SVI/netbird
1
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-06-10 01:12:51 -04:00
Code Issues 3.0k Packages Projects Releases 10 Wiki Activity

Netbird Self-Hosted - P2P is not working - Connections are Relayed #2113

New Issue
Open
opened 2025-11-20 07:04:04 -05:00 by saavagebueno · 3 comments
saavagebueno commented 2025-11-20 07:04:04 -05:00
Owner
Copy Link

Originally created by @maxideus85 on GitHub (Jul 25, 2025).

I have a test environment with an Ubuntu VM running Docker CE and the Netbird server containers deployed following the advanced guide. I also deployed a container for the Netbird agent on the same host to act as an exit node that's using host networking. As a test, I also deployed the Linux Netbird agent directly on the Ubuntu host itself and also got the same result.

In the prior version of 0.51.1 for all containers and agents, I was able to get P2P connections between my Windows 11 endpoint and the exit node. However, in the latest release of 0.51.2, I am now only able to get relayed connections. I have ensured and verified that all documented and required ports are accessible so I don't think it's a firewall or NAT issue on the server side.

Windows 11 endpoint Upload key
e72bcca5e3d73634c00a7b0be17aa15a54a72dd723d9fe22619affbdd23db377/1bb5e298-06b6-4fd4-8f89-e310fd5c685e

Ubuntu Docker host Upload key
e72bcca5e3d73634c00a7b0be17aa15a54a72dd723d9fe22619affbdd23db377/08403185-8cb6-4b30-93e8-f1a5a42cf53f

Originally created by @maxideus85 on GitHub (Jul 25, 2025). I have a test environment with an Ubuntu VM running Docker CE and the Netbird server containers deployed following the advanced guide. I also deployed a container for the Netbird agent on the same host to act as an exit node that's using host networking. As a test, I also deployed the Linux Netbird agent directly on the Ubuntu host itself and also got the same result. In the prior version of 0.51.1 for all containers and agents, I was able to get P2P connections between my Windows 11 endpoint and the exit node. However, in the latest release of 0.51.2, I am now only able to get relayed connections. I have ensured and verified that all documented and required ports are accessible so I don't think it's a firewall or NAT issue on the server side. Windows 11 endpoint Upload key e72bcca5e3d73634c00a7b0be17aa15a54a72dd723d9fe22619affbdd23db377/1bb5e298-06b6-4fd4-8f89-e310fd5c685e Ubuntu Docker host Upload key e72bcca5e3d73634c00a7b0be17aa15a54a72dd723d9fe22619affbdd23db377/08403185-8cb6-4b30-93e8-f1a5a42cf53f
saavagebueno commented 2025-11-20 07:04:06 -05:00
Author
Owner
Copy Link

@lixmal commented on GitHub (Jul 25, 2025):

I noticed two things in your logs:

  1. You seem to run the exit node on the Netbird server, which makes the stun server return 127.0.0.1 as "public IP".
    The machine also doesn't have a public IP on its interface. The result is that this peer cannot transmit its public IP as a candidate. I suggest either using an external stun server or setting up this netbird up flag:

     --external-ip-map strings         Sets external IPs maps between local addresses and interfaces.You can specify a comma-separated list with a single IP and IP/IP or IP/Interface Name. An empty string "" clears the previous configuration. E.g. --external-ip-map 12.34.56.78/10.0.0.1 or --external-ip-map 12.34.56.200,12.34.56.78/10.0.0.1,12.34.56.80/eth1 or --external-ip-map ""

  2. The client peer is missing the STUN server for some reason:

    Relays: 
  [rel://vpn.anon-QMHla.domain:33080] is Available

    This leads to this peer not being able to transmit its public IP either

Fixing either of these should restore P2P.

@lixmal commented on GitHub (Jul 25, 2025): I noticed two things in your logs: 1. You seem to run the exit node on the Netbird server, which makes the stun server return `127.0.0.1` as "public IP". The machine also doesn't have a public IP on its interface. The result is that this peer cannot transmit its public IP as a candidate. I suggest either using an external stun server or setting up this `netbird up` flag: > --external-ip-map strings Sets external IPs maps between local addresses and interfaces.You can specify a comma-separated list with a single IP and IP/IP or IP/Interface Name. An empty string "" clears the previous configuration. E.g. --external-ip-map 12.34.56.78/10.0.0.1 or --external-ip-map 12.34.56.200,12.34.56.78/10.0.0.1,12.34.56.80/eth1 or --external-ip-map "" 2. The client peer is missing the STUN server for some reason: ``` Relays: [rel://vpn.anon-QMHla.domain:33080] is Available ``` This leads to this peer not being able to transmit its public IP either Fixing either of these should restore P2P.
saavagebueno commented 2025-11-20 07:04:06 -05:00
Author
Owner
Copy Link

@maxideus85 commented on GitHub (Jul 25, 2025):

Hi there,

Thank you very much for looking into this!

