Added a plugin for Netbird

[Gauss23]

This is an initial version of a plugin for Netbird.

I've also created a pull request for the Netbird port, as a small patch is currently needed.

https://netbird.io/

[hrfried]

Thank you for doing this—was considering taking a hack at a netbird plugin since I also packaged/maintain it for openSUSE..but I'm very glad someone else did it. :) Really really hope it gets merged soon.

[fichtner]

@hrfried actually we're making it a requirement to have it included in FreeBSD ports first opnsense/ports#218 (comment)

If you know some ins and outs for maintaining a package maybe you can help out here too :)

[Gauss23]

I reached out to the Netbird team to see if they have any objections on me adding the port to FreeBSD. No answer yet.
Maybe I‘ll add it and do the handover later, when Netbird wants to maintain it?

[fichtner]

From experience, authors do not maintain ports and packages for varying reasons and there should be no harm to go ahead with it indeed as it is in the interest of the authors, too.

Cheers,
Franco

[mimugmail]

Just do it, I was also maintaining Cacti port for long time not beeing the main dev over there :)

[Gauss23]

Ok, out of nowhere the Netbird now submitted Netbird to the FreeBSD Ports. But they have chosen security/netbird, Tailscale is also in security/. I was using net/ because I oriented on Zerotier, which is there.

I think it needs to be consistent, right? Port is security/netbird, then the plugin would also be security/netbird?

I would need to recreate the pull request. Did you maybe already had a chance to review the code for bigger issues? I would be happy to fix them.

[fichtner]

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=284877 looks like a netbird employee, oh well :)

yes, let's align with security/netbird then. it will save a lot of confusion later.

[Gauss23]

Update: the port request was accepted.

How can we proceed here?

Do we need to change the category from network to security like in the ports tree?

[fichtner]

It's now in our tree via opnsense/ports@9521b10081 -- let me make a quick review here and then the process is to add the port to ports.conf in tools.git and get the plugin merged too

[mlsmaycon]

@KeenanFalcon I am from NetBird's team. We are looking into OPNSense now and would like to help move this forward. We just finished the PFsense version and would like to add a few UI changes from that version into the work you are doing.

Would it be ok to fork and open a PR to your fork, or would it be better to open the PR directly to the plugin's repo?

[ditronicos]

@KeenanFalcon I am from NetBird's team. We are looking into OPNSense now and would like to help move this forward. We just finished the PFsense version and would like to add a few UI changes from that version into the work you are doing.

Would it be ok to fork and open a PR to your fork, or would it be better to open the PR directly to the plugin's repo?

I think to open the PR directly to the plugin's repo will be the right choice.

[KeenanFalcon]

@KeenanFalcon I am from NetBird's team. We are looking into OPNSense now and would like to help move this forward. We just finished the PFsense version and would like to add a few UI changes from that version into the work you are doing.

Would it be ok to fork and open a PR to your fork, or would it be better to open the PR directly to the plugin's repo?

I have been away some time with my son, so i haven't had much time on the computer lately. But i have looked a little bit more in to rearranging the UI.
I just need to get an overview of my latest changes, then i will push them the repo.

I'm not sure what approach will be best, but your are welcome to make an PR to my Repo, so the plugin maybe are more clean and closer to the finished plugin before making an PR directly to the plugin's repo.

Is it only for the UI that your have some suggestions, or have you also been looking into the backend?

[mlsmaycon]

@KeenanFalcon I am from NetBird's team. We are looking into OPNSense now and would like to help move this forward. We just finished the PFsense version and would like to add a few UI changes from that version into the work you are doing.
Would it be ok to fork and open a PR to your fork, or would it be better to open the PR directly to the plugin's repo?

I have been away some time with my son, so i haven't had much time on the computer lately. But i have looked a little bit more in to rearranging the UI. I just need to get an overview of my latest changes, then i will push them the repo.

