[GH-ISSUE #3744] Peer relay connection fails #7389

Open
opened 2026-08-05 01:12:47 -04:00 by saavagebueno · 1 comment
Owner

Originally created by @qskousen on GitHub (Apr 25, 2025).
Original GitHub issue: https://github.com/netbirdio/netbird/issues/3744

Describe the problem

Two of the clients in a network are unable to access each other, while being able to access all other peers, including ones in the same LAN as one of the problem clients.

To Reproduce

Steps to reproduce the behavior:

  1. Turn on clients
  2. Observe ability to correctly resolve the peer's name
  3. Attempt ping or ssh or telnet
  4. All connection attempts fail

Expected behavior

The clients should be able to contact each other, at least through the relay.

Are you using NetBird Cloud?

Self-hosted

NetBird version

0.42.0 on both affected clients

Is any other VPN software installed?

No

Debug output

netbird status -dA

Output:
Peers detail:
 calebdesktop.anon-L4bT7.domain:
  NetBird IP: 100.83.169.84/32
  Public key: cnzhDHFfHjA/HkZjVc8+DtZCu41C28nb5I3iftukeBg=
  Status: Disconnected
  -- detail --
  Connection type: 
  ICE candidate (Local/Remote): -/-
  ICE candidate endpoints (Local/Remote): -/-
  Relay server address: 
  Last connection update: 1 minute, 45 seconds ago
  Last WireGuard handshake: -
  Transfer status (received/sent) 0 B/0 B
  Quantum resistance: false
  Networks: -
  Latency: 0s

 cbase.anon-L4bT7.domain:
  NetBird IP: 100.83.9.127
  Public key: x47RwlrZDO+4NoFdHivtUOSBZbuRUTOfSFLC3jP2wwE=
  Status: Connected
  -- detail --
  Connection type: Relayed
  ICE candidate (Local/Remote): -/-
  ICE candidate endpoints (Local/Remote): -/-
  Relay server address: rel://net.anon-HaQrr.domain:33080
  Last connection update: 14 seconds ago
  Last WireGuard handshake: -
  Transfer status (received/sent) 444 B/572 B
  Quantum resistance: false
  Networks: -
  Latency: 0s

 qt-mint.anon-L4bT7.domain:
  NetBird IP: 100.83.15.13
  Public key: Tzhq8Bz1PAmk8XTEZaTyKAY0nwWfeBdxb4LiUbH3tUA=
  Status: Connected
  -- detail --
  Connection type: P2P
  ICE candidate (Local/Remote): host/host
  ICE candidate endpoints (Local/Remote): 172.26.64.1:51820/10.0.0.11:51820
  Relay server address: rel://net.anon-HaQrr.domain:33080
  Last connection update: 1 minute, 43 seconds ago
  Last WireGuard handshake: 1 minute, 39 seconds ago
  Transfer status (received/sent) 49.7 KiB/55.8 KiB
  Quantum resistance: false
  Networks: -
  Latency: 401.054µs

 qtdedi.anon-L4bT7.domain:
  NetBird IP: 100.83.73.253
  Public key: 4L2SvsWQltzMNcF13/+pFypi6kr17SxcPFAA2pINDmo=
  Status: Connected
  -- detail --
  Connection type: P2P
  ICE candidate (Local/Remote): srflx/srflx
  ICE candidate endpoints (Local/Remote): 198.51.100.0:51820/198.51.100.1:51820
  Relay server address: rel://net.anon-HaQrr.domain:33080
  Last connection update: 1 minute, 41 seconds ago
  Last WireGuard handshake: 1 minute, 39 seconds ago
  Transfer status (received/sent) 4.2 MiB/4.9 MiB
  Quantum resistance: false
  Networks: -
  Latency: 51.367147ms

Events:
  [INFO] SYSTEM (632cfd48-adda-4bf9-8c9b-d8cb2dda3a13)
    Message: Network map updated
    Time: 4 minutes, 21 seconds ago
  [INFO] SYSTEM (7aed5cec-dc96-4516-8f58-862ffc5cd3bf)
    Message: Network map updated
    Time: 1 minute, 45 seconds ago
OS: linux/amd64
Daemon version: 0.42.0
CLI version: 0.42.0
Management: Connected to https://net.anon-HaQrr.domain:33073
Signal: Connected to http://net.anon-HaQrr.domain:10000
Relays: 
  [stun:net.anon-HaQrr.domain:3478] is Available
  [turn:net.anon-HaQrr.domain:3478?transport=udp] is Available
  [rel://net.anon-HaQrr.domain:33080] is Available
Nameservers: 
FQDN: lydia.anon-L4bT7.domain
NetBird IP: 100.83.83.31/16
Interface type: Kernel
Quantum resistance: false
Networks: 0.0.0.0/0
Forwarding rules: 0
Peers count: 3/4 Connected

