Connecting to an exit node causes the peer connections to switch from P2P to Relayed mode #2285

Open
opened 2025-11-20 07:07:03 -05:00 by saavagebueno · 4 comments
Owner

Originally created by @hectorm on GitHub (Sep 15, 2025).

Describe the problem

On Linux, connecting to an exit node causes the peer connections to switch from P2P to Relayed mode. I haven't observed this behavior on Windows.

To Reproduce

Steps to reproduce the behavior:

  1. Open NetBird UI client on Linux.
  2. Start the connection without using an exit node.
  3. Observe that the peer connections are in P2P mode.
  4. Now, enable the exit node option.
  5. Observe that the peer connections switch to Relayed mode.

Expected behavior

Peer connections should remain in P2P mode even when connected through an exit node.

Are you using NetBird Cloud?

No.

NetBird version

0.57.0

Is any other VPN software installed?

No.

Debug output

I reproduced this behavior on a clean installation of Ubuntu 24.04 and Windows 11 in a VM on the same host.

Ubuntu 24.04
  • netbird status -dA (with some redacted info)
    Peers detail:
     netbird-exit-A.peer.netbird.anon-64jdZ.domain:
      NetBird IP: 100.79.1.10
      Public key: sX/2PlPXLgzQaIyILeHBndjuMdHALlzN4WXdcb9Fj1E=
      Status: Connected
      -- detail --
      Connection type: Relayed
      ICE candidate (Local/Remote): -/-
      ICE candidate endpoints (Local/Remote): -/-
      Relay server address: rels://netbird-exit-B.anon-64jdZ.domain:443
      Last connection update: 16 minutes, 48 seconds ago
      Last WireGuard handshake: 30 seconds ago
      Transfer status (received/sent) 1.8 MiB/101.6 KiB
      Quantum resistance: false
      Networks: 0.0.0.0/0
      Latency: 0s
    
     netbird-exit-B.peer.netbird.anon-64jdZ.domain:
      NetBird IP: 100.79.1.11
      Public key: VFwf0FkA56aB+Patbq9YEU3z6SId6l29Sg4G4V1/TEg=
      Status: Connected
      -- detail --
      Connection type: Relayed
      ICE candidate (Local/Remote): -/-
      ICE candidate endpoints (Local/Remote): -/-
      Relay server address: rels://netbird-exit-B.anon-64jdZ.domain:443
      Last connection update: 16 minutes, 48 seconds ago
      Last WireGuard handshake: 54 seconds ago
      Transfer status (received/sent) 5.8 KiB/6.0 KiB
      Quantum resistance: false
      Networks: -
      Latency: 0s
    
     ****.peer.netbird.anon-64jdZ.domain:
      NetBird IP: 100.79.51.78
      Public key: t5vV8KdQdkjV44ArXoxW8VzMWOGakU3KgOC11c+GmUk=
      Status: Connected
      -- detail --
      Connection type: Relayed
      ICE candidate (Local/Remote): -/-
      ICE candidate endpoints (Local/Remote): -/-
      Relay server address: rels://netbird-exit-B.anon-64jdZ.domain:443
      Last connection update: 16 minutes, 48 seconds ago
      Last WireGuard handshake: 1 minute, 59 seconds ago
      Transfer status (received/sent) 860 B/2.9 KiB
      Quantum resistance: false
      Networks: -
      Latency: 0s
    
     ****.peer.netbird.anon-64jdZ.domain:
      NetBird IP: 100.79.54.216
      Public key: GqMX7hOremH8/aKpP5M1v1LPBpLjkvGzgRAAb4i1nCc=
      Status: Connected
      -- detail --
      Connection type: Relayed
      ICE candidate (Local/Remote): -/-
      ICE candidate endpoints (Local/Remote): -/-
      Relay server address: rels://netbird-exit-B.anon-64jdZ.domain:443
      Last connection update: 16 minutes, 48 seconds ago
      Last WireGuard handshake: 2 minutes ago
      Transfer status (received/sent) 828 B/3.0 KiB
      Quantum resistance: false
      Networks: -
      Latency: 0s
    
