[GH-ISSUE #4047] Unable to P2P between peer and exit node #7938

Open
opened 2026-08-05 01:15:18 -04:00 by saavagebueno · 0 comments
Owner

Originally created by @eveyraud on GitHub (Jun 25, 2025).
Original GitHub issue: https://github.com/netbirdio/netbird/issues/4047

UPDATE

Thanks to @lepazca who identified the problem:
I have two machines. One is configured as a routing peer for the network 0.0.0.0/0 (similar to a deprecated exit node configuration). This network definition inherently includes the public IP address of the routing peer itself. Once the P2P connection is established, WireGuard attempts to route subsequent packets through the VPN tunnel to the routing peer (as its routing configuration dictates that traffic for 0.0.0.0/0 should be sent via this peer). This self-referential routing prevents packets from reaching the peer's public IP via the external network, causing the P2P connection to fail. Consequently, the fallback system is triggered, and all traffic is then relayed via TCP.

Describe the problem

After disabling Windows Firewall and EDR, I am currently not able to connect my Windows and Linux peers in P2P together (only relayed connection). When I create a Linux VM in the same network than my Windows, the two can connect perfectly in P2P.
I saw that NetBird wasn't UPnP and I created a rule to accept inbound and outbound connection on the UDP/51820 port (and even disabled FW as I said)

To Reproduce

Steps to reproduce the behavior:

  1. Create self-hosted NetBird server
  2. Connect a Linux peer
  3. Connect a Windows peer
  4. Authorize the two to communicate
  5. Disable Windows Firewalls and EDR
  6. Type command netbird status --detail
  7. Look at Connection Type

Expected behavior

Connection to be P2P

Are you using NetBird Cloud?

I am using self-hosted NetBird

NetBird version

Linux : 0.49.0, Windows: 0.49.0

Is any other VPN software installed?

Yes, forticlient but it is disabled.

Debug output

To help us resolve the problem, please attach the following anonymized status output

Peers detail:
netbird-gateway.netbird.selfhosted:
NetBird IP: 100.71.125.247
Public key: bGGIji458wjUPLylAqBgv7+bIN8UDa/Ea3viipngPXE=
Status: Connected
-- detail --
Connection type: Relayed
ICE candidate (Local/Remote): -/-
ICE candidate endpoints (Local/Remote): -/-
Relay server address: rels://wg.anon-hcS0Z.domain:443
Last connection update: 3 minutes, 21 seconds ago
Last WireGuard handshake: 1 minute, 22 seconds ago
Transfer status (received/sent) 2.7 MiB/942.3 KiB
Quantum resistance: false
Networks: 0.0.0.0/0
Latency: 0s

