# NetBird + Pangolin (Pangolin as reverse proxy for NetBird) Setup Guide **URL:** \ **Category:** Guides & Tutorials\ **Tags:** netbird, pangolin\ **Created:** [February 12, 2026, 5:48pm UTC](https://forum.hhf.technology/t/netbird-pangolin-pangolin-as-reverse-proxy-for-netbird-setup-guide/4274 "2026-02-12T17:48:57Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![codewhiz](https://forum.hhf.technology/user_avatar/forum.hhf.technology/codewhiz/32/2365_2.png) [@codewhiz](https://forum.hhf.technology/u/codewhiz)\ **Post date:** [February 12, 2026, 5:48pm UTC](https://forum.hhf.technology/t/netbird-pangolin-pangolin-as-reverse-proxy-for-netbird-setup-guide/4274/1 "2026-02-12T17:48:57Z")
**Last updated on 16th Feb 2026** **Disclaimer:** Only tested on fresh installations. **Prerequisites:** Pangolin installed. [How to Self-host Pangolin - Identity-aware VPN and Reverse Proxy for Easy Remote Access - youtube.com/@pangolin-net](https://www.youtube.com/watch?v=0upWrqkJPy8) * * * After my [failed try recently](https://forum.hhf.technology/t/pocketid-pangolin-netbird-work-in-progress/3128/11), I got NetBird finally running properly under Pangolin. With both running on same server as well as different servers. Thanks to Netbird for such awesome changes recently! * * * ## Context NetBird has made it way simpler by adding embedded STUN directly in their relay service instead of using separate coturn service → [[infra] add embedded STUN to getting started (#5141)](https://github.com/netbirdio/netbird/pull/5141) which they added in [v0.64.0](https://github.com/netbirdio/netbird/releases/tag/v0.64.0). They also added this guide → [Migration Guide: From Coturn to Embedded STUN Server - NetBird Docs](https://docs.netbird.io/selfhosted/migration/coturn-to-stun-migration) Their [Self-Hosting Quickstart Guide (5 min) - NetBird Docs](https://docs.netbird.io/selfhosted/selfhosted-quickstart) doesn’t explicitly tell about removed coturn service, which I think they will update instructions in next major version. They have updated their script though. * * * ## Installation Here is my recent installation. Follow this as reference for my below guides - ```auto $ curl -fsSL https://github.com/netbirdio/netbird/releases/latest/download/getting-started.sh | bash The NETBIRD_DOMAIN variable cannot be empty. Enter the domain you want to use for NetBird (e.g. netbird.my-domain.com): nb.yourdomain.com Which reverse proxy will you use? [0] Traefik (recommended - automatic TLS, included in Docker Compose) [1] Existing Traefik (labels for external Traefik instance) [2] Nginx (generates config template) [3] Nginx Proxy Manager (generates config + instructions) [4] External Caddy (generates Caddyfile snippet) [5] Other/Manual (displays setup documentation) Enter choice [0-5] (default: 0): 5 Should container ports be bound to localhost only (127.0.0.1)? Choose 'yes' if your reverse proxy runs on the same host (more secure). Bind to localhost only? [Y/n]: Y Rendering initial files... ========================================== MANUAL REVERSE PROXY SETUP ========================================== Container ports (bound to 127.0.0.1): Dashboard: 8080 NetBird Server: 8081 (all services: management, signal, relay) Configure your reverse proxy with these routes (all go to the same backend): WebSocket (relay, signal, management WS proxy): /relay*, /ws-proxy/* -> 127.0.0.1:8081 (HTTP with WebSocket upgrade, extended timeout) Native gRPC (signal + management): /signalexchange.SignalExchange/* -> 127.0.0.1:8081 /management.ManagementService/* -> 127.0.0.1:8081 (gRPC/h2c - plaintext HTTP/2) HTTP (API + embedded IdP): /api/*, /oauth2/* -> 127.0.0.1:8081 Dashboard (catch-all): /* -> 127.0.0.1:8080 IMPORTANT: gRPC routes require