reach the file server at its LAN IP; reaching a peer at its NetBird IP needs only the policy.
The NetBird documentation
This repository contains assets required to build the documentation website for NetBird. It is built using Next.js with MDX support, a modern React framework for building static and dynamic websites.
We're glad that you want to contribute!
Requirements
- node 16
- npm 8+
Installation
$ npm install
Local Development
$ npm run dev
This command starts a local development server and opens up a browser window. Most changes are reflected live without having to restart the server.
Contributing to the docs
You can click the Fork button in the upper-right area of the screen to create a copy of this repository in your GitHub account. This copy is called a fork. Make any changes you want in your fork, and when you are ready to send those changes to us, go to your fork and create a new pull request to let us know about it.
Once your pull request is created, a NetBird reviewer will take responsibility for providing clear, actionable feedback. As the owner of the pull request, it is your responsibility to modify your pull request to address the feedback that has been provided to you by the NetBird reviewer.
Also, note that you may end up having more than one NetBird reviewer provide you feedback or you may end up getting feedback from a NetBird reviewer that is different than the one initially assigned to provide you feedback.
Furthermore, in some cases, one of your reviewers might ask for a technical review from a NetBird author when needed. Reviewers will do their best to provide feedback in a timely fashion but response time can vary based on circumstances.
Code of conduct
Participation in the NetBird community is governed by the NetBirds' Code of Conduct.
Components and Use
This documentation uses several custom MDX components. Here's a guide to the most commonly used components:
Alert Components
Use these components to highlight important information:
Note
Displays informational content with an orange theme:
import {Note} from "@/components/mdx"
<Note>
NetBird is an **[open-source](https://github.com/netbirdio/netbird)** project and can be self-hosted.
See a comparison between the self-hosted and cloud-hosted versions [here](/selfhosted/self-hosted-vs-cloud-netbird).
</Note>
Warning
Displays warning content with a red theme:
import {Warning} from "@/components/mdx"
<Warning>
The API is still in Beta state so some errors might not be handled properly yet.
</Warning>
Success
Displays success messages with a green theme:
import {Success} from "@/components/mdx"
<Success>
Your configuration has been successfully applied.
</Success>
Tiles Component
Displays a grid of clickable cards with hover effects. Perfect for listing related resources or guides:
import {Tiles} from "@/components/Tiles"
<Tiles
title="About NetBird"
id="about-netbird"
items={[
{
href: '/about-netbird/how-netbird-works',
name: 'How NetBird Works',
description: 'Learn about NetBird concepts, architecture, protocols, and how it creates secure networks.',
},
{
href: '/about-netbird/netbird-vs-traditional-vpn',
name: 'NetBird vs. Traditional VPN',
description: 'Discover how NetBird compares to traditional VPNs and understand the advantages of Zero Trust networking.',
},
]}
/>
Props:
title(string, required): The heading title for the tiles sectionid(string, optional): Optional id for the heading anchoritems(array, required): Array of objects withhref,name, anddescriptionbuttonText(string, optional): Button text (defaults to "Read more" - currently unused as cards are fully clickable)
YouTube Component
Embeds YouTube videos with customizable parameters:
import {YouTube} from "@/components/YouTube"
<YouTube videoId="CFa7SY4Up9k" />
// With custom parameters
<YouTube
videoId="CFa7SY4Up9k"
title="Video Title"
start={175}
color="white"
modestbranding={1}
rel={1}
/>
// Or use a URL instead of videoId
<YouTube url="https://www.youtube.com/watch?v=CFa7SY4Up9k" />
Props:
videoId(string): YouTube video IDurl(string): YouTube URL (alternative to videoId)title(string, optional): Video titlestart(number, optional): Start time in secondscolor(string, optional): Progress bar color -'white'or'red'(default:'white')modestbranding(number, optional): Reduces YouTube branding -0or1(default:1)controls(number, optional): Show/hide controls -0,1, or2(default:1)rel(number, optional): Show related videos -0or1(default:1)
Button Component
Creates styled buttons with multiple variants:
import {Button} from "@/components/Button"
// Primary button (default)
<Button href="https://app.netbird.io/install" arrow="right">
Get started
</Button>
// Secondary button
<Button href="/path" variant="secondary">
Learn more
</Button>
// Outline button
<Button href="/path" variant="outline">
Explore
</Button>
// Text button
<Button href="/path" variant="text" arrow="right">
Read more
</Button>
// With left arrow
<Button href="/path" arrow="left">
Back
</Button>
Props:
variant(string, optional): Button style -'primary','secondary','filled','outline', or'text'(default:'primary')href(string, optional): Link URL (creates a link if provided, otherwise renders as button)arrow(string, optional): Arrow icon -'left'or'right'children(required): Button text content
Other Common Components
Row and Col
Create two-column layouts:
import {Row, Col} from "@/components/mdx"
<Row>
<Col>
Left column content
</Col>
<Col sticky>
Right column content (sticky on scroll)
</Col>
</Row>
Properties and Property
Define API properties or configuration options:
import {Properties, Property} from "@/components/mdx"
<Properties>
<Property name="apiKey" type="string" required>
Your API key for authentication.
</Property>
<Property name="timeout" type="number" min={0} max={300}>
Request timeout in seconds (default: 30).
</Property>
</Properties>
Badge
Displays small status badges:
import {Badge} from "@/components/mdx"
<Badge>New</Badge>
<Badge variant="secondary">Beta</Badge>
Code Blocks
Code syntax highlighting (automatically available):
\`\`\`bash
npm install
npm run dev
\`\`\`
// Or use code groups for multiple languages
<CodeGroup>
```bash title="Installation"
npm install
yarn install
Thank you
NetBird thrives on community participation, and we appreciate your contributions to our website and our documentation!