Events:
[INFO] NETWORK (71cf2845-907b-45ea-a4ce-a0df5fec2b09)
Message: Default route added
Time: 5 minutes, 45 seconds ago
Metadata: id: ALL, network: 0.0.0.0/0, peer: bGGIji458wjUPLylAqBgv7+bIN8UDa/Ea3viipngPXE=
[INFO] SYSTEM (7ea9ca82-02a3-4826-b6a8-9c786d395be5)
Message: Network map updated
Time: 5 minutes, 45 seconds ago
[WARNING] DNS (2a772dbc-2669-4485-a193-7c6b89e6d583)
Message: All upstream servers failed (probe failed)
Time: 5 minutes, 28 seconds ago
Metadata: upstreams: 172.16.1.6:53, 172.16.1.7:53
[INFO] SYSTEM (2a49d777-679d-47de-9a87-fa688c491d08)
Message: Network map updated
Time: 5 minutes, 28 seconds ago
[INFO] NETWORK (4b72de14-7015-4bb4-968c-957d581240f1)
Message: Default route added
Time: 5 minutes, 28 seconds ago
Metadata: id: ALL, network: 0.0.0.0/0, peer: bGGIji458wjUPLylAqBgv7+bIN8UDa/Ea3viipngPXE=
[INFO] NETWORK (081172e9-65b9-4372-a371-08dcb7780e5a)
Message: Default route added
Time: 5 minutes, 28 seconds ago
Metadata: id: ALL, network: 0.0.0.0/0, peer: bGGIji458wjUPLylAqBgv7+bIN8UDa/Ea3viipngPXE=
[WARNING] DNS (c492914c-178f-4474-936e-c64a6ca8d278)
Message: All upstream servers failed (probe failed)
Time: 3 minutes, 21 seconds ago
Metadata: upstreams: 172.16.1.6:53, 172.16.1.7:53
[INFO] SYSTEM (ba935ef3-8259-4dcf-9f21-d0e24d34e1d7)
Message: Network map updated
Time: 3 minutes, 21 seconds ago
[INFO] NETWORK (1c786484-290f-42a7-b298-0119781d7c35)
Message: Default route added
Time: 3 minutes, 21 seconds ago
Metadata: id: ALL, network: 0.0.0.0/0, peer: bGGIji458wjUPLylAqBgv7+bIN8UDa/Ea3viipngPXE=
[INFO] NETWORK (cac1d46e-7915-4ffc-a282-e96ad2d2beba)
Message: Default route added
Time: 3 minutes, 21 seconds ago
Metadata: id: ALL, network: 0.0.0.0/0, peer: bGGIji458wjUPLylAqBgv7+bIN8UDa/Ea3viipngPXE=
OS: windows/amd64
Daemon version: 0.49.0
CLI version: 0.49.0
Management: Connected to https://wg.anon-hcS0Z.domain:443
Signal: Connected to https://wg.anon-hcS0Z.domain:443
Relays:
[stun:wg.anon-hcS0Z.domain:3478] is Available
[turn:wg.anon-hcS0Z.domain:3478?transport=udp] is Available
[rels://wg.anon-hcS0Z.domain:443] is Available
Nameservers:
[172.16.1.6:53, 172.16.1.7:53] for [.] is Available
FQDN: prt35.netbird.selfhosted
NetBird IP: 100.71.104.14/16
Interface type: Userspace
Quantum resistance: false
Lazy connection: false
Networks: -
Forwarding rules: 0
Peers count: 1/1 Connected

Create and upload a debug bundle, and share the returned file key:

0107b729c324c4562e1e10d3b5be55567aa55c08302d40e822c7a4ca939cd561/acb0b152-7f5a-4853-b36c-e846e625a513

Have you tried these troubleshooting steps?