HTTP/2 (h2c) upstream support. WebSocket and gRPC connections need extended timeouts (recommend 1 day). Press Enter when your reverse proxy is configured (or Ctrl+C to exit)... Starting NetBird services [+] up 4/4 ✔ Network netbird_netbird Created 0.0s ✔ Volume netbird_netbird_data Created 0.0s ✔ Container netbird-dashboard Created 0.1s ✔ Container netbird-server Created 0.1s Waiting for NetBird server to become ready . . . . . . . . done Done! NetBird is now running. Access the dashboard at: https://nb.yourdomain.com ``` ### Note before installing: 1. For configuration in Pangolin UI, use these paths as prefix (without `*` character at end). You can simply copy from the terminal instructions provided by netbird script without `*` character - - `/relay` - `/ws-proxy/` - `/signalexchange.SignalExchange/` - `/management.ManagementService/` - `/api/` - `/oauth2/` - `/` 1. In my second way I put netbird services directly in pangolin network for accessing them from pangolin unlike first way where I simply used 127.0.0.1/localhost. I did this because my Netbird wasn’t detected by Pangolin on localhost. You can avoid this way if your Netbird is being detected by Pangolin on localhost. ### 1. For Pangolin and NetBird on Different Servers Install Newt on remote server and add remote site in Pangolin dashboard. Then Install netbird in netbird directory by using their quick start guide installation script, and when on this step - > Press Enter when your reverse proxy is configured (or Ctrl+C to exit)… ![screenshot-2026-02-16_14-58-39](https://forum-cdn.hhf.technology/original/2X/e/e6207d6c7dfbd5cb5af225838cf78fb7e6172a26.jpeg) Add reverse proxy configuration in Pangolin, and press enter on Netbird script. ### 2. For Pangolin and NetBird on Same Server If you installed both on same server then, first go to Pangolin UI and add your pangolin server as local site in your dashboard - ![image](https://forum-cdn.hhf.technology/original/2X/7/7ca48e9da3ec7b8c55f72992ed3c4fed10b5a7ae.jpeg) And then when installing NetBird on this step - > Press Enter when your reverse proxy is configured (or Ctrl+C to exit)… Create a public resource on that local site with the paths provided by netbird ![image](https://forum-cdn.hhf.technology/original/2X/d/d10fbb03502cf25bdf539d283f27d58c136f29b3.jpeg) Add reverse proxy configuration in Pangolin, and press enter on Netbird script. As you can see I’m using direct service names and ports here because I tried using 127.0.0.1 method like in 1st, pangolin was not detecting netbird for me for some reason. So I moved netbird directly to pangolin network as you can see in my below instructions - Edit your docker-compose.yml file of inside netbird folder, where you installed netbird and make sure pangolin is already running: ```auto # In every service, replace this - networks: [netbird] # with this - networks: [pangolin] # And for this global networks declaration part in compose file at the bottom, replace this - networks: netbird: # with this - networks: pangolin: external: true ``` * * * ## BONUS! For Cloudflare users, who run pangolin server with [Cloudflare Proxy/Orange Cloud - Pangolin Docs](https://docs.pangolin.net/self-host/advanced/cloudflare-proxy) turned ON. ![image](https://forum-cdn.hhf.technology/original/2X/9/99bd4dc379deb4f429152c8574ddc091a8e2099c.png) Make sure that you enable gRPC in your Cloudflare Dashboard \> Your Domain \> Network ![image](https://forum-cdn.hhf.technology/original/2X/4/4bb05f3f03fb08f9bcc683bd83cb0c8df95f66db.jpeg) So that your devices connect properly using STUN. I was facing this problem before and discovered this option today which fixed my problem when using Cloudflare Proxy/Orange Cloud ---
**Author:** ![hhf.technoloy](https://forum.hhf.technology/user_avatar/forum.hhf.technology/hhf.technoloy/32/68_2.png) [@hhf.technoloy](https://forum.hhf.technology/u/hhf.technoloy)\ **Post date:** [February 12, 2026, 5:50pm UTC](https://forum.hhf.technology/t/netbird-pangolin-pangolin-as-reverse-proxy-for-netbird-setup-guide/4274/2 "2026-02-12T17:50:19Z")
---
