Turn open-source feedback into backlog-ready tickets

A prototype of how a Technical Product Owner can triage public GitHub issues from netbirdio/netbird and netbirdio/dashboard. Read-only: nothing is ever written to GitHub. See the case study on issue #5513.

Filter and categorizeBugs, reliability, UX, docs, and feature requests, with the evidence shown.
Prioritize transparentlyEditable impact, urgency, and effort. Suggestions are labelled as unverified.
Draft the ticketProblem, user story, acceptance criteria, and QA scenarios from a fixed template.

Live data from the public GitHub API, cached up to 15 minutes. Last refreshed 19 Oct 2026, 13:56 UTC.

Repository

Sort by

Badge key: a solid category badge comes from a GitHub label; a dashed one is inferred from wording and may be wrong. One issue can have several categories.

Possible themes (7)

Issues grouped by shared wording, not by meaning. A theme can miss issues phrased differently or group unrelated ones that share jargon, so read the issues before treating them as one problem. Choose a theme to filter the list to its issues.

Showing 43 of 43 issues

Higher
8.3 priority score
netbird#7215Created 15 Aug 202615 comments
Reliability (inferred from wording)
Medium
6.7 priority score
netbird#4364Created 18 Aug 202549 comments
Bug (inferred from wording)triage-needed
Medium
6.7 priority score
netbird#5517Created 5 Mar 202635 comments
Reliability (inferred from wording)triage-needed
Medium
6.7 priority score
netbird#5646Created 21 Mar 202626 comments
Bug (inferred from wording)Reliability (inferred from wording)triage-needed
Medium
6.7 priority score
netbird#5143Created 20 Jan 202617 comments
Bug (inferred from wording)triage-needed
Medium
6.7 priority score
netbird#7197Created 13 Aug 20266 comments
Reliability (inferred from wording)
Medium
5.0 priority score
netbird#6022Created 28 Apr 20264 comments
Reliability (inferred from wording)triage-needed
Medium
4.0 priority score
netbird#5450Created 25 Feb 202628 comments
Feature request (from a GitHub label)feature-request
Medium
4.0 priority score
dashboard#412Created 9 Sept 202422 comments
Feature request (from a GitHub label)UX (inferred from wording)needs-triagefeature-request
Medium
4.0 priority score
netbird#1096Created 20 Aug 202320 comments
Feature request (from a GitHub label)feature-request
Medium
4.0 priority score
dashboard#398Created 4 Jul 20244 comments
Bug (from a GitHub label)bugself-hosted
Medium
4.0 priority score
netbird#3540Created 19 Mar 20253 comments
Bug (inferred from wording)triage-needed
Medium
3.0 priority score
netbird#5616Created 17 Mar 20265 comments
Uncategorizedtriage-needed
Medium
3.0 priority score
netbird#5972Created 23 Apr 20262 comments
Reliability (inferred from wording)triage-needed
Medium
3.0 priority score
netbird#5800Created 4 Apr 20262 comments
Bug (inferred from wording)Documentation (inferred from wording)triage-needed
Medium
3.0 priority score
dashboard#690Created 29 Jun 20261 comments
Bug (inferred from wording)needs-triage
Medium
3.0 priority score
dashboard#617Created 20 Apr 20261 comments
Bug (inferred from wording)Reliability (inferred from wording)needs-triage
Medium
3.0 priority score
dashboard#685Created 27 Jun 20260 comments
Reliability (inferred from wording)UX (inferred from wording)needs-triage
Lower
2.0 priority score
netbird#5066Created 8 Jan 20264 comments
Uncategorizedtriage-needed
Lower
2.0 priority score
netbird#7372Created 31 Aug 20263 comments
Feature request (from a GitHub label)enhancement
Lower
2.0 priority score
netbird#7152Created 11 Aug 20263 comments
Feature request (from a GitHub label)enhancementbackendsupport
Lower
2.0 priority score
netbird#3457Created 7 Mar 20252 comments
UX (inferred from wording)triage-needed
Lower
2.0 priority score
dashboard#768Created 20 Aug 20261 comments
Feature request (from a GitHub label)UX (inferred from wording)needs-triagefeature-request
Lower
2.0 priority score
dashboard#632Created 5 May 20261 comments
Feature request (from a GitHub label)needs-triagefeature-request
Lower
2.0 priority score
dashboard#667Created 14 Jun 20261 comments
UX (inferred from wording)
Lower
2.0 priority score
dashboard#813Created 23 Sept 20260 comments
Uncategorizedneeds-triage
Lower
2.0 priority score
dashboard#810Created 23 Sept 20260 comments
Feature request (from a GitHub label)needs-triagefeature-request
Lower
2.0 priority score
dashboard#778Created 27 Aug 20260 comments
Bug (inferred from wording)needs-triage
Lower
2.0 priority score
dashboard#655Created 31 May 20260 comments
Bug (inferred from wording)needs-triage
Lower
2.0 priority score
dashboard#652Created 26 May 20260 comments
Bug (inferred from wording)needs-triage
Lower
1.3 priority score
dashboard#406Created 2 Aug 20244 comments
Feature request (from a GitHub label)needs-triagefeature-request
Lower
1.3 priority score
dashboard#713Created 15 Jul 20262 comments
Feature request (from a GitHub label)needs-triagefeature-request
Lower
1.3 priority score
dashboard#618Created 21 Apr 20261 comments
Uncategorizedneeds-triage
Lower
1.3 priority score
dashboard#481Created 8 Aug 20251 comments
Feature request (from a GitHub label)needs-triagefeature-request
Lower
1.3 priority score
dashboard#777Created 27 Aug 20260 comments
UX (inferred from wording)
Lower
1.3 priority score
dashboard#763Created 14 Aug 20260 comments
Feature request (from a GitHub label)needs-triagefeature-request
Lower
1.3 priority score
dashboard#742Created 3 Aug 20260 comments
UX (inferred from wording)
Lower
1.3 priority score
dashboard#720Created 19 Jul 20260 comments
Uncategorizedneeds-triage
Lower
1.3 priority score
dashboard#705Created 9 Jul 20260 comments
UX (inferred from wording)needs-triage
Lower
1.3 priority score
dashboard#700Created 6 Jul 20260 comments
Feature request (from a GitHub label)UX (inferred from wording)needs-triagefeature-request
Lower
1.3 priority score
dashboard#678Created 24 Jun 20260 comments
Feature request (from a GitHub label)needs-triagefeature-request
Lower
1.3 priority score
dashboard#677Created 24 Jun 20260 comments
Uncategorizedneeds-triage
Lower
1.3 priority score
dashboard#631Created 4 May 20260 comments
Feature request (from a GitHub label)UX (inferred from wording)needs-triagefeature-request

