[GH-ISSUE #3940] [Problem] STUN Issues: user self credentials are incorrect - Unable to connect to other servers #8312

Open
opened 2026-08-05 01:17:20 -04:00 by saavagebueno · 0 comments
Owner

Originally created by @Xeravax on GitHub (Jun 8, 2025).
Original GitHub issue: https://github.com/netbirdio/netbird/issues/3940

Describe the problem

I have no full idea where this is coming from, but currently. All our clients on 0.46.0 are reporting issues. Everything says it's connected just fine.

Image

But when we try to connect to ANY server at all, it's refusing the connection. I've enabled an ALL <-> ALL rule, and even that is not being processed by the clients. We're unable to connect to ANY side of the infrastructure.

We get the following error spammed in the console:
session 005000000000000013: check_stun_auth: user self credentials are incorrect

Image

To Reproduce

Unfortuanly, this is in no way explainable on how to reproduce, all I can say is that all clients are now on 0.46.0, and since then we've had this issue.

Expected behavior

Being able to connect to other servers. My best assumption is that the TURN server is having an issue that causes correct credentials to not be accepted for some reason. I checked the management.json and turnserver.conf. Both contain the same password. Down to the capital letter:
Image

My best guess is that TURN is the one client that manages the communication of stuff like the NB firewall rules and stuff, and since that's unable to connect now. It's unable to tell who can connect to whom.
'

Are you using NetBird Cloud?

Selfhosted netbird.

NetBird version

C:\Users\Gebruiker>netbird version
0.46.0

Is any other VPN software installed?

No

Debug output

To help us resolve the problem, please attach the following anonymized status output

 server-name.anon-EO3sq.domain:
  NetBird IP: 100.126.209.13
  Public key: 7ec0aVbGZTt1FlDVa1YH0wrEqNXapONIFesnknjWigw=
  Status: Connected
  -- detail --
  Connection type: P2P
  ICE candidate (Local/Remote): srflx/host
  ICE candidate endpoints (Local/Remote): 198.51.100.0:63204/198.51.100.29:51820
  Relay server address: rel://relay.anon-8G5pv.domain:33080
  Last connection update: 13 minutes, 50 seconds ago
  Last WireGuard handshake: 1 minute, 20 seconds ago
  Transfer status (received/sent) 708 B/2.3 KiB
  Quantum resistance: false
  Networks: -
  Latency: 89.8727ms

 client-name.anon-EO3sq.domain:
  NetBird IP: 100.126.246.128
  Public key: BRFX+Yjx4iHfNIIcsVl7UEZ4gfoXMulSMql4Sc74njw=
  Status: Connecting
  -- detail --
  Connection type:
  ICE candidate (Local/Remote): -/-
  ICE candidate endpoints (Local/Remote): -/-
  Relay server address:
  Last connection update: 13 minutes, 51 seconds ago
  Last WireGuard handshake: -
  Transfer status (received/sent) 0 B/0 B
  Quantum resistance: false
  Networks: -
  Latency: 0s

 client-namet.anon-EO3sq.domain:
  NetBird IP: 100.126.248.99
  Public key: nJ6jc2w+JIfstwrFR3pAqvpIPGpGsnWUyF+UDQ8fzBU=
  Status: Connecting
  -- detail --
  Connection type:
  ICE candidate (Local/Remote): -/-
  ICE candidate endpoints (Local/Remote): -/-
  Relay server address:
  Last connection update: 13 minutes, 51 seconds ago
  Last WireGuard handshake: -
  Transfer status (received/sent) 0 B/0 B
  Quantum resistance: false
  Networks: -
  Latency: 0s

 client-name.anon-EO3sq.domain:
  NetBird IP: 100.126.254.195
  Public key: UyM3dsQXphPvBImTinbJc+pa1vIQSoZo52ibbeyMk0Q=
  Status: Connecting
  -- detail --
  Connection type:
  ICE candidate (Local/Remote): -/-
  ICE candidate endpoints (Local/Remote): -/-
  Relay server address:
  Last connection update: 13 minutes, 51 seconds ago
  Last WireGuard handshake: -
  Transfer status (received/sent) 0 B/0 B
  Quantum resistance: false
  Networks: -
  Latency: 0s