     ****.peer.netbird.anon-64jdZ.domain:
      NetBird IP: 100.79.76.202
      Public key: DNTma0zJVuyYbcjWdDdTvjNMjDaHVatSi9C41BlJpjs=
      Status: Connected
      -- detail --
      Connection type: Relayed
      ICE candidate (Local/Remote): -/-
      ICE candidate endpoints (Local/Remote): -/-
      Relay server address: rels://netbird-exit-B.anon-64jdZ.domain:443
      Last connection update: 16 minutes, 48 seconds ago
      Last WireGuard handshake: 1 minute, 59 seconds ago
      Transfer status (received/sent) 860 B/3.0 KiB
      Quantum resistance: false
      Networks: -
      Latency: 0s
    
     ****.peer.netbird.anon-64jdZ.domain:
      NetBird IP: 100.79.113.61
      Public key: bVUboOCamFbXbOxK+xbX4jvONWj+E0MdOiEFBmg3uno=
      Status: Connected
      -- detail --
      Connection type: Relayed
      ICE candidate (Local/Remote): -/-
      ICE candidate endpoints (Local/Remote): -/-
      Relay server address: rels://netbird-exit-B.anon-64jdZ.domain:443
      Last connection update: 15 minutes, 47 seconds ago
      Last WireGuard handshake: 1 minute, 4 seconds ago
      Transfer status (received/sent) 1.0 KiB/2.9 KiB
      Quantum resistance: false
      Networks: -
      Latency: 0s
    
     ****.peer.netbird.anon-64jdZ.domain:
      NetBird IP: 100.79.181.161
      Public key: J1lirQtlw9qktjMV7PgcRhPw9v2QXj9XzfrBZsIKVks=
      Status: Connected
      -- detail --
      Connection type: Relayed
      ICE candidate (Local/Remote): -/-
      ICE candidate endpoints (Local/Remote): -/-
      Relay server address: rels://netbird-exit-B.anon-64jdZ.domain:443
      Last connection update: 15 minutes, 46 seconds ago
      Last WireGuard handshake: 13 seconds ago
      Transfer status (received/sent) 2.1 KiB/2.0 KiB
      Quantum resistance: false
      Networks: -
      Latency: 0s
    
     ****.peer.netbird.anon-64jdZ.domain:
      NetBird IP: 100.79.219.166
      Public key: gzdVmwvaMGIHlW01z5eLG7zMnFaYjqxr+43gWQQD9nU=
      Status: Connected
      -- detail --
      Connection type: Relayed
      ICE candidate (Local/Remote): -/-
      ICE candidate endpoints (Local/Remote): -/-
      Relay server address: rels://netbird-exit-B.anon-64jdZ.domain:443
      Last connection update: 16 minutes, 48 seconds ago
      Last WireGuard handshake: 2 minutes ago
      Transfer status (received/sent) 2.1 KiB/3.0 KiB
      Quantum resistance: false
      Networks: -
      Latency: 0s
    
     ****.peer.netbird.anon-64jdZ.domain:
      NetBird IP: 100.79.246.75
      Public key: bGwUYnC3o4ldL35eLg/6f9A5AarQON+zXRkvy9ZmWgo=
      Status: Connected
      -- detail --
      Connection type: Relayed
      ICE candidate (Local/Remote): -/-
      ICE candidate endpoints (Local/Remote): -/-
      Relay server address: rels://netbird-exit-B.anon-64jdZ.domain:443
      Last connection update: 16 minutes, 48 seconds ago
      Last WireGuard handshake: 1 minute, 59 seconds ago
      Transfer status (received/sent) 860 B/3.0 KiB
      Quantum resistance: false
      Networks: -
      Latency: 0s
    