← Back to the issue list

netbirdio/netbird#7215

FreeBSD: route manager installs /32 host routes for peer LAN addresses, shadowing mesh-routed subnets and silently blackholing them

Created: 15 Aug 2026
Updated: 16 Oct 2026
Comments: 15

View the source on GitHub

Categories and labels

Reliability (inferred from wording)
- Inferred from wording (a suggestion): "unreachable/outage" in description; "silently" in title

GitHub labels:none

Description (reporter’s words, shown as plain text)

## Environment

| | |
|---|---|
| NetBird | reproduced on 0.74.4 and 0.76.0 |
| OS | FreeBSD 15.0-RELEASE |
| interface | wt0 |
| not reproduced on | macOS and Linux clients of the same account, with the same peers and the same advertised routes |

## Summary

On FreeBSD, the route manager installs one /32 host route per peer LAN address,
pointed at the local host's own physical default gateway. Where that peer really is on the
local LAN this is correct. Where the peer is at another site — reached over the mesh — the
/32 is more specific than the mesh /24, so it wins, and that single address becomes
unreachable while the rest of the subnet keeps working.

**The trigge…

Long text was shortened by this app. Read the rest on GitHub.

Discussion (15 comments on GitHub)

Loaded only when you ask, to stay within GitHub’s rate limit. Commenter names are not shown; each comment links to the original.

Found by shared wording only, not meaning. It can miss a duplicate that is phrased differently and can link unrelated issues that share jargon. Never treat these as confirmed duplicates.

No other loaded issue shares enough distinctive wording with this one. That does not mean none exists.

Prioritize

Priority = (impact × urgency) ÷ effort. These are planning inputs, not facts.

Higher priority (draft)

8.3

Impact: 5 / 5Suggested (inferred, unverified)

1 · Few users, minor annoyance5 · Many users, or a core flow is blocked

Why is the default 5?