  • Reviewed client troubleshooting (if applicable)
  • Checked for newer NetBird versions
  • Searched for similar issues on GitHub (including closed ones)
  • Restarted the NetBird client
  • Disabled other VPN software
  • Checked firewall settings
Originally created by @eveyraud on GitHub (Jun 25, 2025). Original GitHub issue: https://github.com/netbirdio/netbird/issues/4047 ### UPDATE _Thanks to @lepazca who identified the problem:_ I have two machines. One is configured as a routing peer for the network 0.0.0.0/0 (similar to a deprecated exit node configuration). This network definition inherently includes the public IP address of the routing peer itself. Once the P2P connection is established, WireGuard attempts to route subsequent packets through the VPN tunnel to the routing peer (as its routing configuration dictates that traffic for 0.0.0.0/0 should be sent via this peer). This self-referential routing prevents packets from reaching the peer's public IP via the external network, causing the P2P connection to fail. Consequently, the fallback system is triggered, and all traffic is then relayed via TCP. **Describe the problem** After disabling Windows Firewall and EDR, I am currently not able to connect my Windows and Linux peers in P2P together (only relayed connection). When I create a Linux VM in the same network than my Windows, the two can connect perfectly in P2P. I saw that NetBird wasn't UPnP and I created a rule to accept inbound and outbound connection on the UDP/51820 port (and even disabled FW as I said) **To Reproduce** Steps to reproduce the behavior: 1. Create self-hosted NetBird server 2. Connect a Linux peer 3. Connect a Windows peer 4. Authorize the two to communicate 5. Disable Windows Firewalls and EDR 6. Type command netbird status --detail 7. Look at Connection Type **Expected behavior** Connection to be P2P **Are you using NetBird Cloud?** I am using self-hosted NetBird **NetBird version** Linux : 0.49.0, Windows: 0.49.0 **Is any other VPN software installed?** Yes, forticlient but it is disabled. **Debug output** To help us resolve the problem, please attach the following anonymized status output Peers detail: netbird-gateway.netbird.selfhosted: NetBird IP: 100.71.125.247 Public key: bGGIji458wjUPLylAqBgv7+bIN8UDa/Ea3viipngPXE= Status: Connected -- detail -- Connection type: Relayed ICE candidate (Local/Remote): -/- ICE candidate endpoints (Local/Remote): -/- Relay server address: rels://wg.anon-hcS0Z.domain:443 Last connection update: 3 minutes, 21 seconds ago Last WireGuard handshake: 1 minute, 22 seconds ago Transfer status (received/sent) 2.7 MiB/942.3 KiB Quantum resistance: false Networks: 0.0.0.0/0 Latency: 0s Events: [INFO] NETWORK (71cf2845-907b-45ea-a4ce-a0df5fec2b09) Message: Default route added Time: 5 minutes, 45 seconds ago Metadata: id: ALL, network: 0.0.0.0/0, peer: bGGIji458wjUPLylAqBgv7+bIN8UDa/Ea3viipngPXE= [INFO] SYSTEM (7ea9ca82-02a3-4826-b6a8-9c786d395be5) Message: Network map updated Time: 5 minutes, 45 seconds ago [WARNING] DNS (2a772dbc-2669-4485-a193-7c6b89e6d583) Message: All upstream servers failed (probe failed) Time: 5 minutes, 28 seconds ago Metadata: upstreams: 172.16.1.6:53, 172.16.1.7:53 [INFO] SYSTEM (2a49d777-679d-47de-9a87-fa688c491d08) Message: Network map updated Time: 5 minutes, 28 seconds ago [INFO] NETWORK (4b72de14-7015-4bb4-968c-957d581240f1) Message: Default route added Time: 5 minutes, 28 seconds ago Metadata: id: ALL, network: 0.0.0.0/0, peer: bGGIji458wjUPLylAqBgv7+bIN8UDa/Ea3viipngPXE= [INFO] NETWORK (081172e9-65b9-4372-a371-08dcb7780e5a) Message: Default route added Time: 5 minutes, 28 seconds ago Metadata: id: ALL, network: 0.0.0.0/0, peer: bGGIji458wjUPLylAqBgv7+bIN8UDa/Ea3viipngPXE= [WARNING] DNS (c492914c-178f-4474-936e-c64a6ca8d278) Message: All upstream servers failed (probe failed) Time: 3 minutes, 21 seconds ago Metadata: upstreams: 172.16.1.6:53, 172.16.1.7:53 [INFO] SYSTEM (ba935ef3-8259-4dcf-9f21-d0e24d34e1d7) Message: Network map updated Time: 3 minutes, 21 seconds ago [INFO] NETWORK (1c786484-290f-42a7-b298-0119781d7c35) Message: Default route added Time: 3 minutes, 21 seconds ago Metadata: id: ALL, network: 0.0.0.0/0, peer: bGGIji458wjUPLylAqBgv7+bIN8UDa/Ea3viipngPXE= [INFO] NETWORK (cac1d46e-7915-4ffc-a282-e96ad2d2beba) Message: Default route added Time: 3 minutes, 21 seconds ago Metadata: id: ALL, network: 0.0.0.0/0, peer: bGGIji458wjUPLylAqBgv7+bIN8UDa/Ea3viipngPXE= OS: windows/amd64 Daemon version: 0.49.0 CLI version: 0.49.0 Management: Connected to https://wg.anon-hcS0Z.domain:443 Signal: Connected to https://wg.anon-hcS0Z.domain:443 Relays: [stun:wg.anon-hcS0Z.domain:3478] is Available [turn:wg.anon-hcS0Z.domain:3478?transport=udp] is Available [rels://wg.anon-hcS0Z.domain:443] is Available Nameservers: [172.16.1.6:53, 172.16.1.7:53] for [.] is Available FQDN: prt35.netbird.selfhosted NetBird IP: 100.71.104.14/16 Interface type: Userspace Quantum resistance: false Lazy connection: false Networks: - Forwarding rules: 0 Peers count: 1/1 Connected Create and upload a debug bundle, and share the returned file key: 0107b729c324c4562e1e10d3b5be55567aa55c08302d40e822c7a4ca939cd561/acb0b152-7f5a-4853-b36c-e846e625a513 **Have you tried these troubleshooting steps?** - [X] Reviewed [client troubleshooting](https://docs.netbird.io/how-to/troubleshooting-client) (if applicable) - [X] Checked for newer NetBird versions - [X] Searched for similar issues on GitHub (including closed ones) - [X] Restarted the NetBird client - [X] Disabled other VPN software - [X] Checked firewall settings
saavagebueno added the bugclient labels 2026-08-05 01:15:19 -04:00
Sign in to join this conversation.
No Label bug client
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: DYNR/netbird#7938