**Author:** ![codewhiz](https://forum.hhf.technology/user_avatar/forum.hhf.technology/codewhiz/32/2365_2.png) [@codewhiz](https://forum.hhf.technology/u/codewhiz)\ **Post date:** [February 16, 2026, 9:18am UTC](https://forum.hhf.technology/t/netbird-pangolin-pangolin-as-reverse-proxy-for-netbird-setup-guide/4274/3 "2026-02-16T09:18:54Z")
### Key Changes: - **16 Feb 2026** - **20 Feb 2026** * * * For people like me who are still using Pangolin as their reverse proxy and NetBird as their overlay vpn, I will keep updating the posts. Haven’t tested migration guides myself, as i did fresh install of the combined container version. ---
**Author:** ![fkgantec](https://forum.hhf.technology/letter_avatar_proxy/v4/letter/f/f04885/32.png) [@fkgantec](https://forum.hhf.technology/u/fkgantec)\ **Post date:** [April 16, 2026, 11:47am UTC](https://forum.hhf.technology/t/netbird-pangolin-pangolin-as-reverse-proxy-for-netbird-setup-guide/4274/4 "2026-04-16T11:47:38Z")
```auto ``` Hi codewhiz, I just installed Netbird behind my Pangolin following your instructions. Netbird seems to be working fine, but when I try to add peers, they can’t connect to the Netbird server. I think it might be because Netbird and Pangolin both use the same port, 51820. Unfortunately, I’m a beginner and I don’t really understand why it’s not working. Perhaps you could help me with this? ---
**Author:** ![f3r0x](https://forum.hhf.technology/letter_avatar_proxy/v4/letter/f/6de8d8/32.png) [@f3r0x](https://forum.hhf.technology/u/f3r0x)\ **Post date:** [April 21, 2026, 7:02pm UTC](https://forum.hhf.technology/t/netbird-pangolin-pangolin-as-reverse-proxy-for-netbird-setup-guide/4274/5 "2026-04-21T19:02:04Z")
Hi all, I have the same setup and setup and I believe the gprc timeout beeing to short in pangolin is causing some issues as described here as well for nginx as well (I cannot paste links but searching for the error brings this up). I see errors like these in the log of clients: ERRO shared/signal/client/grpc.go:416: Stream receive error: rpc error: code = Internal desc = stream terminated by RST\_STREAM with error code: INTERNAL\_ERROR Is anybody aware of a way to increase the timeout in pangolin? ---
**Author:** ![hhf.technoloy](https://forum.hhf.technology/user_avatar/forum.hhf.technology/hhf.technoloy/32/68_2.png) [@hhf.technoloy](https://forum.hhf.technology/u/hhf.technoloy)\ **Post date:** [April 21, 2026, 9:54pm UTC](https://forum.hhf.technology/t/netbird-pangolin-pangolin-as-reverse-proxy-for-netbird-setup-guide/4274/6 "2026-04-21T21:54:48Z")
> [@f3r0x](#): > > I have the same setup and setup and I believe the gprc timeout beeing to short in pangolin is causing some issues as described here as well for nginx as well (I cannot paste links but searching for the error brings this up). > > I see errors like these in the log of clients: > ERRO shared/signal/client/grpc.go:416: Stream receive error: rpc error: code = Internal desc = stream terminated by RST\_STREAM with error code: INTERNAL\_ERROR > > Is anybody aware of a way to increase the timeout in pangolin? In your Traefik **static config** (usually `traefik_config.yml`), bump the responding timeouts on the entrypoint that handles your traffic (websecure routes). Example: ```yaml entryPoints: websecure: # ... your existing settings ... http: # ... transport: respondingTimeouts: readTimeout: 1h # or 30m / whatever your gRPC streams need writeTimeout: 