Starts at 2 (unknown).
+1: categorized as a bug or reliability problem (inferred).
+1: 15 public comments (an engagement proxy, not measured user impact).
+1: 15 or more comments suggests many people are affected.

Urgency: 5 / 5Suggested (inferred, unverified)

1 · Can wait for planned work5 · Time-critical, security, or data loss

Why is the default 5?

Starts at 2 (unknown).
+1: wording suggests a severe failure mode (security, crash, outage, silent failure, cannot log in).
+1: a bug/reliability report that several people responded to.
+1: still active (updated within 30 days).

Effort: 3 / 5Suggested (inferred, unverified)

1 · Hours, one engineer5 · Multi-sprint, cross-team

Why is the default 3?

Fixed at 3 (unknown). Effort cannot be inferred from an issue; replace it with an engineering estimate.

Bands: ≥ 8 higher · ≥ 3 medium · below lower. Edits are saved only in this browser.

Ticket draft

Generated from a fixed template (no AI). Edit any section; sections you leave alone keep following your scores.

Ticket title

Harden: FreeBSD: route manager installs /32 host routes for peer LAN addresses, shadowing mesh-routed subnets and silently blackholing them

Problem statement

Reported in netbirdio/netbird#7215 on 15 Aug 2026: "FreeBSD: route manager installs /32 host routes for peer LAN addresses, shadowing mesh-routed subnets and silently blackholing them".

Reporter's description (excerpt, unverified): | | | |---|---| | NetBird | reproduced on **0.74.4** and **0.76.0** | | OS | FreeBSD 15.0-RELEASE | | interface | `wt0` | | not reproduced on | macOS and Linux clients of the **same account**, with the same peers and the same advertised routes |

Draft estimate, not verified: impact 5/5, urgency 5/5, effort 3/5, giving a priority score of 8.3 (Higher).

GitHub labels: none. Category: Reliability.

User story

As an operator running NetBird on long-lived machines, I want the failure described in "FreeBSD: route manager installs /32 host routes for peer LAN addresses, shadowing mesh-routed subnets and silently blackholing them" to be detected and recovered from (or clearly surfaced), so that connectivity does not silently degrade.

Acceptance criteria

Given the failure condition from the report occurs, when the system is affected, then the problem is detected within a defined time bound (to be agreed) instead of failing silently.
Given a detected failure, when automatic recovery is possible, then the system recovers without manual intervention; otherwise it surfaces an actionable status.
Given the system is degraded, when a user or script checks status, then the status reflects the real state rather than reporting healthy.
Diagnostics (logs or metrics) record when the failure was detected and how it was resolved, without leaking secrets.

QA test scenarios

Confirm the report still reproduces
1. Identify the affected component and the version in the report.
2. Retest on the latest supported release, using the reporter's reproduction steps.
Expected: Either the behavior is reproduced (proceed) or it is not (ask the reporter to confirm, then close or re-scope).
Induce the failure and observe detection
1. Create the failure condition from the report (for example expire a session or cut the network).
2. Wait for the agreed detection window.
Expected: The failure is detected and status changes accordingly; nothing keeps reporting healthy.
Recovery without manual action
1. Restore the failed dependency.
2. Observe the system without intervening.
Expected: The system returns to a healthy state on its own, or shows exactly what action is required.
Long-running soak
1. Run the affected component unattended for an extended period with periodic fault injection.
Expected: No resource growth, hangs, or silent degradation.

Assumptions and open questions

The problem has not been reproduced by this tool; it is taken from a single public report.
The reporter's version and environment may be outdated; confirm against the latest release first.
Impact and urgency are suggested defaults or manual edits, not measurements. Effort (3/5) needs an engineering estimate.
The persona in the user story is a template default; adjust it to the real affected audience.

View as Markdown

# Harden: FreeBSD: route manager installs /32 host routes for peer LAN addresses, shadowing mesh-routed subnets and silently blackholing them

> Draft from a deterministic template. Unverified. Source: https://github.com/netbirdio/netbird/issues/7215

## Problem statement

Reported in netbirdio/netbird#7215 on 15 Aug 2026: "FreeBSD: route manager installs /32 host routes for peer LAN addresses, shadowing mesh-routed subnets and silently blackholing them".
Reporter's description (excerpt, unverified): | | | |---|---| | NetBird | reproduced on **0.74.4** and **0.76.0** | | OS | FreeBSD 15.0-RELEASE | | interface | `wt0` | | not reproduced on | macOS and Linux clients of the **same account**, with the same peers and the same advertised routes |
Draft estimate, not verified: impact 5/5, urgency 5/5, effort 3/5, giving a priority score of 8.3 (Higher).
GitHub labels: none. Category: Reliability.