    Events:
      [INFO] NETWORK (ad9e3ebb-844e-4755-a819-1df9cac1406f)
        Message: Default route added
        Time: 17 minutes, 20 seconds ago
        Metadata: id: exit-****, network: 0.0.0.0/0, peer: VFwf0FkA56aB+Patbq9YEU3z6SId6l29Sg4G4V1/TEg=
      [WARNING] NETWORK (3b894dcf-fe8f-4100-ad7b-138fc9b85132)
        Message: Default route disconnected due to peer unreachability
        Time: 17 minutes, 20 seconds ago
        Metadata: id: exit-****, network: 0.0.0.0/0, peer: VFwf0FkA56aB+Patbq9YEU3z6SId6l29Sg4G4V1/TEg=
      [INFO] NETWORK (b25a04e1-f712-4418-9f8f-9bf4475d3fe5)
        Message: Default route added
        Time: 17 minutes, 19 seconds ago
        Metadata: id: exit-****, network: 0.0.0.0/0, peer: sX/2PlPXLgzQaIyILeHBndjuMdHALlzN4WXdcb9Fj1E=
      [INFO] NETWORK (a7ec36ab-f413-43be-a6a3-027db9c29b7e)
        Message: Default route added
        Time: 17 minutes, 19 seconds ago
        Metadata: id: exit-****, network: 0.0.0.0/0, peer: sX/2PlPXLgzQaIyILeHBndjuMdHALlzN4WXdcb9Fj1E=
      [INFO] NETWORK (df5af5f7-63bc-457d-bd2d-6d3717a2653b)
        Message: Default route disconnected due to high availability change
        Time: 16 minutes, 49 seconds ago
        Metadata: id: exit-****, network: 0.0.0.0/0, peer: sX/2PlPXLgzQaIyILeHBndjuMdHALlzN4WXdcb9Fj1E=
      [INFO] NETWORK (d838cc11-fe10-4eaa-866a-c1960320c793)
        Message: Default route added
        Time: 16 minutes, 49 seconds ago
        Metadata: id: exit-****, network: 0.0.0.0/0, peer: VFwf0FkA56aB+Patbq9YEU3z6SId6l29Sg4G4V1/TEg=
      [INFO] NETWORK (dc21bb5d-4725-4155-8484-4caa5cc0ee9f)
        Message: Default route added
        Time: 16 minutes, 49 seconds ago
        Metadata: id: exit-****, network: 0.0.0.0/0, peer: VFwf0FkA56aB+Patbq9YEU3z6SId6l29Sg4G4V1/TEg=
      [WARNING] NETWORK (8467c148-c89c-417d-af98-bb183972d35e)
        Message: Default route disconnected due to peer unreachability
        Time: 16 minutes, 49 seconds ago
        Metadata: id: exit-****, network: 0.0.0.0/0, peer: VFwf0FkA56aB+Patbq9YEU3z6SId6l29Sg4G4V1/TEg=
      [INFO] NETWORK (ca58cc91-a6fa-4f84-86ef-ea688f3b1358)
        Message: Default route added
        Time: 16 minutes, 48 seconds ago
        Metadata: id: exit-****, network: 0.0.0.0/0, peer: sX/2PlPXLgzQaIyILeHBndjuMdHALlzN4WXdcb9Fj1E=
      [INFO] NETWORK (5fcf8844-845e-4b3f-9ffe-d4ab4ff69440)
        Message: Default route added
        Time: 16 minutes, 48 seconds ago
        Metadata: id: exit-****, network: 0.0.0.0/0, peer: sX/2PlPXLgzQaIyILeHBndjuMdHALlzN4WXdcb9Fj1E=
    OS: linux/amd64
    Daemon version: 0.57.0
    CLI version: 0.57.0
    Profile: default
    Management: Connected to https://netbird.anon-64jdZ.domain:443
    Signal: Connected to https://netbird.anon-64jdZ.domain:443
    Relays:
      [stuns:netbird.anon-64jdZ.domain:5349] is Available
      [rels://netbird-exit-B.anon-64jdZ.domain:443] is Available
    Nameservers:
      [8.8.8.8:53, 1.1.1.1:53] for [.] is Available
      [100.79.1.10:5335, 100.79.1.11:5335, 8.8.8.8:53] for [anon-64jdZ.domain, anon-c1owV.domain] is Available
    FQDN: ****.peer.netbird.anon-64jdZ.domain
    NetBird IP: 100.79.122.114/16
    Interface type: Kernel
    Quantum resistance: false
    Lazy connection: false
    Networks: -
    Forwarding rules: 0
    Peers count: 9/9 Connected
    