I originally had designated the Netbird agent Docker container as the exit node but ran into the relay issue I described. To troubleshoot, I installed the Linux agent on the Docker host itself, but it had the same issues.

The Docker host and the containers are behind a firewall. I had a firewall hair pinning issue if I used the public IP of "vpn.domain.com". This is why I added an internal host record so that vpn.domain.com resolves to itself, 127.0.0.1.

Now your suggestion on the Linux agent appears to have corrected the problem and allowed P2P. This was the command I had to run:

netbird down
netbird up --management-url https://domain.vpn.com:33073 --admin-url https://vpn.domain.com --setup-key <key> --external-ip-map <external IP>/<LAN IP>

Is there a way to specify the "--external-ip-map" for a Docker agent? This is the command I have been using:

docker run -d --name DOCKER_NETBIRD_PEER --hostname DOCKER_NETBIRD_PEER --add-host vpn.domain.com:<internal IP> --cap-add=NET_ADMIN --network host -e NB_SETUP_KEY=<key> -v netbird-client:/etc/netbird -e NB_MANAGEMENT_URL=https://vpn.domain.com:33073 netbirdio/netbird:latest

Follow-up question, for Windows agents on the same LAN as the Docker host, I had to add a host file to get around hair pinning. Does --external-ip-map work for Windows Netbird agents?

@maxideus85 commented on GitHub (Jul 25, 2025): Hi there, Thank you very much for looking into this! I originally had designated the Netbird agent Docker container as the exit node but ran into the relay issue I described. To troubleshoot, I installed the Linux agent on the Docker host itself, but it had the same issues. The Docker host and the containers are behind a firewall. I had a firewall hair pinning issue if I used the public IP of "vpn.domain.com". This is why I added an internal host record so that vpn.domain.com resolves to itself, 127.0.0.1. Now your suggestion on the Linux agent appears to have corrected the problem and allowed P2P. This was the command I had to run: `netbird down` `netbird up --management-url https://domain.vpn.com:33073 --admin-url https://vpn.domain.com --setup-key <key> --external-ip-map <external IP>/<LAN IP>` Is there a way to specify the "--external-ip-map" for a Docker agent? This is the command I have been using: `docker run -d --name DOCKER_NETBIRD_PEER --hostname DOCKER_NETBIRD_PEER --add-host vpn.domain.com:<internal IP> --cap-add=NET_ADMIN --network host -e NB_SETUP_KEY=<key> -v netbird-client:/etc/netbird -e NB_MANAGEMENT_URL=https://vpn.domain.com:33073 netbirdio/netbird:latest` Follow-up question, for Windows agents on the same LAN as the Docker host, I had to add a host file to get around hair pinning. Does --external-ip-map work for Windows Netbird agents?
saavagebueno commented 2025-11-20 07:04:06 -05:00
Author
Owner
Copy Link

@lixmal commented on GitHub (Jul 29, 2025):

Is there a way to specify the "--external-ip-map" for a Docker agent?

NB_EXTERNAL_IP_MAP as env var should work.

Follow-up question, for Windows agents on the same LAN as the Docker host, I had to add a host file to get around hair pinning. Does --external-ip-map work for Windows Netbird agents?

Yes

@lixmal commented on GitHub (Jul 29, 2025): >Is there a way to specify the "--external-ip-map" for a Docker agent? `NB_EXTERNAL_IP_MAP` as env var should work. >Follow-up question, for Windows agents on the same LAN as the Docker host, I had to add a host file to get around hair pinning. Does --external-ip-map work for Windows Netbird agents? Yes
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
2021 Q4
2022 Q1
2022 Q1
accessibility
acl
agent
agent
Android
Android
api
authentik
automation
azure
battery-usage
bug
cache
client
client-ui
cloud
cloud-only
cloudflare
community
compatibility
config-idp
config-issue
connection
contribution
coturn
cross-vpn
dashboard
data-usage
distribution
dns
docker
documentation
duplicate
enhancement
enhancement
event-stream
feature-request
freebsd
getting-started
go
good first issue
gui
help wanted
home-assistant
idp
inconsistency
integration
integrations
ios
ipv6
jwt
k8s
keycloak
linux
login
macos
management-service
missing-docs
mobile
moved-internal
needs-review
netbird-ui
networking
new-platform
nginx
notification
okta
openwrt
packaging
peer-management
peer-management
peer-management
performance
postgres
posture-checks
psk
pull-request
Mirrored from GitHub Pull Request
 question
refactor
relay
release
rfc
routes
security
security-related
self-hosting
server
signal
sleep-issue
ssh
ssl
status
store
synology
system-compatibility-issue
test-suite
third-party-integration
triage
triage-needed
troubleshooting
UX
waiting-feedback
windows
wontfix
zitadel
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
saavagebueno
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: SVI/netbird#2113
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?