Events:
  [INFO] SYSTEM (a01d2052-ec5f-4c72-a75c-e55bda8e56f8)
    Message: Network map updated
    Time: 34 minutes, 6 seconds ago
  [INFO] SYSTEM (0983a6cf-bd4b-415f-b6d6-4260eff9b458)
    Message: Network map updated
    Time: 32 minutes, 39 seconds ago
  [INFO] SYSTEM (b0f51528-a42b-4525-a43d-1eacf1e8f2c5)
    Message: Network map updated
    Time: 28 minutes, 4 seconds ago
  [INFO] SYSTEM (e62b22fd-d42a-4564-a4d8-135e7371d7aa)
    Message: Network map updated
    Time: 21 minutes, 29 seconds ago
  [INFO] SYSTEM (ee912ce4-6b9b-4beb-9cd6-dad5ff94f8cf)
    Message: Network map updated
    Time: 19 minutes, 50 seconds ago
  [INFO] SYSTEM (2cc6b4ed-cd4b-4bcf-a390-5d582002d1a3)
    Message: Network map updated
    Time: 18 minutes, 51 seconds ago
  [INFO] SYSTEM (1e5d5395-5311-43de-8ccc-91ff9bcbda07)
    Message: Network map updated
    Time: 16 minutes, 15 seconds ago
  [INFO] SYSTEM (9edd86d7-93fa-4bf7-8e57-62c656f6758c)
    Message: Network map updated
    Time: 13 minutes, 51 seconds ago
  [INFO] SYSTEM (3c3a3577-22b6-4f2b-9147-6699a6c171db)
    Message: Network map updated
    Time: 13 minutes, 47 seconds ago
  [INFO] SYSTEM (385a40da-9e31-4cc2-a02e-3996cc1599e2)
    Message: Network map updated
    Time: 5 minutes, 41 seconds ago
OS: windows/amd64
Daemon version: 0.46.0
CLI version: 0.46.0
Management: Connected to https://vpn.anon-8G5pv.domain:443
Signal: Connected to https://vpn.anon-8G5pv.domain:443
Relays:
  [stun:turn.anon-8G5pv.domain:3478] is Available
  [turn:turn.anon-8G5pv.domain:3478?transport=udp] is Available
  [rel://relay.anon-8G5pv.domain:33080] is Available
Nameservers:
  [100.126.212.168:53] for [anon-gWSDF.domain] is Available
  [100.126.212.168:53] for [anon-sY1kn.domain] is Available
  [100.126.212.168:53] for [anon-BBsyE.domain] is Available
  [100.126.212.168:53] for [anon-mWH6A.domain] is Available
  [100.126.212.168:53] for [anon-HxJzh.domain] is Available
  [100.126.212.168:53] for [anon-fD284.domain] is Available
  [100.126.212.168:53] for [anon-aoJFH.domain] is Available
  [100.126.212.168:53] for [anon-OoEEi.domain] is Available
  [8.8.8.8:53, 8.8.4.4:53] for [.] is Available
  [100.126.212.168:53] for [anon-3mv7w.domain] is Available
  [100.126.212.168:53] for [anon-5lKlX.domain] is Available
  [100.126.212.168:53] for [anon-shjqQ.domain] is Available
  [100.126.212.168:53] for [anon-GpMtB.domain] is Available
  [100.126.212.168:53] for [anon-duN5v.domain] is Available
  [100.126.212.168:53] for [anon-Dh3uA.domain] is Available
  [100.126.212.168:53] for [anon-cEzrm.domain] is Available
  [100.126.212.168:53] for [anon-CGm1p.domain] is Available
  [100.126.212.168:53] for [anon-yFgf7.domain] is Available
  [100.126.212.168:53] for [anon-JvJ5C.domain] is Available
  [100.126.212.168:53] for [anon-g1OPh.domain] is Available
  [100.126.212.168:53] for [anon-Xo9qB.domain] is Available
  [100.126.212.168:53] for [anon-qocsH.domain] is Available
FQDN: stefanocoding-gamepc.anon-EO3sq.domain
NetBird IP: 100.126.136.200/16
Interface type: Userspace
Quantum resistance: false
Lazy connection: true
Networks: -
Forwarding rules: 0
Peers count: 33/90 Connected

Create and upload a debug bundle, and share the returned file key:

75bd102f54b54fcf4ff96d803496c5382cec871b9e8b71286220cf0104cd7d61/c9d04749-85fb-46a7-acb0-05b3c63e2e88

Uploaded files are automatically deleted after 30 days.

Additional Information:
Downgrading a client back down to 0.45.3 makes me able to connect to a 0.46.0 server. Something may have gone wrong on the clients, as all other machines (servers) have been setup with a setup key. Rather then SSO. However, this is roughly tested and I'm not 100% sure if this is applicable.
Downgrading did not work, both client and server on 0.45.3 (with management on 0.46.0) still does not allow people to connect.

Have you tried these troubleshooting steps?