Debug file attached as well:

netbird.debug.1136344926.zip

Additional context

These two clients (cbase, lydia in the logs) were formerly able to connect, then stopped working. cbase is still able to connect to qt-mint and vice versa, despite qt-mint being in the same LAN as lydia and having to also use the relay server. I've tried updating, restarting, tailing logs, checking relay config, turning NetBird on and off, checking firewalls, everything I can think of. Thank you for any help.

Have you tried these troubleshooting steps?

  • Checked for newer NetBird versions
  • Searched for similar issues on GitHub (including closed ones)
  • Restarted the NetBird client
  • Disabled other VPN software
  • Checked firewall settings
Originally created by @qskousen on GitHub (Apr 25, 2025). Original GitHub issue: https://github.com/netbirdio/netbird/issues/3744 **Describe the problem** Two of the clients in a network are unable to access each other, while being able to access all other peers, including ones in the same LAN as one of the problem clients. **To Reproduce** Steps to reproduce the behavior: 1. Turn on clients 2. Observe ability to correctly resolve the peer's name 3. Attempt `ping` or `ssh` or `telnet` 4. All connection attempts fail **Expected behavior** The clients should be able to contact each other, at least through the relay. **Are you using NetBird Cloud?** Self-hosted **NetBird version** `0.42.0` on both affected clients **Is any other VPN software installed?** No **Debug output** `netbird status -dA` <details> <summary>Output:</summary> ``` Peers detail: calebdesktop.anon-L4bT7.domain: NetBird IP: 100.83.169.84/32 Public key: cnzhDHFfHjA/HkZjVc8+DtZCu41C28nb5I3iftukeBg= Status: Disconnected -- detail -- Connection type: ICE candidate (Local/Remote): -/- ICE candidate endpoints (Local/Remote): -/- Relay server address: Last connection update: 1 minute, 45 seconds ago Last WireGuard handshake: - Transfer status (received/sent) 0 B/0 B Quantum resistance: false Networks: - Latency: 0s cbase.anon-L4bT7.domain: NetBird IP: 100.83.9.127 Public key: x47RwlrZDO+4NoFdHivtUOSBZbuRUTOfSFLC3jP2wwE= Status: Connected -- detail -- Connection type: Relayed ICE candidate (Local/Remote): -/- ICE candidate endpoints (Local/Remote): -/- Relay server address: rel://net.anon-HaQrr.domain:33080 Last connection update: 14 seconds ago Last WireGuard handshake: - Transfer status (received/sent) 444 B/572 B Quantum resistance: false Networks: - Latency: 0s qt-mint.anon-L4bT7.domain: NetBird IP: 100.83.15.13 Public key: Tzhq8Bz1PAmk8XTEZaTyKAY0nwWfeBdxb4LiUbH3tUA= Status: Connected -- detail -- Connection type: P2P ICE candidate (Local/Remote): host/host ICE candidate endpoints (Local/Remote): 172.26.64.1:51820/10.0.0.11:51820 Relay server address: rel://net.anon-HaQrr.domain:33080 Last connection update: 1 minute, 43 seconds ago Last WireGuard handshake: 1 minute, 39 seconds ago Transfer status (received/sent) 49.7 KiB/55.8 KiB Quantum resistance: false Networks: - Latency: 401.054µs qtdedi.anon-L4bT7.domain: NetBird IP: 100.83.73.253 Public key: 4L2SvsWQltzMNcF13/+pFypi6kr17SxcPFAA2pINDmo= Status: Connected -- detail -- Connection type: P2P ICE candidate (Local/Remote): srflx/srflx ICE candidate endpoints (Local/Remote): 198.51.100.0:51820/198.51.100.1:51820 Relay server address: rel://net.anon-HaQrr.domain:33080 Last connection update: 1 minute, 41 seconds ago Last WireGuard handshake: 1 minute, 39 seconds ago Transfer status (received/sent) 4.2 MiB/4.9 MiB Quantum resistance: false Networks: - Latency: 51.367147ms Events: [INFO] SYSTEM (632cfd48-adda-4bf9-8c9b-d8cb2dda3a13) Message: Network map updated Time: 4 minutes, 21 seconds ago [INFO] SYSTEM (7aed5cec-dc96-4516-8f58-862ffc5cd3bf) Message: Network map updated Time: 1 minute, 45 seconds ago OS: linux/amd64 Daemon version: 0.42.0 CLI version: 0.42.0 Management: Connected to https://net.anon-HaQrr.domain:33073 Signal: Connected to http://net.anon-HaQrr.domain:10000 Relays: [stun:net.anon-HaQrr.domain:3478] is Available [turn:net.anon-HaQrr.domain:3478?transport=udp] is Available [rel://net.anon-HaQrr.domain:33080] is Available Nameservers: FQDN: lydia.anon-L4bT7.domain NetBird IP: 100.83.83.31/16 Interface type: Kernel Quantum resistance: false Networks: 0.0.0.0/0 Forwarding rules: 0 Peers count: 3/4 Connected ``` </details> Debug file attached as well: [netbird.debug.1136344926.zip](https://github.com/user-attachments/files/19914264/netbird.debug.1136344926.zip) **Additional context** These two clients (cbase, lydia in the logs) were formerly able to connect, then stopped working. cbase is still able to connect to qt-mint and vice versa, despite qt-mint being in the same LAN as lydia and having to also use the relay server. I've tried updating, restarting, tailing logs, checking relay config, turning NetBird on and off, checking firewalls, everything I can think of. Thank you for any help. **Have you tried these troubleshooting steps?** - [x] Checked for newer NetBird versions - [x] Searched for similar issues on GitHub (including closed ones) - [x] Restarted the NetBird client - [x] Disabled other VPN software - [x] Checked firewall settings
saavagebueno added the triage-neededself-hosting labels 2026-08-05 01:12:47 -04:00
Author
Owner

