SVI/netbird
1
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-06-10 09:22:09 -04:00
Code Issues 3.0k Packages Projects Releases 10 Wiki Activity

Multiple peers behind NAT getting relayed #1313

New Issue
Open
opened 2025-11-20 05:28:07 -05:00 by saavagebueno · 18 comments
saavagebueno commented 2025-11-20 05:28:07 -05:00
Owner
Copy Link

Originally created by @deatheibon on GitHub (Oct 7, 2024).

Describe the problem

I've setup a fresh netbird instance and added some peers which should create a p2p connection between each other. For testing i've setup one peer with a direct attached public ip and 3 peers behind the same NAT(OPNsense). With default Outbound NAT all connections to the public server getting realyed. With setting outbound NAT to static port for UDP atleast one connection to public server is getting p2p state. I figured out that the reason for this behavior is port 51820 which is the same on all peers behind my NAT, if i change ports to 51820,51821,51822 all three peers getting p2p connection cause of no duplicate source port. Shouldnt it work like this with default outbound behavior from OPNsense which is rewriting the source port automatically? I want to connect many peers over diffrent locations with some behind NAT and need the p2p connection for performance rasons. But i cant change all wgport settings to achieve this. Local connection between clients behind nat are p2p and as expected its only if NAT is involved. So maybe an idea would be NAT hole punching or to be compatible with source port rewrite or maybe a way that netbird itself is changing the wgport automatically.

To Reproduce

Steps to reproduce the behavior:

  1. add peer with direct public ip
  2. add atleas 2 peers behind nat
  3. see netbird status -d and see relayed connection to public server

Expected behavior
p2p connection to public server

Are you using NetBird Cloud?

No, self-hosted

NetBird version

0.30.0

Originally created by @deatheibon on GitHub (Oct 7, 2024). **Describe the problem** I've setup a fresh netbird instance and added some peers which should create a p2p connection between each other. For testing i've setup one peer with a direct attached public ip and 3 peers behind the same NAT(OPNsense). With default Outbound NAT all connections to the public server getting realyed. With setting outbound NAT to static port for UDP atleast one connection to public server is getting p2p state. I figured out that the reason for this behavior is port 51820 which is the same on all peers behind my NAT, if i change ports to 51820,51821,51822 all three peers getting p2p connection cause of no duplicate source port. Shouldnt it work like this with default outbound behavior from OPNsense which is rewriting the source port automatically? I want to connect many peers over diffrent locations with some behind NAT and need the p2p connection for performance rasons. But i cant change all wgport settings to achieve this. Local connection between clients behind nat are p2p and as expected its only if NAT is involved. So maybe an idea would be NAT hole punching or to be compatible with source port rewrite or maybe a way that netbird itself is changing the wgport automatically. **To Reproduce** Steps to reproduce the behavior: 1. add peer with direct public ip 2. add atleas 2 peers behind nat 3. see netbird status -d and see relayed connection to public server **Expected behavior** p2p connection to public server **Are you using NetBird Cloud?** No, self-hosted **NetBird version** 0.30.0
saavagebueno added the bugcompatibility labels 2025-11-20 05:28:08 -05:00
saavagebueno commented 2025-11-20 05:28:08 -05:00
Author
Owner
Copy Link

@jesvinjoachim commented on GitHub (Oct 15, 2024):

it same for me , as long there is ony two device in a route i get p2p, if add multiple device to acce the newtork everyting atleast one is relayed , also netbird status -detail shows its a p2p host/s***/p*** but the latecy might be still high , and on the other node it shows realyed .

i can confirm the issue .

Are you using NetBird Cloud?

No, self-hosted

NetBird version

0.30.1

@jesvinjoachim commented on GitHub (Oct 15, 2024): it same for me , as long there is ony two device in a route i get p2p, if add multiple device to acce the newtork everyting atleast one is relayed , also netbird status -detail shows its a p2p host/s***/p*** but the latecy might be still high , and on the other node it shows realyed . i can confirm the issue . Are you using NetBird Cloud? No, self-hosted NetBird version 0.30.1
saavagebueno commented 2025-11-20 05:28:08 -05:00
Author
Owner
Copy Link

@scroguard commented on GitHub (Dec 2, 2024):

i had a similar issue to this with my clients behind an opnsense firewall. i had to make some adjustments to the outbound nat (static ports and hybrid nat mode) as well as make sure each client used a unique port for wireguard. if multiple clients shared the same port then connections would relay instead of going p2p.

