Related to #5812, but with a different root cause — confirmed disableClientRoutes: false via netbird debug config, so this is not the same "DisableClientRoutes" misconfiguration that closed that issue.
Describe the problem:
On macOS, a domain-based Network Resource (e.g. example.com, address type "Domain") shows as Status: Selected in netbird networks list, with correctly resolved IPs listed under "Resolved IPs" — but no corresponding host route is ever written to the macOS routing table. Traffic to those resolved IPs continues to flow via the default gateway instead of the NetBird interface.
CIDR-based Network Routes on the same client work correctly (LAN routes to 192.168.x.x/24 are properly installed on utun100). Only DNS/domain-based resource routes fail to install.
To Reproduce:
- Create a Network in the NetBird dashboard with a Domain-type Resource (e.g.
example.com)
- Assign a Linux routing peer with Masquerade enabled
- Create an Access Control Policy: Source = macOS client's group, Destination = the domain resource, enabled, no posture checks
- Connect the macOS client
- Run
netbird networks list -> Status shows Selected, Resolved IPs populated correctly
- Run
netstat -rn | grep <resolved-ip> -> no entry
- Run
route -n get <resolved-ip> -> shows default gateway/interface, not the NetBird utun interface
traceroute <resolved-ip> -> goes via default gateway, not via utun
Expected behavior:
A host route for each resolved IP should be installed in the macOS routing table via the NetBird interface, same as CIDR routes.
Additional context:
- The same Policy/Resource works correctly on an Android client on the same account — route installs and traffic is properly routed via the routing peer. This isolates the bug to the macOS client's domain-route -> OS-route installation step.
netbird networks deselect <resource> followed by netbird networks select <resource> does not fix it.netbird down / netbird up (reconnect) does not fix it.
Debug config (relevant fields):
{
"disableDns": false,
"disableClientRoutes": false,
"disableServerRoutes": false,
"blockLanAccess": false,
"networkMonitor": true
}
Environment:
- OS: macOS 26.6.1 (Tahoe), Build 25G76, Apple Silicon
- Daemon version: 0.77.0
- CLI version: 0.77.0
- Interface type: Userspace
- Routing peer OS: Ubuntu 24.04
- Routing peer NetBird version: 0.77.0
- Self-hosted management, dashboard v2.91.1
Related to #5812, but with a different root cause — confirmed
disableClientRoutes: falsevianetbird debug config, so this is not the same "DisableClientRoutes" misconfiguration that closed that issue.Describe the problem:
On macOS, a domain-based Network Resource (e.g.
example.com, address type "Domain") shows asStatus: Selectedinnetbird networks list, with correctly resolved IPs listed under "Resolved IPs" — but no corresponding host route is ever written to the macOS routing table. Traffic to those resolved IPs continues to flow via the default gateway instead of the NetBird interface.CIDR-based Network Routes on the same client work correctly (LAN routes to 192.168.x.x/24 are properly installed on utun100). Only DNS/domain-based resource routes fail to install.
To Reproduce:
example.com)netbird networks list-> Status showsSelected, Resolved IPs populated correctlynetstat -rn | grep <resolved-ip>-> no entryroute -n get <resolved-ip>-> shows default gateway/interface, not the NetBird utun interfacetraceroute <resolved-ip>-> goes via default gateway, not via utunExpected behavior:
A host route for each resolved IP should be installed in the macOS routing table via the NetBird interface, same as CIDR routes.
Additional context:
netbird networks deselect <resource>followed bynetbird networks select <resource>does not fix it.netbird down/netbird up(reconnect) does not fix it.Debug config (relevant fields):
Environment: