Stupid NetBird Tricks

I’ve enjoyed following the development of NetBird. Once in a while, I’ll start working on a feature I’m interested in. A few days later, I’ll run across a branch where they are close to shipping that feature. The development happens in the open!

The WASM client is typically used within the NetBird dashboard for remote RDP & SSH access. By running NetBird in the browser, web-based RDP & SSH clients can connect to remote resources through the NetBird relay infrastructure.

netbird-wasm

Out of the box, the WASM client speaks ICMP, HTTP, WebSocket, SSH, and RDP. To extend this, I added support for raw TCP and UDP to the NetBird WASM client. This opens the door to doing some truly unhinged things.

The new client gets wrapped in a little TypeScript library. This has shared logic for using the client and also ships with the extremely large ~60MB netbird wasm client.

Hosting HTTP, SSH, DNS, and NTP in the browser

With the TCP/UDP hooks in the netbird-wasm client, we can host things like HTTP, DNS, SSH, and NTP servers. So let’s do all of that.

Claude, make some servers!

netbird-wasm joins the NetBird network through a WebSocket relay. Traffic is encapsulated via WireGuard. NetBird Reverse Proxy makes the tab internet routable!

Safari on an iPad with 5G can host all of these services. HTTP, SSH, NTP, and DNS are all routable through NetBird Reverse Proxy to the NetBird peer running in a browser tab.

Within the tab, packets are sent from the netbird-wasm worker to the peer-webserver worker over MessageChannel. Another Go application hosts the various servers. A shim provides socket level access to these servers via the netbird relay.

Services

The tab joins the NetBird Network just like any other peer. A NetBird Setup Key authorizes the peer to join the network. Access Control Policies control communication between other peers.

HTTP

The HTTP server serves a simple about page with statistics. Golang’s net/http is used to host the page. Stats are streamed via WebSocket/SSE.

SSH

DNS

karl@mba ~ % dig @ipad.allday.mcgriddl.es clockclub.net

; <<>> DiG 9.10.6 <<>> @ipad.allday.mcgriddl.es clockclub.net
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 53601
;; flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;clockclub.net.			IN	A

;; ANSWER SECTION:
clockclub.net.		60	IN	A	3.166.192.88
clockclub.net.		60	IN	A	3.166.192.98
clockclub.net.		60	IN	A	3.166.192.124
clockclub.net.		60	IN	A	3.166.192.60

;; Query time: 352 msec
;; SERVER: 3.14.195.16#53(3.14.195.16)
;; WHEN: Sun Aug 09 20:07:06 EDT 2026
;; MSG SIZE  rcvd: 158

CoreDNS is used as a library to provide DNS functionality. DNS requests to the tab are fetched from Cloudflare using DoH.

NTP

karl@mba ~ % sntp ipad.allday.mcgriddl.es
-0.002524 +/- 0.039970 ipad.allday.mcgriddl.es 3.14.195.16

time.Now() within WASM/go is mapped to Date.now() in the browser. A very basic NTP implementation provides the time.

Diagnostics

The NetBird client already includes pcap capture. The netbird-wasm patch makes this accessible via wasm. Pcaps can be captured and exported.

Switchboard

NetBird-WASM establishes connections to the switch through a remote NetBird Peer. Standard NetBird access control policies grant access between the browser and the remote management network. Through this connection, Switchboard can interact with the remote switch via gNMI, SSH, and HTTP.