SVI/netbird
1
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-08-04 19:55:09 -04:00
Code Issues 3.0k Packages Projects Releases 10 Wiki Activity

No connectivity if one peer is behind NAT #1679

New Issue
Closed
opened 2025-11-20 06:04:38 -05:00 by saavagebueno · 0 comments
saavagebueno commented 2025-11-20 06:04:38 -05:00
Owner
Copy Link

Originally created by @hotfur on GitHub (Mar 5, 2025).

Describe the problem

When one of the peer (let's call it Public peer) have open Wireguard port (default is 51820) and the other peer have its Wireguard port firewalled (call this NAT peer), connection could not be established between A and B.

To Reproduce

  • Install NetBird client on machine A and B.
  • Open incoming UDP port 51820 on machine A and verify it is open by accessing it over the internet.
  • Make sure that machine B is behind a NAT router and have internet access.
  • Firewall incoming UDP port 51820 on machine B.
  • Add ACL rule in NetBird control panel allowing ALL connection between A and B.
  • Wait 1-2 minutes.
  • Ping A from B
  • Observe 100% packet dropped.

Expected behavior

Machine A respond to ping from B without any packet dropped.

Are you using NetBird Cloud?

Yes

NetBird version

0.37.1

NetBird status -dA output:

_______________Machine A:
Peers detail:
laptop.netbird.cloud:
NetBird IP: 100.82.201.57
Public key: *
Status: Connected
-- detail --
Connection type: Relayed
ICE candidate (Local/Remote): -/-
ICE candidate endpoints (Local/Remote): -/-
Relay server address: rels://streamline-sg-sin1-1.relay.netbird.io:443
Last connection update: 4 seconds ago
Last WireGuard handshake: 1 minute, 34 seconds ago
Transfer status (received/sent) 10.2 KiB/174.0 KiB
Quantum resistance: true
Routes: -
Networks: -
Latency: 25.667375ms

OS: linux/mipsle
Daemon version: 0.36.7
CLI version: 0.36.7
Management: Connected to https://api.netbird.io:443
Signal: Connected to https://signal.netbird.io:443
Relays:
[stun:stun.netbird.io:5555] is Available
[turns:turn.netbird.io:443?transport=tcp] is Available
[rels://streamline-sg-sin1-1.relay.netbird.io:443] is Available
Nameservers:
FQDN: saya.netbird.cloud
NetBird IP: 100.82.28.77/16
Interface type: Kernel
Quantum resistance: true (permissive)
Peers count: 1/1 Connected

_______________Machine B:
Peers detail:
saya.netbird.cloud:
NetBird IP: 100.82.28.77
Public key: *
Status: Connected
-- detail --
Connection type: P2P
ICE candidate (Local/Remote): srflx/srflx
ICE candidate endpoints (Local/Remote): 198.51.100.0:55274/198.51.100.1:36514
Relay server address: rels://streamline-sg-sin1-1.relay.netbird.io:443
Last connection update: 42 seconds ago
Last WireGuard handshake: 27 seconds ago
Transfer status (received/sent) 51.2 KiB/1.3 KiB
Quantum resistance: true
Routes: -
Networks: -
Latency: 25.753082ms