## User story

As an operator running NetBird on long-lived machines, I want the failure described in "FreeBSD: route manager installs /32 host routes for peer LAN addresses, shadowing mesh-routed subnets and silently blackholing them" to be detected and recovered from (or clearly surfaced), so that connectivity does not silently degrade.

## Acceptance criteria

- [ ] Given the failure condition from the report occurs, when the system is affected, then the problem is detected within a defined time bound (to be agreed) instead of failing silently.
- [ ] Given a detected failure, when automatic recovery is possible, then the system recovers without manual intervention; otherwise it surfaces an actionable status.
- [ ] Given the system is degraded, when a user or script checks status, then the status reflects the real state rather than reporting healthy.
- [ ] Diagnostics (logs or metrics) record when the failure was detected and how it was resolved, without leaking secrets.

## QA test scenarios

### 1. Confirm the report still reproduces

1. Identify the affected component and the version in the report.
2. Retest on the latest supported release, using the reporter's reproduction steps.

**Expected:** Either the behavior is reproduced (proceed) or it is not (ask the reporter to confirm, then close or re-scope).

### 2. Induce the failure and observe detection

1. Create the failure condition from the report (for example expire a session or cut the network).
2. Wait for the agreed detection window.

**Expected:** The failure is detected and status changes accordingly; nothing keeps reporting healthy.

### 3. Recovery without manual action

1. Restore the failed dependency.
2. Observe the system without intervening.

**Expected:** The system returns to a healthy state on its own, or shows exactly what action is required.

### 4. Long-running soak

1. Run the affected component unattended for an extended period with periodic fault injection.

**Expected:** No resource growth, hangs, or silent degradation.

## Assumptions and open questions

- The problem has not been reproduced by this tool; it is taken from a single public report.
- The reporter's version and environment may be outdated; confirm against the latest release first.
- Impact and urgency are suggested defaults or manual edits, not measurements. Effort (3/5) needs an engineering estimate.
- The persona in the user story is a template default; adjust it to the real affected audience.

## Environment | | | |---|---| | NetBird | reproduced on 0.74.4 and 0.76.0 | | OS | FreeBSD 15.0-RELEASE | | interface | wt0 | | not reproduced on | macOS and Linux clients of the same account, with the same peers and the same advertised routes | ## Summary On FreeBSD, the route manager installs one /32 host route per peer LAN address, pointed at the local host's own physical default gateway. Where that peer really is on the local LAN this is correct. Where the peer is at another site — reached over the mesh — the /32 is more specific than the mesh /24, so it wins, and that single address becomes unreachable while the rest of the subnet keeps working. **The trigge…

Turn open-source feedback into backlog-ready tickets

Issue triage board

FreeBSD: route manager installs /32 host routes for peer LAN addresses, shadowing mesh-routed subnets and silently blackholing them

DNS not working on IOS

Stuck on issuing certificate

Ghost proxy peers stuck in "Connecting" — not visible in management API or dashboard, cannot be removed

Generic OIDC authentication fails if "name"-claim is missing (no configurable fallback)

Single-account mode silently forks a new account when the existing account has an empty domain (self-hosted, embedded IdP)

NetBird `netbird-acl-forward-filter` drops k3s/kube-router-forwarded VPN traffic due to mark-bit collision with kube-router netpol

Feature Request: Add Let's Encrypt / ACME DNS challenge (DNS-01) support to the Proxy container.

