NetBird Networks / Routing-Peer setup

Use Networks (the newer NetBird model), not legacy Network Routes.

The NetBird client runs with network_mode: host on each Docker host. Each Docker host is a routing peer for only the private Docker resource(s) that must be reachable remotely. None of the application containers publishes a host port.

Peer groups

Create these peer groups:

public-proxy: PUBLIC01
guac-workers: GUAC01, GUAC02, GUAC03
sessionguard-host: SESSIONGUARD01

Network: guac01-docker

Routing peer: GUAC01

Resource:

Name: guac01-web
Address: 10.201.1.10
Type: IP
Resource group: guacamole-web

Policy:

Source: public-proxy
Destination/resource: guac01-web
Protocol: TCP
Port: 8080

Repeat with:

GUAC02 -> 10.201.2.10:8080
GUAC03 -> 10.201.3.10:8080

Do not advertise the guacd addresses (.11). guacd has no authentication and must remain reachable only inside its local Docker bridge.

Network: sessionguard-docker

Routing peer: SESSIONGUARD01

Resources:

sessionguard-master
- Address: 10.202.0.10
- Type: IP
guacamole-db
- Address: 10.202.0.20
- Type: IP

Policies:

public-proxy -> sessionguard-master, TCP 8080
guac-workers -> sessionguard-master, TCP 8080
guac-workers -> guacamole-db, TCP 5432

Do not create a resource for 10.202.0.11 (SessionGuard PostgreSQL). That database remains private to the SessionGuard Docker bridge.

IP forwarding

Linux routing peers normally enable forwarding automatically through NetBird. If forwarding is blocked by host policy, persist it explicitly:

sudo sysctl -w net.ipv4.ip_forward=1
printf 'net.ipv4.ip_forward=1\n' | sudo tee /etc/sysctl.d/99-netbird-routing.conf

Verify

On each routing peer:

netbird status -d
ip route

From PUBLIC01, after the Networks are distributed:

curl -I http://10.201.1.10:8080/
curl -I http://10.201.2.10:8080/
curl -I http://10.201.3.10:8080/
curl -I http://10.202.0.10:8080/healthz

From a Guacamole worker container:

# SessionGuard broker/control plane
wget -S -O- http://10.202.0.10:8080/healthz

# Shared Guacamole PostgreSQL
# use pg_isready/psql from a temporary postgres client container if needed

For production, check that PUBLIC01 <-> routing peers are P2P/direct, not permanently relayed, using netbird status -d.

2.4 KiB Raw Blame History