I'm not sure what approach will be best, but your are welcome to make an PR to my Repo, so the plugin maybe are more clean and closer to the finished plugin before making an PR directly to the plugin's repo.

Is it only for the UI that your have some suggestions, or have you also been looking into the backend?

We are looking at both. There might be some installation and a restart. We would also like to maintain the plugin moving forward.

[Gauss23]

I would be more than happy to see Netbird picking up the development and maintenance of the plugin.
But I'm surprised. The pfSense has a completely different UI.
The current Netbird plugin in this PR looks like that (in fact the current version is more polished and has more options, like DNS):

I think the boxes for "Disable client routes" and "Disable custom routing" are really important for some people.

Would your idea be to pick it up from there or to create something based on the pfSense plugin?

[fichtner]

Last round of review questions is still open. It would be good to bring this over the finish line first. Anyone can work on the next steps afterwards.

[mlsmaycon]

@Gauss23 by following PFSense GUI, we mean more on split authentication and settings and have a more clear text status page. See some examples:

In any case, this is a work in progress.

We intend to follow @fichtner last comment and help @Gauss23 finish the PR by addressing the comments, then we can join forces with @KeenanFalcon to apply the UI changes above. Let us know if this doesn't make any sense.

[Gauss23]

The open points would be:

• moving to configd instead of writing the config directly
• some case issues: Added a plugin for Netbird #4531 (comment)
• some linting needed: Added a plugin for Netbird #4531 (comment)
• decision on how to detect the OS: Added a plugin for Netbird #4531 (comment)
• and another case issue: Added a plugin for Netbird #4531 (comment)

I'm currently covered in work, so I would not be sad, if someone could provide fixes, I can implement them in this PR.

[fichtner]

opnsense/tools@13ec1f17c9bb is done so I think w should merge this before proceeding with more changes outside this initial PR scope

[fichtner]

@Gauss23 if you say it's ready I'll merge it

[Gauss23]

I would need to build the plugin again after all those changes to see if it works. Hope to find some time this evening (Berlin time). Wouldn't mind if someone else is able to build it and test it, maybe someone from the Netbird team?

[fichtner]

Everyone can test on master branch then ;) Thanks!

[fichtner]

FYI

9b67a27280e
449aed1ec7a
0894c205b74

I can't test this in detail, but I'd rather want to consolidate this now than clogging up future PRs. I'll have more time to look at this after 25.7 is out next week.

[Gauss23]

I just started a fresh OPNsense installation and was building the plugin. There was an error after running the initial setup with the setup-key. Apart from the message it seems to run. At least as long as you don't change the config. The path for the config file seemed to have changed. Now it's: /var/db/netbird/config.json. I think this needs some polishing.

As expected, it registers as Linux in the Netbird management console.

Messages during initial setup.

Waiting for PIDS: 29319.
Deleting old configuration file
Starting netbird.
2025-07-19T20:21:38Z INFO ./caller_not_available:0: 2025/07/19 20:21:38 WARNING: [core] [Channel #1 SubChannel #2]grpc: addrConn.createTransport failed to connect to {Addr: "/var/run/netbird.sock", ServerName: "localhost", Attributes: {"<%!p(networktype.keyType=grpc.internal.transport.networktype)>": "unix" }, }. Err: connection error: desc = "transport: Error while dialing: dial unix /var/run/netbird.sock: connect: no such file or directory"
2025/07/19 20:21:42 failed to increase receive buffer size (wanted: 7168 kiB, got 41 kiB). See https://github.com/quic-go/quic-go/wiki/UDP-Buffer-Sizes for details.
Connected

[Gauss23]

I just tried to change the file name for the config file in /mvc/app/controllers/OPNsense/Netbird/Api/ServiceController.php to the config.json in /var/db but as expected that won't work as those files are owned by root and changing the file from the controller directly is not allowed. What would be needed to change from direct file writes to the configd approach?