1h idleTimeout: 1h # this is the big one for long-lived streams ``` (Some people also tweak `serversTransport.respondingTimeouts` globally if you’re using a custom transport.) If you’re using dynamic config from Pangolin (the HTTP provider endpoint), make sure your static config still overrides the timeouts—dynamic config can’t change these. Restart Traefik after the change and test the gRPC client again. ### Other things to try - **Client-side gRPC keepalive** (if your client library allows it): Most gRPC clients (Go, etc.) let you set `KeepaliveParams` with a short ping interval (e.g., every 10–30s) and a timeout. This prevents the connection from ever going fully idle. - **Rule out Cloudflare/CDN in front** : If anything is proxying Pangolin externally, disable its idle timeout or enable WebSocket/gRPC support (many default to 30–100s idle). ---
**Author:** ![codewhiz](https://forum.hhf.technology/user_avatar/forum.hhf.technology/codewhiz/32/2365_2.png) [@codewhiz](https://forum.hhf.technology/u/codewhiz)\ **Post date:** [July 15, 2026, 4:12am UTC](https://forum.hhf.technology/t/netbird-pangolin-pangolin-as-reverse-proxy-for-netbird-setup-guide/4274/7 "2026-07-15T04:12:23Z")
If you are on Linux, then this might be the fix for your problem: > > > Hello, > I started using Netbird yesterday on my linux machine. It was working fi…ne, but once i restarted my machine it displays the message "2023-08-03T10:19:37+01:00 WARN client/cmd/root.go:187: retrying Login to the Management service in 1.098619925s due to error rpc error: code = Unknown desc = getting pkce authorization flow info failed with error: context deadline exceeded" when i run "sudo netbird up" even with my setup-key. I tried uninstall/reinstall but nothing worked. Can you help please ? > > > Steps to reproduce the behavior: > 1. Install Netbird > 2. sudo netbird up > 3. restart machine > 4. sudo netbird up > 5. 2023-08-03T10:19:37+01:00 WARN client/cmd/root.go:187: retrying Login to the Management service in 1.098619925s due to error rpc error: code = Unknown desc = getting pkce authorization flow info failed with error: context deadline exceeded > > The expected behavior is to have the same as yesterday when i installed it. I expected it to display "connected" after i run the command "sudo netbird up". > > \*\*NetBird status -d output:\*\* > Daemon status: LoginFailed > > Run UP command to log in with SSO (interactive login): > > netbird up > > If you are running a self-hosted version and no SSO provider has been configured in your Management Server, > you can use a setup-key: > > netbird up --management-url \ --setup-key \ > > More info: https://www.netbird.io/docs/overview/setup-keys > > \*\*Screenshots\*\* > !\[image\](https://github.com/netbirdio/netbird/assets/86080510/9e4eed4b-46e1-4925-af80-49e63361f5c8) > !\[image\](https://github.com/netbirdio/netbird/assets/86080510/2f994e60-a727-4a79-b1b9-3ee5e2618be5) > > > > Thanks for help > 1. Stop the Netbird Service > You’ve already stopped the service, but you can confirm it’s inactive with: > > ```auto > sudo systemctl stop netbird > sudo systemctl disable netbird > > ``` > > 1. Remove Netbird Files > Use these commands to remove Netbird’s files and directories: > > ```auto > sudo rm -rf /usr/local/bin/netbird > sudo rm -rf /etc/netbird > sudo rm -rf /var/lib/netbird > > ``` > > 1. Uninstall Netbird if Installed via apt > If you used apt to install Netbird, you can also remove it with: > > `sudo apt remove netbird -y` > 4. Reinstall Netbird > Now, reinstall Netbird: > > ```auto > curl -fsSL https://pkgs.netbird.io/install.sh | sudo bash > sudo apt update > sudo apt install netbird -y > > ``` > > Finally, start Netbird again: > > `sudo netbird up` > > Worked for me