Add Light Theme for Web UI

Support obfuscation to work-around ISP blocking

Auth endpoint returns 404 on successful login

Country block posture checks does not work correctly at all

Reverse proxy stopped working after initially working fine on NetBird Cloud — ERR_SSL_PROTOCOL_ERROR

Windows userspace bind proxy (factory_usp): P2PConnected stuck at 0 for NAT traversal peers despite STUN responses received

Client Secret does not update when changed from the webui

Self-hosted Google OIDC login broken — CSP connect-src omits token endpoint (oauth2.googleapis.com)

Dashboard Logout does not perform OIDC RP-initiated logout — users re-authenticated by silent renewal

DNS Nameserver Group limited to 3 resolvers — blocks dual-stack IPv4+IPv6 redundancy

Service startup blocked waiting for GeoLite2 database download (Request: Async download)

[agent-network] Import agentgateway model-catalog pricing

Support multiple identity connectors mapping to a single user account (native + OIDC merge)

NetBird UI Shows "Connected" in Airplane Mode on Windows

Support for the OIDC prompt feature in the Netbird Dashboard UI

Publish dashboard image to GitHub Container Registry (ghcr.io)

Reverse Proxy service modal strips dots from the subdomain input, blocking nested subdomains the API accepts

Rootless Dashboard uses port 8080 but Traefik configuration still points to port 80

Enable copy on selection in integrated ssh terminal

Self-compiled dashboard fails to load - "Connection closed" in browser console

Skip TLS Verification toggle does not apply correctly on existing service

Settings > Network > IPv6 Enabled Groups: Cannot add "All" group

rootless container

Allow use of the same domain for two services using a different port.

netbird-dashboard docker image missing Crowdsec feature?

Display connected peers for SSO peers without additional authentication

Group selector blocks the main thread ~190 ms per keystroke with ~960 groups (no list virtualization)

Add a delete action to the peer detail page

Generated password modal flashes and disappears when creating a user from an empty group's detail page

Bug: Environment variables not substituted in Dashboard JS assets when Embedded IdP is disabled

Update available button not visible on Android Chrome

Add a button to refresh peers name in case of duplicated peer

More specific audit events

[Bug] Self-hosted Entra ID SSO shows consent prompt on every login due to Dex connector missing promptType

Allow login buttons to be reordered

Turn open-source feedback into backlog-ready tickets

Issue triage board

FreeBSD: route manager installs /32 host routes for peer LAN addresses, shadowing mesh-routed subnets and silently blackholing them

DNS not working on IOS

Stuck on issuing certificate

Ghost proxy peers stuck in "Connecting" — not visible in management API or dashboard, cannot be removed

Generic OIDC authentication fails if "name"-claim is missing (no configurable fallback)

Single-account mode silently forks a new account when the existing account has an empty domain (self-hosted, embedded IdP)

NetBird `netbird-acl-forward-filter` drops k3s/kube-router-forwarded VPN traffic due to mark-bit collision with kube-router netpol

Feature Request: Add Let's Encrypt / ACME DNS challenge (DNS-01) support to the Proxy container.

Add Light Theme for Web UI

Support obfuscation to work-around ISP blocking

Auth endpoint returns 404 on successful login

Country block posture checks does not work correctly at all

Reverse proxy stopped working after initially working fine on NetBird Cloud — ERR_SSL_PROTOCOL_ERROR

Windows userspace bind proxy (factory_usp): P2PConnected stuck at 0 for NAT traversal peers despite STUN responses received

Client Secret does not update when changed from the webui

Self-hosted Google OIDC login broken — CSP connect-src omits token endpoint (oauth2.googleapis.com)

Dashboard Logout does not perform OIDC RP-initiated logout — users re-authenticated by silent renewal

DNS Nameserver Group limited to 3 resolvers — blocks dual-stack IPv4+IPv6 redundancy

Service startup blocked waiting for GeoLite2 database download (Request: Async download)

[agent-network] Import agentgateway model-catalog pricing

Support multiple identity connectors mapping to a single user account (native + OIDC merge)

NetBird UI Shows "Connected" in Airplane Mode on Windows

Support for the OIDC prompt feature in the Netbird Dashboard UI

Publish dashboard image to GitHub Container Registry (ghcr.io)

Reverse Proxy service modal strips dots from the subdomain input, blocking nested subdomains the API accepts

Rootless Dashboard uses port 8080 but Traefik configuration still points to port 80

Enable copy on selection in integrated ssh terminal

Self-compiled dashboard fails to load - "Connection closed" in browser console

Skip TLS Verification toggle does not apply correctly on existing service

Settings > Network > IPv6 Enabled Groups: Cannot add "All" group

rootless container

Allow use of the same domain for two services using a different port.

netbird-dashboard docker image missing Crowdsec feature?