  • Debug bundle: d1064e6e14a1336c26f7abaf90ce06323515d634e9d4cfc7b50cdb9379ad84ba/63f83625-d34d-498e-a8a6-ad70f774e475

Windows 11
  • netbird status -dA (with some redacted info)
    Peers detail:
     netbird-exit-A.peer.netbird.anon-8DL8x.domain:
      NetBird IP: 100.79.1.10
      Public key: sX/2PlPXLgzQaIyILeHBndjuMdHALlzN4WXdcb9Fj1E=
      Status: Connected
      -- detail --
      Connection type: P2P
      ICE candidate (Local/Remote): host/host
      ICE candidate endpoints (Local/Remote): 10.0.2.15:51820/198.51.100.0:51820
      Relay server address: rels://netbird-exit-****.anon-8DL8x.domain:443
      Last connection update: 2 hours ago
      Last WireGuard handshake: 48 seconds ago
      Transfer status (received/sent) 493.1 MiB/205.1 MiB
      Quantum resistance: false
      Networks: 0.0.0.0/0
      Latency: 0s
    
     netbird-exit-B.peer.netbird.anon-8DL8x.domain:
      NetBird IP: 100.79.1.11
      Public key: VFwf0FkA56aB+Patbq9YEU3z6SId6l29Sg4G4V1/TEg=
      Status: Connected
      -- detail --
      Connection type: P2P
      ICE candidate (Local/Remote): host/host
      ICE candidate endpoints (Local/Remote): 127.0.0.1:51820/198.51.100.1:51820
      Relay server address: rels://netbird-exit-B.anon-8DL8x.domain:443
      Last connection update: 2 hours ago
      Last WireGuard handshake: 1 minute, 28 seconds ago
      Transfer status (received/sent) 5.6 KiB/19.4 KiB
      Quantum resistance: false
      Networks: -
      Latency: 0s
    
     ****.peer.netbird.anon-8DL8x.domain:
      NetBird IP: 100.79.51.78
      Public key: t5vV8KdQdkjV44ArXoxW8VzMWOGakU3KgOC11c+GmUk=
      Status: Connected
      -- detail --
      Connection type: P2P
      ICE candidate (Local/Remote): host/host
      ICE candidate endpoints (Local/Remote): 127.0.0.1:51820/198.51.100.2:51820
      Relay server address: rels://netbird-exit-B.anon-8DL8x.domain:443
      Last connection update: 2 hours ago
      Last WireGuard handshake: 1 minute, 36 seconds ago
      Transfer status (received/sent) 5.3 KiB/19.2 KiB
      Quantum resistance: false
      Networks: -
      Latency: 0s
    
     ****.peer.netbird.anon-8DL8x.domain:
      NetBird IP: 100.79.54.216
      Public key: GqMX7hOremH8/aKpP5M1v1LPBpLjkvGzgRAAb4i1nCc=
      Status: Connected
      -- detail --
      Connection type: P2P
      ICE candidate (Local/Remote): host/host
      ICE candidate endpoints (Local/Remote): 10.0.2.15:51820/198.51.100.3:51820
      Relay server address: rels://netbird-exit-A.anon-8DL8x.domain:443
      Last connection update: 2 hours ago
      Last WireGuard handshake: 1 minute, 37 seconds ago
      Transfer status (received/sent) 5.3 KiB/19.2 KiB
      Quantum resistance: false
      Networks: -
      Latency: 0s
    
     ****.peer.netbird.anon-8DL8x.domain:
      NetBird IP: 100.79.76.202
      Public key: DNTma0zJVuyYbcjWdDdTvjNMjDaHVatSi9C41BlJpjs=
      Status: Connected
      -- detail --
      Connection type: P2P
      ICE candidate (Local/Remote): host/host
      ICE candidate endpoints (Local/Remote): 10.0.2.15:51820/198.51.100.4:51820
      Relay server address: rels://netbird-exit-A.anon-8DL8x.domain:443
      Last connection update: 2 hours ago
      Last WireGuard handshake: 1 minute, 37 seconds ago
      Transfer status (received/sent) 5.2 KiB/19.2 KiB
      Quantum resistance: false
      Networks: -
      Latency: 0s
    