@scroguard commented on GitHub (Dec 2, 2024): i had a similar issue to this with my clients behind an opnsense firewall. i had to make some adjustments to the outbound nat (static ports and hybrid nat mode) as well as make sure each client used a unique port for wireguard. if multiple clients shared the same port then connections would relay instead of going p2p.
saavagebueno commented 2025-11-20 05:28:09 -05:00
Author
Owner
Copy Link

@deatheibon commented on GitHub (Feb 24, 2025):

i still can see this behavior with current version. I can say with native wireguard client, if you not specify any listening port wireguard client will use random source port. maybe an option in netbird webinterface where its possible to choose "use random port on clients" would be possible which then just unsetting the listening port in netbird client config. i would like to implement netbird in our company but the performance gap with relayed connection is huge, atleast for me i can only achieve 10% of availabe bandwith with relayed connection.

EDIT:
it seems the netbird client uses random port if you set wgport to -1 so far i see random source ports but still some connections get relayed but it looks much better now. I've set static port nat on opnsense for that to work aswell. So maybe there is only one additional option needed during client enrollment to set the port.

for example:

netbird up --management-url https://netbird.io --admin-url https://netbird.io --wireguard-port -1

Are you using NetBird Cloud?

No, self-hosted

Netbird Version

37.1

@deatheibon commented on GitHub (Feb 24, 2025): i still can see this behavior with current version. I can say with native wireguard client, if you not specify any listening port wireguard client will use random source port. maybe an option in netbird webinterface where its possible to choose "use random port on clients" would be possible which then just unsetting the listening port in netbird client config. i would like to implement netbird in our company but the performance gap with relayed connection is huge, atleast for me i can only achieve 10% of availabe bandwith with relayed connection. EDIT: it seems the netbird client uses random port if you set wgport to -1 so far i see random source ports but still some connections get relayed but it looks much better now. I've set static port nat on opnsense for that to work aswell. So maybe there is only one additional option needed during client enrollment to set the port. for example: `netbird up --management-url https://netbird.io --admin-url https://netbird.io --wireguard-port -1` Are you using NetBird Cloud? No, self-hosted Netbird Version 37.1
saavagebueno commented 2025-11-20 05:28:09 -05:00
Author
Owner
Copy Link

@Blackclaws commented on GitHub (May 5, 2025):

I think this doesn't work anymore as netbird now reports parsing -1: invalid syntax

@Blackclaws commented on GitHub (May 5, 2025): I think this doesn't work anymore as netbird now reports parsing -1: invalid syntax
saavagebueno commented 2025-11-20 05:28:09 -05:00
Author
Owner
Copy Link

@hjchjchjc4352 commented on GitHub (May 5, 2025):

I think this doesn't work anymore as netbird now reports parsing -1: invalid syntax

that's still useful

@hjchjchjc4352 commented on GitHub (May 5, 2025): > I think this doesn't work anymore as netbird now reports parsing -1: invalid syntax that's still useful
saavagebueno commented 2025-11-20 05:28:09 -05:00
Author
Owner
Copy Link

@hjchjchjc4352 commented on GitHub (May 5, 2025):

I think this doesn't work anymore as netbird now reports parsing -1: invalid syntax

it works on my linux、Windows and androids

@hjchjchjc4352 commented on GitHub (May 5, 2025): > I think this doesn't work anymore as netbird now reports parsing -1: invalid syntax it works on my linux、Windows and androids
saavagebueno commented 2025-11-20 05:28:09 -05:00
Author
Owner
Copy Link

@nazarewk commented on GitHub (May 6, 2025):

I think this doesn't work anymore as netbird now reports parsing -1: invalid syntax

Could you provide more details? At least a full log line at/before the error.

