SVI/netbird
1
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-05-16 13:12:11 -04:00
Code Issues 3.0k Packages Projects Releases 10 Wiki Activity

Installing netbird relay and netbird peer on one node to use a private network #1798

New Issue
Closed
opened 2025-11-20 06:07:00 -05:00 by saavagebueno · 6 comments
saavagebueno commented 2025-11-20 06:07:00 -05:00
Owner
Copy Link

Originally created by @galiev on GitHub (Apr 8, 2025).

Tell me please, does it make sense to install both a relay and a peer on a node so that thanks to the ICE protocol the relay uses a private network between the relay and the exit peer instead of a public network? If it makes sense, would it be enough to add rules allowing connections between the relay-peer and the exit peer?
It might be worth considering other options, such as adding an entry to the hosts file on the exit node specifying a private address for the relay name?

Originally created by @galiev on GitHub (Apr 8, 2025). Tell me please, does it make sense to install both a relay and a peer on a node so that thanks to the ICE protocol the relay uses a private network between the relay and the exit peer instead of a public network? If it makes sense, would it be enough to add rules allowing connections between the relay-peer and the exit peer? It might be worth considering other options, such as adding an entry to the hosts file on the exit node specifying a private address for the relay name?
saavagebueno commented 2025-11-20 06:07:01 -05:00
Author
Owner
Copy Link

@nazarewk commented on GitHub (Apr 8, 2025):

I'm not sure I follow.

If you mean to deploy a relay into a private network for more performance/to work around firewall rules management in a larger network, then it can make sense, and we plan to implement this possibility for Netbird Cloud later this year.

If you mean to deploy a relay into Netbird's address space, then I don't think it makes much sense, because Peers won't be able to use it before connecting to the network (chicken & egg problem).

@nazarewk commented on GitHub (Apr 8, 2025): I'm not sure I follow. If you mean to deploy a relay into a private network for more performance/to work around firewall rules management in a larger network, then it can make sense, and we plan to implement this possibility for Netbird Cloud later this year. If you mean to deploy a relay into Netbird's address space, then I don't think it makes much sense, because Peers won't be able to use it before connecting to the network (chicken & egg problem).
saavagebueno commented 2025-11-20 06:07:01 -05:00
Author
Owner
Copy Link

@galiev commented on GitHub (Apr 8, 2025):

Yes, my mistake, sorry, I didn't provide context. My relay and the node to which the client connects from the Internet are both simultaneously connected to the Internet and one private unlimited network. Traffic on the node is paid and it is usually not enough for the full month. The traffic in the tariff for the relay is much more because it is a different region. some clients use relay as I see, and if the relay sends traffic over a private network, then this can save me some traffic

@galiev commented on GitHub (Apr 8, 2025): Yes, my mistake, sorry, I didn't provide context. My relay and the node to which the client connects from the Internet are both simultaneously connected to the Internet and one private unlimited network. Traffic on the node is paid and it is usually not enough for the full month. The traffic in the tariff for the relay is much more because it is a different region. some clients use relay as I see, and if the relay sends traffic over a private network, then this can save me some traffic
saavagebueno commented 2025-11-20 06:07:01 -05:00
Author
Owner
Copy Link

@nazarewk commented on GitHub (Apr 9, 2025):

if the relay sends traffic over a private network, then this can save me some traffic

  1. Are we talking about a private network, as in NetBird network, or an internal network?
  2. Are all clients connecting from within that private network? You won't save much traffic by connecting clients from outside the private network. Unless the Relay is listening on a second (unmetered) internet connection that can be accessed by clients from outside.

Are we talking self-hosted NetBird or Cloud offering? I might be wrong, but I think you can already deploy and configure own relays for the self-hosted.

@nazarewk commented on GitHub (Apr 9, 2025): > if the relay sends traffic over a private network, then this can save me some traffic 1. Are we talking about a private network, as in NetBird network, or an internal network? 2. Are all clients connecting from _within_ that private network? You won't save much traffic by connecting clients from outside the private network. Unless the Relay is listening on a second (unmetered) internet connection that can be accessed by clients from outside. Are we talking self-hosted NetBird or Cloud offering? I might be wrong, but I think you can already deploy and configure own relays for the self-hosted.
saavagebueno commented 2025-11-20 06:07:01 -05:00
Author
Owner
Copy Link

@galiev commented on GitHub (Apr 9, 2025):

Dear @nazarewk, thank you for your help!