[sheridans]

Leave the file where it is, it's recommended location for for FreeBSD? If they can support the rc config as tailscale does, that would be the approach.

[KeenanFalcon]

I just started a fresh OPNsense installation and was building the plugin. There was an error after running the initial setup with the setup-key. Apart from the message it seems to run. At least as long as you don't change the config. The path for the config file seemed to have changed. Now it's: /var/db/netbird/config.json. I think this needs some polishing.

As expected, it registers as Linux in the Netbird management console.

Messages during initial setup.

Waiting for PIDS: 29319.
Deleting old configuration file
Starting netbird.
2025-07-19T20:21:38Z INFO ./caller_not_available:0: 2025/07/19 20:21:38 WARNING: [core] [Channel #1 SubChannel #2]grpc: addrConn.createTransport failed to connect to {Addr: "/var/run/netbird.sock", ServerName: "localhost", Attributes: {"<%!p(networktype.keyType=grpc.internal.transport.networktype)>": "unix" }, }. Err: connection error: desc = "transport: Error while dialing: dial unix /var/run/netbird.sock: connect: no such file or directory"
2025/07/19 20:21:42 failed to increase receive buffer size (wanted: 7168 kiB, got 41 kiB). See https://github.com/quic-go/quic-go/wiki/UDP-Buffer-Sizes for details.
Connected

I ran in to the same error when i tried to install and run the plugin, and i have seen the part about the buffer size before.
Was the service running when your tried? What version of OPNsense are you testing it on, stable or developer?

My template for "/etc/rc.conf.d/netbird" as looking like this.

{% if helpers.exists('OPNsense.netbird.general.Enabled') and OPNsense.netbird.general.Enabled|default("0") == '1' %}
netbird_enable="YES"
{% else %}
netbird_enable="NO"
{% endif %}
netbird_config_file="/usr/local/etc/netbird/config.json"
netbird_log_file="syslog"
netbird_log_level="info"

Maybe @sheridans can give an offer on whether it's safe to increase the UDP-Buffer-Size?
And as you have made the plugin for Tailscale, perhaps you can tell if it also use wireguard connections, because i have noticed that netbird's connections are showing up on the wireguard status page, but i haven't seen that with tailscale connections.

[Gauss23]

I was testing on the newest 25.1.11.

Maybe the service was not enabled yet, when running the setup. Something we should be able to check, right?

I don't know who changed the config path. When I created the PR, Netbird was using the path /usr/local/etc/netbird/config.json. But for some reason the running daemon on my test-box was now using /var/db/netbird/config.json. Netbird version 0.49 from the official source.

It would be great if someone else could pick up the plugin from here. Ideally someone from the Netbird team.

[sheridans]

You're right, the location was changed. During FreeBSD port submission, it was decided /var/db was a better location to keep inline with FreeBSD.

[KeenanFalcon]

Yes we have talked about that they changed location before. But what are the best location seen from OPNsense's perspective, in regards to backups and when being in HA Carp mode?
I know that they are working on something from the Netbird team, and i been working something too.

[Monviech]

The HA only syncs the config.xml section, not any other files on disk.

E.g.:
https://github.com/opnsense/core/blob/05e329de087acb3ebe5f957d0dabf2e0a9a85c37/src/etc/inc/plugins.inc.d/dnsmasq.inc#L82

[QuantumCorral]

Hello everyone,

Is it possible to implement a function like “Disable Routes”, similar to what’s available in the WireGuard server?

I’d like to use Netbird as a VPN backend for OSPF and BGP. For that to work, all IPs need to be allowed, but Netbird should not inject any routes into the system.

Additionally, I’ve noticed that if a network is not directly connected to the OPNsense, for example, if it’s behind another router and reachable via a static route configured in OPNsense, it does not get routed through the VPN.

[SirAry]

Hi, guys, how can I install the plugin in opnsense 25.7.1_1? cannot find it in plugins. What I must do?