@nazarewk commented on GitHub (May 6, 2025): > I think this doesn't work anymore as netbird now reports parsing -1: invalid syntax Could you provide more details? At least a full log line at/before the error.
saavagebueno commented 2025-11-20 05:28:09 -05:00
Author
Owner
Copy Link

@Blackclaws commented on GitHub (May 6, 2025):

@nazarewk

❯ netbird up --management-url https://netbird***:443 --admin-url https://netbird*** --wireguard-port -1
Error: invalid argument "-1" for "--wireguard-port" flag: strconv.ParseUint: parsing "-1": invalid syntax

That's with 0.43.1 on Arch

@Blackclaws commented on GitHub (May 6, 2025): @nazarewk ``` ❯ netbird up --management-url https://netbird***:443 --admin-url https://netbird*** --wireguard-port -1 Error: invalid argument "-1" for "--wireguard-port" flag: strconv.ParseUint: parsing "-1": invalid syntax ``` That's with 0.43.1 on Arch
saavagebueno commented 2025-11-20 05:28:10 -05:00
Author
Owner
Copy Link

@lixmal commented on GitHub (May 6, 2025):

I'm not sure where this is supposed to come from, it has always been an unsigned int, so negative values are impossible.

e9c967b27c (diff-0db67eedcdec93665cc9dea08a99e38d7ed16f94db2e98f842af921340815542R42)

@lixmal commented on GitHub (May 6, 2025): I'm not sure where this is supposed to come from, it has always been an unsigned int, so negative values are impossible. https://github.com/netbirdio/netbird/commit/e9c967b27c644a2aed9ca9525b6bfd7386ed3139#diff-0db67eedcdec93665cc9dea08a99e38d7ed16f94db2e98f842af921340815542R42
saavagebueno commented 2025-11-20 05:28:10 -05:00
Author
Owner
Copy Link

@hjchjchjc4352 commented on GitHub (May 7, 2025):

@nazarewk

❯ netbird up --management-url https://netbird***:443 --admin-url https://netbird*** --wireguard-port -1
Error: invalid argument "-1" for "--wireguard-port" flag: strconv.ParseUint: parsing "-1": invalid syntax

That's with 0.43.1 on Arch

I didn’t use the --wireguard-port -1 command; I directly edited /netbird/config.json, setting "WgPort": -1.
The Androidd directory is /data/data/io.netbird.client/files/netbitd.cfg.

@hjchjchjc4352 commented on GitHub (May 7, 2025): > [@nazarewk](https://github.com/nazarewk) > > ``` > ❯ netbird up --management-url https://netbird***:443 --admin-url https://netbird*** --wireguard-port -1 > Error: invalid argument "-1" for "--wireguard-port" flag: strconv.ParseUint: parsing "-1": invalid syntax > ``` > > That's with 0.43.1 on Arch I didn’t use the --wireguard-port -1 command; I directly edited /netbird/config.json, setting "WgPort": -1. The Androidd directory is /data/data/io.netbird.client/files/netbitd.cfg.
saavagebueno commented 2025-11-20 05:28:10 -05:00
Author
Owner
Copy Link

@hjchjchjc4352 commented on GitHub (May 8, 2025):

I think this doesn't work anymore as netbird now reports parsing -1: invalid syntax

Could you provide more details? At least a full log line at/before the error.

Is it possible to deploy a self-hosted NetBird server using Docker’s host network mode?

@hjchjchjc4352 commented on GitHub (May 8, 2025): > > I think this doesn't work anymore as netbird now reports parsing -1: invalid syntax > > Could you provide more details? At least a full log line at/before the error. Is it possible to deploy a self-hosted NetBird server using Docker’s host network mode?
saavagebueno commented 2025-11-20 05:28:10 -05:00
Author
Owner
Copy Link

@florian-obradovic commented on GitHub (May 18, 2025):

Just noticed that all my peers behind our corp firewall are relayed.
I can't tell since which release this is but I'm certain, it worked a few months ago...
Setting "WgPort": -1, doesn't help.

I see this strange behavior:

Image

@florian-obradovic commented on GitHub (May 18, 2025): Just noticed that all my peers behind our corp firewall are relayed. I can't tell since which release this is but I'm certain, it worked a few months ago... Setting `"WgPort": -1,` doesn't help. I see this strange behavior: ![Image](https://github.com/user-attachments/assets/86925abc-cf7d-4230-8cde-31aa5f81087f)
saavagebueno commented 2025-11-20 05:28:10 -05:00
Author
Owner
Copy Link

@nazarewk commented on GitHub (Jun 6, 2025):

cross-linking issues related to WireGuard Port selection so they're easier to discover:

@nazarewk commented on GitHub (Jun 6, 2025): cross-linking issues related to WireGuard Port selection so they're easier to discover: - https://github.com/netbirdio/netbird/issues/2703 - https://github.com/netbirdio/netbird/issues/1378 - https://github.com/netbirdio/netbird/issues/546 - https://github.com/netbirdio/netbird/issues/1679
saavagebueno commented 2025-11-20 05:28:10 -05:00
Author
Owner
Copy Link