@raaron773 commented on GitHub (May 14, 2025):

I also have similar issue. where my wireguard handshake fails
I have 4 peers and it just shows 1/4 connected and obviously, I cannot connect to other peers even though they are running and show online on the dashboard

netbird status -d
Peers detail:
 prometheus.netbird.selfhosted:
  NetBird IP: 100.90.109.208
  Public key: spC2C9soHaTy/y7K70ZM1aJ+xbT34utYFNXXH0jlIQ0=
  Status: Disconnected
  -- detail --
  Connection type: 
  ICE candidate (Local/Remote): -/-
  ICE candidate endpoints (Local/Remote): -/-
  Relay server address: 
  Last connection update: -
  Last WireGuard handshake: -
  Transfer status (received/sent) 0 B/0 B
  Quantum resistance: false
  Networks: -
  Latency: 0s

 netbird.netbird.selfhosted:
  NetBird IP: 100.90.110.104
  Public key: YAh+0JtWSh+46+8dX2earUUebu4ZQPb/vOCFcR9b0Ec=
  Status: Disconnected
  -- detail --
  Connection type: 
  ICE candidate (Local/Remote): -/-
  ICE candidate endpoints (Local/Remote): -/-
  Relay server address: 
  Last connection update: -
  Last WireGuard handshake: -
  Transfer status (received/sent) 0 B/0 B
  Quantum resistance: false
  Networks: -
  Latency: 0s

 belobog.netbird.selfhosted:
  NetBird IP: 100.90.133.102
  Public key: XNhXaQnNcqqByl1u4RS8IV6i9nPeWuLqa5aTWw+h6U4=
  Status: Connected
  -- detail --
  Connection type: P2P
  ICE candidate (Local/Remote): srflx/srflx
  ICE candidate endpoints (Local/Remote): 157.119.42.36:46633/103.178.134.103:51820
  Relay server address: rels://netbird.svarogforge.org:443
  Last connection update: 26 seconds ago
  Last WireGuard handshake: 27 seconds ago
  Transfer status (received/sent) 92 B/212 B
  Quantum resistance: false
  Networks: -
  Latency: 7.324317ms

 dn2101.netbird.selfhosted:
  NetBird IP: 100.90.245.213
  Public key: Jb3mUbrnU6pU0wTu1ohxFbBCvkof4b5DGoI3jrt0+jk=
  Status: Disconnected
  -- detail --
  Connection type: 
  ICE candidate (Local/Remote): -/-
  ICE candidate endpoints (Local/Remote): -/-
  Relay server address: 
  Last connection update: -
  Last WireGuard handshake: -
  Transfer status (received/sent) 0 B/0 B
  Quantum resistance: false
  Networks: -
  Latency: 0s

