Document the dual-stack IPv6 gateway-IP issue for self-hosted - #901
Document the dual-stack IPv6 gateway-IP issue for self-hosted#901emrcbrn wants to merge 2 commits into
Conversation
On dual-stack hosts whose NetBird domain has an AAAA record, peers that connect over IPv6 are recorded with the Docker bridge gateway (e.g. 172.30.0.1) as their Public IP, because Docker's userland proxy re-originates the connection from the gateway before any reverse proxy sees it. Header and trustedHTTPProxies settings cannot fix it. - Quickstart: add an "IPv6 and dual-stack hosts" subsection under Troubleshoot (symptom, cause, the enable_ipv6 + ip6tables fix pair, and the AAAA-removal alternative), plus a short pointer on the domain prerequisite. Distinguishes this from overlay IPv6. - External reverse proxy: note that the gateway-IP symptom is not a header problem, linking to the fix. - Self-hosted dashboard troubleshooting: symptom-phrased entry linking to the fix. Ref: NET-1461 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
@emrcbrn is attempting to deploy a commit to the NetBird GmbH Team on Vercel. A member of the Team first needs to authorize it. |
|
Warning Review limit reached
Next review available in: 18 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughThe documentation explains incorrect peer public-IP detection on dual-stack hosts when Docker re-originates IPv6 traffic. It documents IPv6 Docker configuration, DNS alternatives, kernel limitations, and links the guidance from related self-hosted pages. ChangesIPv6 peer address guidance
Estimated code review effort: 2 (Simple) | ~10 minutes Suggested reviewers: Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/pages/selfhosted/selfhosted-quickstart.mdx`:
- Around line 201-212: Update the Docker network troubleshooting instructions
around the netbird network configuration to include recreating the existing
network, using docker compose down or docker network rm before bringing the
stack up again. Explicitly warn users not to remove data volumes, and preserve
the IPv6 enablement and ULA subnet steps.
- Around line 214-220: Update the Docker ip6tables guidance in the selfhosted
quickstart to avoid grouping all pre-27 engines together: provide tested
version-specific daemon configurations, including the required experimental and
fixed-cidr-v6 settings for older engines and the supported IPv6 configuration
for Engine 28, or clearly state a tested minimum Docker Engine version.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: ad1d7192-11bb-4541-93b5-6e3847d21094
📒 Files selected for processing (3)
src/pages/selfhosted/external-reverse-proxy.mdxsrc/pages/selfhosted/selfhosted-quickstart.mdxsrc/pages/selfhosted/troubleshooting/dashboard.mdx
- The fix applies to a running deployment, and Docker only reads network options when it first creates a network, so add a step to recreate the netbird network (docker compose down/up), with a warning not to remove data volumes. - Make the daemon.json guidance version-specific: ip6tables is default on Docker Engine 27+, and older engines need "experimental": true. Drop the daemon-level "ipv6": true, which only affects the default bridge and is not needed here. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
1 participant
What
Documents a known self-hosted deployment issue: on dual-stack hosts whose NetBird domain has an
AAAArecord, peers connecting over IPv6 are recorded with the Docker bridge gateway address (for example172.30.0.1) as their Public IP in the dashboard, with Region Unknown. The value appears to flip between logins because the same peer shows its real IP over an IPv4 path.Cause: the getting-started script creates an IPv4-only Docker network. IPv4 inbound is DNATed (source IP preserved), but IPv6 inbound has no path into the bridge and is handled by Docker's userland proxy, which re-originates the connection over IPv4 from the gateway. This happens before any reverse proxy sees the request, so
X-Forwarded-For/X-Real-IP/trustedHTTPProxiescannot fix it.Changes
Canonical content lives in one place (the quickstart), with the other two locations linking to it:
selfhosted/selfhosted-quickstart.mdx— new IPv6 and dual-stack hosts subsection under Troubleshoot: symptom, cause, the two-part fix (enable_ipv6+ ULA subnet on the compose network, andip6tablesindaemon.jsonwith a warning to pair them), theAAAA-removal alternative, and theipv6.disable=1kernel caveat. Includes a short pointer on the domain prerequisite, and a note distinguishing this from the IPv6 overlay feature.selfhosted/external-reverse-proxy.mdx— a note that the gateway-IP symptom is not a header ortrustedHTTPProxiesproblem, linking to the fix.selfhosted/troubleshooting/dashboard.mdx— a symptom-phrased entry ("Peer Public IP shows a Docker or internal IP") linking to the fix.Ref: NET-1461
Summary by CodeRabbit
AAAArecord.