@nazarewk commented on GitHub (Jul 2, 2025):

FYI: you'll be able to select a random wireguard port after https://github.com/netbirdio/netbird/pull/4085 gets released

@nazarewk commented on GitHub (Jul 2, 2025): FYI: you'll be able to select a random wireguard port after https://github.com/netbirdio/netbird/pull/4085 gets released
saavagebueno commented 2025-11-20 05:28:11 -05:00
Author
Owner
Copy Link

@flotpg commented on GitHub (Jul 3, 2025):

Could double NAT be a problem like 5G Modem in a router which often is CG NAT / carrier grade NATed?
I also noticed such behavior when connected to iOS personal hotspot.

@flotpg commented on GitHub (Jul 3, 2025): Could double NAT be a problem like 5G Modem in a router which often is CG NAT / carrier grade NATed? I also noticed such behavior when connected to iOS personal hotspot.
saavagebueno commented 2025-11-20 05:28:11 -05:00
Author
Owner
Copy Link

@flotpg commented on GitHub (Jul 6, 2025):

Just updated from 0.45.2 > 0.50.1 and I still have the issue, that all peers are relayed except one machine which is running on the public internet:

Image

I'm online using Telekom Germany (CGNAT) + NAT @ local router.

Image

If I connect from different networks it works. Nothing is blocked on my local router.

@flotpg commented on GitHub (Jul 6, 2025): Just updated from 0.45.2 > 0.50.1 and I still have the issue, that all peers are relayed except one machine which is running on the public internet: <img width="2074" height="850" alt="Image" src="https://github.com/user-attachments/assets/df235791-2956-4dcc-8361-416fda4a7b34" /> I'm online using Telekom Germany (CGNAT) + NAT @ local router. <img width="1884" height="1370" alt="Image" src="https://github.com/user-attachments/assets/4a95f7e9-4ba4-420c-b921-5e8c28dfd848" /> If I connect from different networks it works. Nothing is blocked on my local router.
saavagebueno commented 2025-11-20 05:28:11 -05:00
Author
Owner
Copy Link

@nazarewk commented on GitHub (Jul 7, 2025):

Could double NAT be a problem like 5G Modem in a router which often is CG NAT / carrier grade NATed?

the more NATs/firewalls/routers you have on your network path, the more likely it is that one or more of them is preventing P2P/hole punching.

@nazarewk commented on GitHub (Jul 7, 2025): > Could double NAT be a problem like 5G Modem in a router which often is CG NAT / carrier grade NATed? the more NATs/firewalls/routers you have on your network path, the more likely it is that one or more of them is preventing P2P/hole punching.
saavagebueno commented 2025-11-20 05:28:11 -05:00
Author
Owner
Copy Link

@flotpg commented on GitHub (Jul 7, 2025):

Whats your experience with personal hotspot?
I almost always have relayed connection

@flotpg commented on GitHub (Jul 7, 2025): Whats your experience with personal hotspot? I almost always have relayed connection
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
2021 Q4
2022 Q1
2022 Q1
accessibility
acl
agent
agent
Android
Android
api
authentik
automation
azure
battery-usage
bug
cache
client
client-ui
cloud
cloud-only
cloudflare
community
compatibility
config-idp
config-issue
connection
contribution
coturn
cross-vpn
dashboard
data-usage
distribution
dns
docker
documentation
duplicate
enhancement
enhancement
event-stream
feature-request
freebsd
getting-started
go
good first issue
gui
help wanted
home-assistant
idp
inconsistency
integration
integrations
ios
ipv6
jwt
k8s
keycloak
linux
login
macos
management-service
missing-docs
mobile
moved-internal
needs-review
netbird-ui
networking
new-platform
nginx
notification
okta
openwrt
packaging
peer-management
peer-management
peer-management
performance
postgres
posture-checks
psk
pull-request
Mirrored from GitHub Pull Request
 question
refactor
relay
release
rfc
routes
security
security-related
self-hosting
server
signal
sleep-issue
ssh
ssl
status
store
synology
system-compatibility-issue
test-suite
third-party-integration
triage
triage-needed
troubleshooting
UX
waiting-feedback
windows
wontfix
zitadel
No Label bug compatibility
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
saavagebueno
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: SVI/netbird#1313
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?