     ****.peer.netbird.anon-8DL8x.domain:
      NetBird IP: 100.79.113.61
      Public key: bVUboOCamFbXbOxK+xbX4jvONWj+E0MdOiEFBmg3uno=
      Status: Connected
      -- detail --
      Connection type: P2P
      ICE candidate (Local/Remote): host/host
      ICE candidate endpoints (Local/Remote): 127.0.0.1:51820/198.51.100.5:51820
      Relay server address: rels://netbird-exit-B.anon-8DL8x.domain:443
      Last connection update: 2 hours ago
      Last WireGuard handshake: 1 minute, 36 seconds ago
      Transfer status (received/sent) 5.3 KiB/19.2 KiB
      Quantum resistance: false
      Networks: -
      Latency: 0s
    
     ****.peer.netbird.anon-8DL8x.domain:
      NetBird IP: 100.79.181.161
      Public key: J1lirQtlw9qktjMV7PgcRhPw9v2QXj9XzfrBZsIKVks=
      Status: Connected
      -- detail --
      Connection type: P2P
      ICE candidate (Local/Remote): host/host
      ICE candidate endpoints (Local/Remote): 127.0.0.1:51820/198.51.100.6:51820
      Relay server address: rels://netbird-exit-A.anon-8DL8x.domain:443
      Last connection update: 2 hours ago
      Last WireGuard handshake: 1 minute, 37 seconds ago
      Transfer status (received/sent) 5.2 KiB/19.2 KiB
      Quantum resistance: false
      Networks: -
      Latency: 0s
    
     ****.peer.netbird.anon-8DL8x.domain:
      NetBird IP: 100.79.219.166
      Public key: gzdVmwvaMGIHlW01z5eLG7zMnFaYjqxr+43gWQQD9nU=
      Status: Connected
      -- detail --
      Connection type: P2P
      ICE candidate (Local/Remote): host/host
      ICE candidate endpoints (Local/Remote): 127.0.0.1:51820/198.51.100.7:51820
      Relay server address: rels://netbird-exit-B.anon-8DL8x.domain:443
      Last connection update: 2 hours ago
      Last WireGuard handshake: 1 minute, 36 seconds ago
      Transfer status (received/sent) 5.3 KiB/19.2 KiB
      Quantum resistance: false
      Networks: -
      Latency: 0s
    
     ****.peer.netbird.anon-8DL8x.domain:
      NetBird IP: 100.79.246.75
      Public key: bGwUYnC3o4ldL35eLg/6f9A5AarQON+zXRkvy9ZmWgo=
      Status: Connected
      -- detail --
      Connection type: P2P
      ICE candidate (Local/Remote): host/host
      ICE candidate endpoints (Local/Remote): 10.0.2.15:51820/198.51.100.8:51820
      Relay server address: rels://netbird-exit-B.anon-8DL8x.domain:443
      Last connection update: 2 hours ago
      Last WireGuard handshake: 1 minute, 36 seconds ago
      Transfer status (received/sent) 5.2 KiB/19.2 KiB
      Quantum resistance: false
      Networks: -
      Latency: 0s
    