  1. We are discussing an internal Internet Service Provider (ISP) network and self-hosted netbird.
  2. I wanted to implement the following interaction setup:
  • The client connects via the Internet to a relay.
  • The relay connects via the ISP's private network to the target node(netbird exit node).
  • The exit node accesses an external web server via the Internet.

The issue is that the relay, running in Docker, is unaware of the existence of alternative routes to the nodes. However, if the Netbird client is installed on the same server where the relay is running, then my understanding is that, thanks to the ICE protocol, this client should be able to determine the optimal paths.

This raises the question: will such a solution help achieve my goal, or could it potentially lead to issues with the relay's operation?

@galiev commented on GitHub (Apr 9, 2025): Dear @nazarewk, thank you for your help! 1. We are discussing an internal Internet Service Provider (ISP) network and self-hosted netbird. 2. I wanted to implement the following interaction setup: - The client connects via the Internet to a relay. - The relay connects via the ISP's private network to the target node(netbird exit node). - The exit node accesses an external web server via the Internet. The issue is that the relay, running in Docker, is unaware of the existence of alternative routes to the nodes. However, if the Netbird client is installed on the same server where the relay is running, then my understanding is that, thanks to the ICE protocol, this client should be able to determine the optimal paths. This raises the question: will such a solution help achieve my goal, or could it potentially lead to issues with the relay's operation?
saavagebueno commented 2025-11-20 06:07:01 -05:00
Author
Owner
Copy Link

@nazarewk commented on GitHub (Apr 9, 2025):

It all depends on whether the concrete routing & firewall devices setup would prevent the P2P connection from being established and make the local relay selected reliably.

Knowing what was written already, it seems like it would be possible to achieve the result with careful design and lots of experimentation, but this kind of design is definitely out of the scope without an established support contract.

There is also a caveat: if the ISP's private network is a CGNAT (which it most likely is: running on the same 100.0.0.0/8 ip range as NetBird) and the end user devices receive IP addressing from the same range, it might give you a lot of issues with addressing collisions or end up being impossible alltogether.

@nazarewk commented on GitHub (Apr 9, 2025): It all depends on whether the concrete routing & firewall devices setup would prevent the P2P connection from being established and make the local relay selected reliably. Knowing what was written already, it seems like it would be possible to achieve the result with careful design and lots of experimentation, but this kind of design is definitely out of the scope without an established support contract. There is also a caveat: if the ISP's private network is a CGNAT (which it most likely is: running on the same `100.0.0.0/8` ip range as NetBird) and the end user devices receive IP addressing from the same range, it might give you a lot of issues with addressing collisions or end up being impossible alltogether.
saavagebueno commented 2025-11-20 06:07:02 -05:00
Author
Owner
Copy Link

@galiev commented on GitHub (Apr 9, 2025):

@nazarewk Thank you very much!

@galiev commented on GitHub (Apr 9, 2025): @nazarewk Thank you very much!
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
2021 Q4
2022 Q1
2022 Q1
accessibility
acl
agent
agent
Android
Android
api
authentik
automation
azure
battery-usage
bug
cache
client
client-ui
cloud
cloud-only
cloudflare
community
compatibility
config-idp
config-issue
connection
contribution
coturn
cross-vpn
dashboard
data-usage
distribution
dns
docker
documentation
duplicate
enhancement
enhancement
event-stream
feature-request
freebsd
getting-started
go
good first issue
gui
help wanted
home-assistant
idp
inconsistency
integration
integrations
ios
ipv6
jwt
k8s
keycloak
linux
login
macos
management-service
missing-docs
mobile
moved-internal
needs-review
netbird-ui
networking
new-platform
nginx
notification
okta
openwrt
packaging
peer-management
peer-management
peer-management
performance
postgres
posture-checks
psk
pull-request
Mirrored from GitHub Pull Request
 question
refactor
relay
release
rfc
routes
security
security-related
self-hosting
server
signal
sleep-issue
ssh
ssl
status
store
synology
system-compatibility-issue
test-suite
third-party-integration
triage
triage-needed
troubleshooting
UX
waiting-feedback
windows
wontfix
zitadel
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
saavagebueno
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: SVI/netbird#1798
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?