Events:
  [INFO] SYSTEM (bff533b6-0658-43dd-953b-835b98225af5)
    Message: Network map updated
    Time: 28 seconds ago
OS: linux/amd64
Daemon version: 0.43.3
CLI version: 0.43.3
Management: Connected to https://netbird.svarogforge.org:443
Signal: Connected to https://netbird.svarogforge.org:443
Relays: 
  [stun:netbird.svarogforge.org:3478] is Available
  [turn:netbird.svarogforge.org:3478?transport=udp] is Available
  [rels://netbird.svarogforge.org:443] is Available
Nameservers: 
FQDN: dell-work.netbird.selfhosted
NetBird IP: 100.90.210.148/16
Interface type: Kernel
Quantum resistance: false
Networks: 10.0.0.0/32
Forwarding rules: 0
Peers count: 1/4 Connected
<!-- gh-comment-id:2879219474 --> @raaron773 commented on GitHub (May 14, 2025): I also have similar issue. where my wireguard handshake fails I have 4 peers and it just shows `1/4 connected` and obviously, I cannot connect to other peers even though they are running and show online on the dashboard ``` netbird status -d Peers detail: prometheus.netbird.selfhosted: NetBird IP: 100.90.109.208 Public key: spC2C9soHaTy/y7K70ZM1aJ+xbT34utYFNXXH0jlIQ0= Status: Disconnected -- detail -- Connection type: ICE candidate (Local/Remote): -/- ICE candidate endpoints (Local/Remote): -/- Relay server address: Last connection update: - Last WireGuard handshake: - Transfer status (received/sent) 0 B/0 B Quantum resistance: false Networks: - Latency: 0s netbird.netbird.selfhosted: NetBird IP: 100.90.110.104 Public key: YAh+0JtWSh+46+8dX2earUUebu4ZQPb/vOCFcR9b0Ec= Status: Disconnected -- detail -- Connection type: ICE candidate (Local/Remote): -/- ICE candidate endpoints (Local/Remote): -/- Relay server address: Last connection update: - Last WireGuard handshake: - Transfer status (received/sent) 0 B/0 B Quantum resistance: false Networks: - Latency: 0s belobog.netbird.selfhosted: NetBird IP: 100.90.133.102 Public key: XNhXaQnNcqqByl1u4RS8IV6i9nPeWuLqa5aTWw+h6U4= Status: Connected -- detail -- Connection type: P2P ICE candidate (Local/Remote): srflx/srflx ICE candidate endpoints (Local/Remote): 157.119.42.36:46633/103.178.134.103:51820 Relay server address: rels://netbird.svarogforge.org:443 Last connection update: 26 seconds ago Last WireGuard handshake: 27 seconds ago Transfer status (received/sent) 92 B/212 B Quantum resistance: false Networks: - Latency: 7.324317ms dn2101.netbird.selfhosted: NetBird IP: 100.90.245.213 Public key: Jb3mUbrnU6pU0wTu1ohxFbBCvkof4b5DGoI3jrt0+jk= Status: Disconnected -- detail -- Connection type: ICE candidate (Local/Remote): -/- ICE candidate endpoints (Local/Remote): -/- Relay server address: Last connection update: - Last WireGuard handshake: - Transfer status (received/sent) 0 B/0 B Quantum resistance: false Networks: - Latency: 0s Events: [INFO] SYSTEM (bff533b6-0658-43dd-953b-835b98225af5) Message: Network map updated Time: 28 seconds ago OS: linux/amd64 Daemon version: 0.43.3 CLI version: 0.43.3 Management: Connected to https://netbird.svarogforge.org:443 Signal: Connected to https://netbird.svarogforge.org:443 Relays: [stun:netbird.svarogforge.org:3478] is Available [turn:netbird.svarogforge.org:3478?transport=udp] is Available [rels://netbird.svarogforge.org:443] is Available Nameservers: FQDN: dell-work.netbird.selfhosted NetBird IP: 100.90.210.148/16 Interface type: Kernel Quantum resistance: false Networks: 10.0.0.0/32 Forwarding rules: 0 Peers count: 1/4 Connected ```
Sign in to join this conversation.
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: DYNR/netbird#7389