    Events:
      [INFO] SYSTEM (d7b955d7-f578-4a9e-a0c5-a8ce65b7e78d)
        Message: Network map updated
        Time: 2 hours ago
      [INFO] SYSTEM (8b54e581-126a-4f08-951c-deb2da22e263)
        Message: Network selection changed
        Time: 1 hour, 57 minutes ago
        Metadata: all: false, append: true, networks: exit-****
      [INFO] NETWORK (e3026528-54d4-4241-8830-251ba0e17ff6)
        Message: Default route added
        Time: 1 hour, 57 minutes ago
        Metadata: id: exit-****, network: 0.0.0.0/0, peer: sX/2PlPXLgzQaIyILeHBndjuMdHALlzN4WXdcb9Fj1E=
      [INFO] NETWORK (23df2d30-b2d9-4359-b01e-97b46193f78d)
        Message: Default route added
        Time: 1 hour, 57 minutes ago
        Metadata: id: exit-****, network: 0.0.0.0/0, peer: sX/2PlPXLgzQaIyILeHBndjuMdHALlzN4WXdcb9Fj1E=
      [INFO] NETWORK (17d5e15d-9944-4394-b05c-dbc653c1a3bf)
        Message: Default route removed
        Time: 1 hour, 53 minutes ago
        Metadata: id: exit-****, network: 0.0.0.0/0, peer: sX/2PlPXLgzQaIyILeHBndjuMdHALlzN4WXdcb9Fj1E=
      [INFO] SYSTEM (b45fb82a-d3aa-4436-bb2b-708547ead430)
        Message: Network deselection changed
        Time: 1 hour, 53 minutes ago
        Metadata: all: false, append: false, networks: exit-****
      [INFO] SYSTEM (a3f89868-98be-44bb-833b-61867d6c122b)
        Message: Network selection changed
        Time: 1 hour, 5 minutes ago
        Metadata: all: false, append: true, networks: exit-****
      [INFO] NETWORK (d47825c3-c230-4b34-9a3f-476414bbd73f)
        Message: Default route added
        Time: 1 hour, 5 minutes ago
        Metadata: id: exit-****, network: 0.0.0.0/0, peer: sX/2PlPXLgzQaIyILeHBndjuMdHALlzN4WXdcb9Fj1E=
      [INFO] NETWORK (74d3bb5e-e01f-4dc4-abea-ad747dd45bf1)
        Message: Default route added
        Time: 1 hour, 5 minutes ago
        Metadata: id: exit-****, network: 0.0.0.0/0, peer: sX/2PlPXLgzQaIyILeHBndjuMdHALlzN4WXdcb9Fj1E=
    OS: windows/amd64
    Daemon version: 0.57.0
    CLI version: 0.57.0
    Profile: default
    Management: Connected to https://netbird.anon-8DL8x.domain:443
    Signal: Connected to https://netbird.anon-8DL8x.domain:443
    Relays:
      [stuns:netbird.anon-8DL8x.domain:5349] is Available
      [rels://netbird-exit-A.anon-8DL8x.domain:443] is Available
    Nameservers:
      [8.8.8.8:53, 1.1.1.1:53] for [.] is Available
      [100.79.1.10:5335, 100.79.1.11:5335, 8.8.8.8:53] for [anon-8DL8x.domain, anon-NXZHG.domain] is Available
    FQDN: ****.peer.netbird.anon-8DL8x.domain
    NetBird IP: 100.79.213.197/16
    Interface type: Userspace
    Quantum resistance: false
    Lazy connection: false
    Networks: -
    Forwarding rules: 0
    Peers count: 9/9 Connected
    
  • Debug bundle: d1064e6e14a1336c26f7abaf90ce06323515d634e9d4cfc7b50cdb9379ad84ba/8418052e-cb79-4c46-8e3b-e04493708073