  • Reviewed client troubleshooting (if applicable)
  • Checked for newer NetBird versions
  • Searched for similar issues on GitHub (including closed ones)
  • Restarted the NetBird client
  • Disabled other VPN software
  • Checked firewall settings
Originally created by @Xeravax on GitHub (Jun 8, 2025). Original GitHub issue: https://github.com/netbirdio/netbird/issues/3940 **Describe the problem** I have no full idea where this is coming from, but currently. All our clients on 0.46.0 are reporting issues. Everything says it's connected just fine. ![Image](https://github.com/user-attachments/assets/a6d52a17-bf77-47f0-ad80-459ea8401465) But when we try to connect to ANY server at all, it's refusing the connection. I've enabled an ALL <-> ALL rule, and even that is not being processed by the clients. We're unable to connect to ANY side of the infrastructure. We get the following error spammed in the console: session 005000000000000013: check_stun_auth: user self credentials are incorrect ![Image](https://github.com/user-attachments/assets/6b89faf3-19e9-4f70-8f3e-26119660606e) **To Reproduce** Unfortuanly, this is in no way explainable on how to reproduce, all I can say is that all clients are now on 0.46.0, and since then we've had this issue. **Expected behavior** Being able to connect to other servers. My best assumption is that the TURN server is having an issue that causes correct credentials to not be accepted for some reason. I checked the management.json and turnserver.conf. Both contain the same password. Down to the **capital letter**: ![Image](https://github.com/user-attachments/assets/d9980d48-ba98-4524-a417-eb4d1dfdc772) My best guess is that TURN is the one client that manages the communication of stuff like the NB firewall rules and stuff, and since that's unable to connect now. It's unable to tell who can connect to whom. ' **Are you using NetBird Cloud?** Selfhosted netbird. **NetBird version** C:\Users\Gebruiker>netbird version 0.46.0 **Is any other VPN software installed?** No **Debug output** To help us resolve the problem, please attach the following anonymized status output ``` server-name.anon-EO3sq.domain: NetBird IP: 100.126.209.13 Public key: 7ec0aVbGZTt1FlDVa1YH0wrEqNXapONIFesnknjWigw= Status: Connected -- detail -- Connection type: P2P ICE candidate (Local/Remote): srflx/host ICE candidate endpoints (Local/Remote): 198.51.100.0:63204/198.51.100.29:51820 Relay server address: rel://relay.anon-8G5pv.domain:33080 Last connection update: 13 minutes, 50 seconds ago Last WireGuard handshake: 1 minute, 20 seconds ago Transfer status (received/sent) 708 B/2.3 KiB Quantum resistance: false Networks: - Latency: 89.8727ms client-name.anon-EO3sq.domain: NetBird IP: 100.126.246.128 Public key: BRFX+Yjx4iHfNIIcsVl7UEZ4gfoXMulSMql4Sc74njw= Status: Connecting -- detail -- Connection type: ICE candidate (Local/Remote): -/- ICE candidate endpoints (Local/Remote): -/- Relay server address: Last connection update: 13 minutes, 51 seconds ago Last WireGuard handshake: - Transfer status (received/sent) 0 B/0 B Quantum resistance: false Networks: - Latency: 0s client-namet.anon-EO3sq.domain: NetBird IP: 100.126.248.99 Public key: nJ6jc2w+JIfstwrFR3pAqvpIPGpGsnWUyF+UDQ8fzBU= Status: Connecting -- detail -- Connection type: ICE candidate (Local/Remote): -/- ICE candidate endpoints (Local/Remote): -/- Relay server address: Last connection update: 13 minutes, 51 seconds ago Last WireGuard handshake: - Transfer status (received/sent) 0 B/0 B Quantum resistance: false Networks: - Latency: 0s client-name.anon-EO3sq.domain: NetBird IP: 100.126.254.195 Public key: UyM3dsQXphPvBImTinbJc+pa1vIQSoZo52ibbeyMk0Q= Status: Connecting -- detail -- Connection type: ICE candidate (Local/Remote): -/- ICE candidate endpoints (Local/Remote): -/- Relay server address: Last connection update: 13 minutes, 51 seconds ago Last WireGuard handshake: - Transfer status (received/sent) 0 B/0 B Quantum resistance: false Networks: - Latency: 0s Events: [INFO] SYSTEM (a01d2052-ec5f-4c72-a75c-e55bda8e56f8) Message: Network map updated Time: 34 minutes, 6 seconds ago [INFO] SYSTEM (0983a6cf-bd4b-415f-b6d6-4260eff9b458) Message: Network map updated Time: 32 minutes, 39 seconds ago [INFO] SYSTEM (b0f51528-a42b-4525-a43d-1eacf1e8f2c5) Message: Network map updated Time: 28 minutes, 4 seconds ago [INFO] SYSTEM (e62b22fd-d42a-4564-a4d8-135e7371d7aa) Message: Network map updated Time: 21 minutes, 29 seconds ago [INFO] SYSTEM (ee912ce4-6b9b-4beb-9cd6-dad5ff94f8cf) Message: Network map updated Time: 19 minutes, 50 seconds ago [INFO] SYSTEM (2cc6b4ed-cd4b-4bcf-a390-5d582002d1a3) Message: Network map updated Time: 18 minutes, 51 seconds ago [INFO] SYSTEM (1e5d5395-5311-43de-8ccc-91ff9bcbda07) Message: Network map updated Time: 16 minutes, 15 seconds ago [INFO] SYSTEM (9edd86d7-93fa-4bf7-8e57-62c656f6758c) Message: Network map updated Time: 13 minutes, 51 seconds ago [INFO] SYSTEM (3c3a3577-22b6-4f2b-9147-6699a6c171db) Message: Network map updated Time: 13 minutes, 47 seconds ago [INFO] SYSTEM (385a40da-9e31-4cc2-a02e-3996cc1599e2) Message: Network map updated Time: 5 minutes, 41 seconds ago OS: windows/amd64 Daemon version: 0.46.0 CLI version: 0.46.0 Management: Connected to https://vpn.anon-8G5pv.domain:443 Signal: Connected to https://vpn.anon-8G5pv.domain:443 Relays: [stun:turn.anon-8G5pv.domain:3478] is Available [turn:turn.anon-8G5pv.domain:3478?transport=udp] is Available [rel://relay.anon-8G5pv.domain:33080] is Available Nameservers: [100.126.212.168:53] for [anon-gWSDF.domain] is Available [100.126.212.168:53] for [anon-sY1kn.domain] is Available [100.126.212.168:53] for [anon-BBsyE.domain] is Available [100.126.212.168:53] for [anon-mWH6A.domain] is Available [100.126.212.168:53] for [anon-HxJzh.domain] is Available [100.126.212.168:53] for [anon-fD284.domain] is Available [100.126.212.168:53] for [anon-aoJFH.domain] is Available [100.126.212.168:53] for [anon-OoEEi.domain] is Available [8.8.8.8:53, 8.8.4.4:53] for [.] is Available [100.126.212.168:53] for [anon-3mv7w.domain] is Available [100.126.212.168:53] for [anon-5lKlX.domain] is Available [100.126.212.168:53] for [anon-shjqQ.domain] is Available [100.126.212.168:53] for [anon-GpMtB.domain] is Available [100.126.212.168:53] for [anon-duN5v.domain] is Available [100.126.212.168:53] for [anon-Dh3uA.domain] is Available [100.126.212.168:53] for [anon-cEzrm.domain] is Available [100.126.212.168:53] for [anon-CGm1p.domain] is Available [100.126.212.168:53] for [anon-yFgf7.domain] is Available [100.126.212.168:53] for [anon-JvJ5C.domain] is Available [100.126.212.168:53] for [anon-g1OPh.domain] is Available [100.126.212.168:53] for [anon-Xo9qB.domain] is Available [100.126.212.168:53] for [anon-qocsH.domain] is Available FQDN: stefanocoding-gamepc.anon-EO3sq.domain NetBird IP: 100.126.136.200/16 Interface type: Userspace Quantum resistance: false Lazy connection: true Networks: - Forwarding rules: 0 Peers count: 33/90 Connected ``` Create and upload a debug bundle, and share the returned file key: `75bd102f54b54fcf4ff96d803496c5382cec871b9e8b71286220cf0104cd7d61/c9d04749-85fb-46a7-acb0-05b3c63e2e88` *Uploaded files are automatically deleted after 30 days.* **Additional Information**: ~~Downgrading a **client** back down to 0.45.3 makes me able to connect to a 0.46.0 server. Something may have gone wrong on the clients, as all other machines (servers) have been setup with a setup key. Rather then SSO. However, this is roughly tested and I'm not 100% sure if this is applicable.~~ Downgrading did not work, both client and server on 0.45.3 (with management on 0.46.0) still does not allow people to connect. **Have you tried these troubleshooting steps?** - [x] Reviewed [client troubleshooting](https://docs.netbird.io/how-to/troubleshooting-client) (if applicable) - [x] Checked for newer NetBird versions - [x] Searched for similar issues on GitHub (including closed ones) - [x] Restarted the NetBird client - [x] Disabled other VPN software - [x] Checked firewall settings
saavagebueno added the coturn label 2026-08-05 01:17:20 -04:00
Sign in to join this conversation.
No Label coturn
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: DYNR/netbird#8312