Events:
[INFO] SYSTEM (9bd49688-b3ba-4790-9509-aa8f3739a326)
Message: Network map updated
Time: 33 minutes, 52 seconds ago
[INFO] SYSTEM (9617bf0c-09f7-4ca5-a310-8bed7be52669)
Message: Network map updated
Time: 33 minutes, 5 seconds ago
[INFO] SYSTEM (0e3ec051-d446-4a09-8142-9c90e969801c)
Message: Network map updated
Time: 29 minutes, 19 seconds ago
[INFO] SYSTEM (603cefda-9064-428a-86e9-749fe8347c0e)
Message: Network map updated
Time: 26 minutes, 57 seconds ago
[INFO] SYSTEM (d3cc4357-d5f2-472e-8eb6-ecf76816fa09)
Message: Network map updated
Time: 6 minutes, 58 seconds ago
[INFO] SYSTEM (cf76effd-70e7-43bf-8c10-1f74dc37df1e)
Message: Network map updated
Time: 6 minutes, 55 seconds ago
[INFO] SYSTEM (9c396f35-b86b-49e0-95ed-6de0c527d0a2)
Message: Network map updated
Time: 5 minutes, 31 seconds ago
[INFO] SYSTEM (7201bcd3-cc55-48da-945b-9756cfca78cb)
Message: Network map updated
Time: 5 minutes, 31 seconds ago
[INFO] SYSTEM (aea8ae50-d213-49f4-bb3b-d458dc38b74f)
Message: Network map updated
Time: 5 minutes, 3 seconds ago
[INFO] SYSTEM (3aedbb1a-8a0b-4f92-ae84-0fe9ac2d60f1)
Message: Network map updated
Time: 1 minute, 18 seconds ago
OS: linux/amd64
Daemon version: 0.37.1
CLI version: 0.37.1
Management: Connected to https://api.netbird.io:443
Signal: Connected to https://signal.netbird.io:443
Relays:
[stun:stun.netbird.io:5555] is Available
[turns:turn.netbird.io:443?transport=tcp] is Available
[rels://streamline-sg-sin1-1.relay.netbird.io:443] is Available
Nameservers:
FQDN: laptop.netbird.cloud
NetBird IP: 100.82.201.57/16
Interface type: Kernel
Quantum resistance: true (permissive)
Networks: -
Peers count: 1/1 Connected

Do you face any (non-mobile) client issues?

N/A

Screenshots

N/A

Additional context

To be precise, some time due to luck it is possible to ping A from B at the very beginning when activating NetBird on machine B. The ping must then be continued constantly for the connection to persist. If I stop the ping then wait for a few second (usually in less than 10 second) then it would be impossible to ping A from B (or vice-versa it do not matter).

