geo blocking by country blocks local IP

[gdechene]

Describe the problem

Hello,
I selfhost netbird and I use the reverse proxy. I configured the urls to be accessible only in France. The issue is when I try to connect to service at home, I have the IP 192.168.1.254, which is not France, and I receive a Forbidden response.
Here the logs
netbird-proxy] 2026-03-26T05:26:19.895Z DEBG proxy/internal/auth/middleware.go:100: checking authentication for host: music.netbird.mydomain.fr, exists: true
[netbird-proxy] 2026-03-26T05:26:19.896Z DEBG proxy/internal/auth/middleware.go:201: IP restriction: country_restricted for 192.168.1.254:60856

To Reproduce

Steps to reproduce the behavior:

1. Configure geo blocking on a service
2. Allow only your country
3. Connect to the service at home
4. See error

Expected behavior

I expect to access my service when I am at home.
The existing geoblocking middleware in traefik plugins allows to specify ip and ip range to bypass the geo blocking restrictions, it should be great to have the same with an env variable for example?
I can't apply geoblocking by country if I can't access services at home.

Are you using NetBird Cloud?

Self-host NetBird's control plane.

NetBird version

0.67.0

NetBird status -d output:

If applicable, add the `netbird status -d' command output.

Screenshots

Additional context

Add any other context about the problem here.

[gdechene]

I added also the local range ip ie 192.168.1.0/24 and I had the same issue

[mlsmaycon]

The behavior you describe is consistent with the proxy not seeing your real IP. When it evaluates rules against the wrong address:

• "Allow only" sets a default-deny policy: your IP must match to be allowed. If the proxy sees a different IP, it won't match, so everything gets blocked.
• "Block" keeps a default-allow policy: only matching IPs are rejected. If the proxy sees a different IP, nothing matches the blocklist, so everything passes through.

This applies to both country and IP rules. Check whether your infrastructure (load balancer, ingress controller) is forwarding the real client IP to the proxy.

[gdechene]

hello, thanks for your reply. My home box does NAT loopback / hairpin. Or I see if I can fix it with my box, or a whitelist should be great. I keep you in touch. Thanks

[gdechene]

I self host Netbird at home on a raspberry, not in a VPS. So, my IP will always be local when I connect to my services at home.

[LordJuice1]

I don't think I'm having a hairpin cause my problem. But I'm running into a similar situation with adding geo location blocking. I thought allowing the 100.64.0.0/16 range would help. But it doesn't seem to

[gdechene]

Ues I tried docker ip range and home ip range, it requires a french ip for me.
The solution should be to use netbird in the cloud and it will work well. But if I want to self host it at home and not on a vps...

[PowershellScripter]

@gdechene This sounds like a NAT loopback issue. Since your device never leaves your network, your Public IP is never evaluated by the proxy service. Alongside the default "Allow Country", can you add an additional rule to "Allow CIDR" and add your local home subnet?
Since any external device trying to connect will always present a public IP to evaluate, they can never use the CIDR allow list for your local subnet. If your proxy has the X-Forwarded-For middleware, it will expose a clients true IP (which should be your home network IP, not the docker range), thus not blocking your home network.

[gdechene]

Hello,
I tried but it does not work. It is an AND. And french ip and cidr ip

[NDebx]

@gdechene I'm having the same issue :(

Tried to allow only france, netherlands and germany. But it also blocks my internal oidc solution behind netbird's reverse proxy. Pangolin doesn't has this issue, but I guess it's part of the Beta?

[NDebx]

@gdechene I tried to allow france, netherlands, germany and the Docker subnet. But that didn't worked, did you found a temp solution?

[gdechene]

Hello,
Right now no.
I am waiting the deployment of crowdsec functionality which will include normally whitelist range ips

[logancarlile97]

I wanted to add to this. I am experiencing the same issue. However, for me it happens when my client device is connected to netbird network. When adding a second allow rule for the netbird cidr range "100.91.0.0/16" the connection is still blocked. However once the second allow rule is added then public ip addresses in my country begin getting blocked because they are not within the ip range. It appears that the access control rules must all be true with no ability to change it to an or evaluation.

[NDebx]

@logancarlile97 It's annoying right. Logically it should be working :(