Why: CT124 observed "Connecting" from iPhone for hours while
CT124 self-reported Connected. Root cause: DNS timeout ~7h earlier
broke management gRPC, daemon didn't auto-recover after DNS returned.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Discovered while deploying NetBird on CT124 (which already runs
Tailscale in kernel mode). Tailscale's ts-input/ts-forward chains
drop all 100.64.0.0/10 traffic not coming from tailscale0, and since
NetBird uses 100.71.0.0/16 (within that CGNAT range), its wt0
traffic gets silently dropped.
Captured:
- Symptom recognition (Connected in status but 100% ping loss)
- Distinguishing when it hits (kernel-mode Tailscale vs userspace)
- Fix: iptables-legacy -I INPUT/FORWARD allow rules on wt0
- Persistence: systemd oneshot + /usr/local/sbin script
(iptables-persistent doesn't cover the legacy table)
Document the operational patterns established while adding CT100 and
CT101 as peers via Docker, plus incidental fixes:
- Docker compose template for headless peer containers
- One-off setup key naming convention and API creation
- Peer rename via API PUT (works, unlike setup keys)
- Mac daemon kickstart via 'sudo launchctl kickstart -k system/netbird'
(service name is 'netbird', not 'io.netbird.client')
- UPNP auto-port-mapping discovery in NetBird client
- CT100 PermitRootLogin drop-in override (first-match-wins sshd quirk)