Originally created by @hotfur on GitHub (Mar 5, 2025). **Describe the problem** When one of the peer (let's call it Public peer) have open Wireguard port (default is 51820) and the other peer have its Wireguard port firewalled (call this NAT peer), connection could not be established between A and B. **To Reproduce** - Install NetBird client on machine A and B. - Open incoming UDP port 51820 on machine A and verify it is open by accessing it over the internet. - Make sure that machine B is behind a NAT router and have internet access. - Firewall incoming UDP port 51820 on machine B. - Add ACL rule in NetBird control panel allowing ALL connection between A and B. - Wait 1-2 minutes. - Ping A from B - Observe 100% packet dropped. **Expected behavior** Machine A respond to ping from B without any packet dropped. **Are you using NetBird Cloud?** Yes **NetBird version** 0.37.1 **NetBird status -dA output:** _________________________________________________Machine A:__________________________________ Peers detail: laptop.netbird.cloud: NetBird IP: 100.82.201.57 Public key: * Status: Connected -- detail -- Connection type: Relayed ICE candidate (Local/Remote): -/- ICE candidate endpoints (Local/Remote): -/- Relay server address: rels://streamline-sg-sin1-1.relay.netbird.io:443 Last connection update: 4 seconds ago Last WireGuard handshake: 1 minute, 34 seconds ago Transfer status (received/sent) 10.2 KiB/174.0 KiB Quantum resistance: true Routes: - Networks: - Latency: 25.667375ms OS: linux/mipsle Daemon version: 0.36.7 CLI version: 0.36.7 Management: Connected to https://api.netbird.io:443 Signal: Connected to https://signal.netbird.io:443 Relays: [stun:stun.netbird.io:5555] is Available [turns:turn.netbird.io:443?transport=tcp] is Available [rels://streamline-sg-sin1-1.relay.netbird.io:443] is Available Nameservers: FQDN: saya.netbird.cloud NetBird IP: 100.82.28.77/16 Interface type: Kernel Quantum resistance: true (permissive) Peers count: 1/1 Connected _________________________________________________Machine B:__________________________________ Peers detail: saya.netbird.cloud: NetBird IP: 100.82.28.77 Public key: * Status: Connected -- detail -- Connection type: P2P ICE candidate (Local/Remote): srflx/srflx ICE candidate endpoints (Local/Remote): 198.51.100.0:55274/198.51.100.1:36514 Relay server address: rels://streamline-sg-sin1-1.relay.netbird.io:443 Last connection update: 42 seconds ago Last WireGuard handshake: 27 seconds ago Transfer status (received/sent) 51.2 KiB/1.3 KiB Quantum resistance: true Routes: - Networks: - Latency: 25.753082ms Events: [INFO] SYSTEM (9bd49688-b3ba-4790-9509-aa8f3739a326) Message: Network map updated Time: 33 minutes, 52 seconds ago [INFO] SYSTEM (9617bf0c-09f7-4ca5-a310-8bed7be52669) Message: Network map updated Time: 33 minutes, 5 seconds ago [INFO] SYSTEM (0e3ec051-d446-4a09-8142-9c90e969801c) Message: Network map updated Time: 29 minutes, 19 seconds ago [INFO] SYSTEM (603cefda-9064-428a-86e9-749fe8347c0e) Message: Network map updated Time: 26 minutes, 57 seconds ago [INFO] SYSTEM (d3cc4357-d5f2-472e-8eb6-ecf76816fa09) Message: Network map updated Time: 6 minutes, 58 seconds ago [INFO] SYSTEM (cf76effd-70e7-43bf-8c10-1f74dc37df1e) Message: Network map updated Time: 6 minutes, 55 seconds ago [INFO] SYSTEM (9c396f35-b86b-49e0-95ed-6de0c527d0a2) Message: Network map updated Time: 5 minutes, 31 seconds ago [INFO] SYSTEM (7201bcd3-cc55-48da-945b-9756cfca78cb) Message: Network map updated Time: 5 minutes, 31 seconds ago [INFO] SYSTEM (aea8ae50-d213-49f4-bb3b-d458dc38b74f) Message: Network map updated Time: 5 minutes, 3 seconds ago [INFO] SYSTEM (3aedbb1a-8a0b-4f92-ae84-0fe9ac2d60f1) Message: Network map updated Time: 1 minute, 18 seconds ago OS: linux/amd64 Daemon version: 0.37.1 CLI version: 0.37.1 Management: Connected to https://api.netbird.io:443 Signal: Connected to https://signal.netbird.io:443 Relays: [stun:stun.netbird.io:5555] is Available [turns:turn.netbird.io:443?transport=tcp] is Available [rels://streamline-sg-sin1-1.relay.netbird.io:443] is Available Nameservers: FQDN: laptop.netbird.cloud NetBird IP: 100.82.201.57/16 Interface type: Kernel Quantum resistance: true (permissive) Networks: - Peers count: 1/1 Connected **Do you face any (non-mobile) client issues?** N/A **Screenshots** N/A **Additional context** To be precise, some time due to luck it is possible to ping A from B at the very beginning when activating NetBird on machine B. The ping must then be continued constantly for the connection to persist. If I stop the ping then wait for a few second (usually in less than 10 second) then it would be impossible to ping A from B (or vice-versa it do not matter).
saavagebueno added the triage-needed label 2025-11-20 06:04:38 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
2021 Q4
2022 Q1
2022 Q1
accessibility
acl
agent
agent
Android
Android
api
authentik
automation
azure
battery-usage
bug
cache
client
client-ui
cloud
cloud-only
cloudflare
community
compatibility
config-idp
config-issue
connection
contribution
coturn
cross-vpn
dashboard
data-usage
distribution
dns
docker
documentation
duplicate
enhancement
enhancement
event-stream
feature-request
freebsd
getting-started
go
good first issue
gui
help wanted
home-assistant
idp
inconsistency
integration
integrations
ios
ipv6
jwt
k8s
keycloak
linux
login
macos
management-service
missing-docs
mobile
moved-internal
needs-review
netbird-ui
networking
new-platform
nginx
notification
okta
openwrt
packaging
peer-management
peer-management
peer-management
performance
postgres
posture-checks
psk
pull-request
Mirrored from GitHub Pull Request
 question
refactor
relay
release
rfc
routes
security
security-related
self-hosting
server
signal
sleep-issue
ssh
ssl
status
store
synology
system-compatibility-issue
test-suite
third-party-integration
triage
triage-needed
troubleshooting
UX
waiting-feedback
windows
wontfix
zitadel
No Label triage-needed
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
saavagebueno
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: SVI/netbird#1679
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?