Originally created by @hectorm on GitHub (Sep 15, 2025). ### Describe the problem On Linux, connecting to an exit node causes the peer connections to switch from P2P to Relayed mode. I haven't observed this behavior on Windows. ### To Reproduce Steps to reproduce the behavior: 1. Open NetBird UI client on Linux. 2. Start the connection without using an exit node. 3. Observe that the peer connections are in P2P mode. 4. Now, enable the exit node option. 5. Observe that the peer connections switch to Relayed mode. ### Expected behavior Peer connections should remain in P2P mode even when connected through an exit node. ### Are you using NetBird Cloud? No. ### NetBird version 0.57.0 ### Is any other VPN software installed? No. ### Debug output I reproduced this behavior on a clean installation of Ubuntu 24.04 and Windows 11 in a VM on the same host. ##### Ubuntu 24.04 * <details><summary>netbird status -dA (with some redacted info)</summary> ``` Peers detail: netbird-exit-A.peer.netbird.anon-64jdZ.domain: NetBird IP: 100.79.1.10 Public key: sX/2PlPXLgzQaIyILeHBndjuMdHALlzN4WXdcb9Fj1E= Status: Connected -- detail -- Connection type: Relayed ICE candidate (Local/Remote): -/- ICE candidate endpoints (Local/Remote): -/- Relay server address: rels://netbird-exit-B.anon-64jdZ.domain:443 Last connection update: 16 minutes, 48 seconds ago Last WireGuard handshake: 30 seconds ago Transfer status (received/sent) 1.8 MiB/101.6 KiB Quantum resistance: false Networks: 0.0.0.0/0 Latency: 0s netbird-exit-B.peer.netbird.anon-64jdZ.domain: NetBird IP: 100.79.1.11 Public key: VFwf0FkA56aB+Patbq9YEU3z6SId6l29Sg4G4V1/TEg= Status: Connected -- detail -- Connection type: Relayed ICE candidate (Local/Remote): -/- ICE candidate endpoints (Local/Remote): -/- Relay server address: rels://netbird-exit-B.anon-64jdZ.domain:443 Last connection update: 16 minutes, 48 seconds ago Last WireGuard handshake: 54 seconds ago Transfer status (received/sent) 5.8 KiB/6.0 KiB Quantum resistance: false Networks: - Latency: 0s ****.peer.netbird.anon-64jdZ.domain: NetBird IP: 100.79.51.78 Public key: t5vV8KdQdkjV44ArXoxW8VzMWOGakU3KgOC11c+GmUk= Status: Connected -- detail -- Connection type: Relayed ICE candidate (Local/Remote): -/- ICE candidate endpoints (Local/Remote): -/- Relay server address: rels://netbird-exit-B.anon-64jdZ.domain:443 Last connection update: 16 minutes, 48 seconds ago Last WireGuard handshake: 1 minute, 59 seconds ago Transfer status (received/sent) 860 B/2.9 KiB Quantum resistance: false Networks: - Latency: 0s ****.peer.netbird.anon-64jdZ.domain: NetBird IP: 100.79.54.216 Public key: GqMX7hOremH8/aKpP5M1v1LPBpLjkvGzgRAAb4i1nCc= Status: Connected -- detail -- Connection type: Relayed ICE candidate (Local/Remote): -/- ICE candidate endpoints (Local/Remote): -/- Relay server address: rels://netbird-exit-B.anon-64jdZ.domain:443 Last connection update: 16 minutes, 48 seconds ago Last WireGuard handshake: 2 minutes ago Transfer status (received/sent) 828 B/3.0 KiB Quantum resistance: false Networks: - Latency: 0s ****.peer.netbird.anon-64jdZ.domain: NetBird IP: 100.79.76.202 Public key: DNTma0zJVuyYbcjWdDdTvjNMjDaHVatSi9C41BlJpjs= Status: Connected -- detail -- Connection type: Relayed ICE candidate (Local/Remote): -/- ICE candidate endpoints (Local/Remote): -/- Relay server address: rels://netbird-exit-B.anon-64jdZ.domain:443 Last connection update: 16 minutes, 48 seconds ago Last WireGuard handshake: 1 minute, 59 seconds ago Transfer status (received/sent) 860 B/3.0 KiB Quantum resistance: false Networks: - Latency: 0s ****.peer.netbird.anon-64jdZ.domain: NetBird IP: 100.79.113.61 Public key: bVUboOCamFbXbOxK+xbX4jvONWj+E0MdOiEFBmg3uno= Status: Connected -- detail -- Connection type: Relayed ICE candidate (Local/Remote): -/- ICE candidate endpoints (Local/Remote): -/- Relay server address: rels://netbird-exit-B.anon-64jdZ.domain:443 Last connection update: 15 minutes, 47 seconds ago Last WireGuard handshake: 1 minute, 4 seconds ago Transfer status (received/sent) 1.0 KiB/2.9 KiB Quantum resistance: false Networks: - Latency: 0s ****.peer.netbird.anon-64jdZ.domain: NetBird IP: 100.79.181.161 Public key: J1lirQtlw9qktjMV7PgcRhPw9v2QXj9XzfrBZsIKVks= Status: Connected -- detail -- Connection type: Relayed ICE candidate (Local/Remote): -/- ICE candidate endpoints (Local/Remote): -/- Relay server address: rels://netbird-exit-B.anon-64jdZ.domain:443 Last connection update: 15 minutes, 46 seconds ago Last WireGuard handshake: 13 seconds ago Transfer status (received/sent) 2.1 KiB/2.0 KiB Quantum resistance: false Networks: - Latency: 0s ****.peer.netbird.anon-64jdZ.domain: NetBird IP: 100.79.219.166 Public key: gzdVmwvaMGIHlW01z5eLG7zMnFaYjqxr+43gWQQD9nU= Status: Connected -- detail -- Connection type: Relayed ICE candidate (Local/Remote): -/- ICE candidate endpoints (Local/Remote): -/- Relay server address: rels://netbird-exit-B.anon-64jdZ.domain:443 Last connection update: 16 minutes, 48 seconds ago Last WireGuard handshake: 2 minutes ago Transfer status (received/sent) 2.1 KiB/3.0 KiB Quantum resistance: false Networks: - Latency: 0s ****.peer.netbird.anon-64jdZ.domain: NetBird IP: 100.79.246.75 Public key: bGwUYnC3o4ldL35eLg/6f9A5AarQON+zXRkvy9ZmWgo= Status: Connected -- detail -- Connection type: Relayed ICE candidate (Local/Remote): -/- ICE candidate endpoints (Local/Remote): -/- Relay server address: rels://netbird-exit-B.anon-64jdZ.domain:443 Last connection update: 16 minutes, 48 seconds ago Last WireGuard handshake: 1 minute, 59 seconds ago Transfer status (received/sent) 860 B/3.0 KiB Quantum resistance: false Networks: - Latency: 0s Events: [INFO] NETWORK (ad9e3ebb-844e-4755-a819-1df9cac1406f) Message: Default route added Time: 17 minutes, 20 seconds ago Metadata: id: exit-****, network: 0.0.0.0/0, peer: VFwf0FkA56aB+Patbq9YEU3z6SId6l29Sg4G4V1/TEg= [WARNING] NETWORK (3b894dcf-fe8f-4100-ad7b-138fc9b85132) Message: Default route disconnected due to peer unreachability Time: 17 minutes, 20 seconds ago Metadata: id: exit-****, network: 0.0.0.0/0, peer: VFwf0FkA56aB+Patbq9YEU3z6SId6l29Sg4G4V1/TEg= [INFO] NETWORK (b25a04e1-f712-4418-9f8f-9bf4475d3fe5) Message: Default route added Time: 17 minutes, 19 seconds ago Metadata: id: exit-****, network: 0.0.0.0/0, peer: sX/2PlPXLgzQaIyILeHBndjuMdHALlzN4WXdcb9Fj1E= [INFO] NETWORK (a7ec36ab-f413-43be-a6a3-027db9c29b7e) Message: Default route added Time: 17 minutes, 19 seconds ago Metadata: id: exit-****, network: 0.0.0.0/0, peer: sX/2PlPXLgzQaIyILeHBndjuMdHALlzN4WXdcb9Fj1E= [INFO] NETWORK (df5af5f7-63bc-457d-bd2d-6d3717a2653b) Message: Default route disconnected due to high availability change Time: 16 minutes, 49 seconds ago Metadata: id: exit-****, network: 0.0.0.0/0, peer: sX/2PlPXLgzQaIyILeHBndjuMdHALlzN4WXdcb9Fj1E= [INFO] NETWORK (d838cc11-fe10-4eaa-866a-c1960320c793) Message: Default route added Time: 16 minutes, 49 seconds ago Metadata: id: exit-****, network: 0.0.0.0/0, peer: VFwf0FkA56aB+Patbq9YEU3z6SId6l29Sg4G4V1/TEg= [INFO] NETWORK (dc21bb5d-4725-4155-8484-4caa5cc0ee9f) Message: Default route added Time: 16 minutes, 49 seconds ago Metadata: id: exit-****, network: 0.0.0.0/0, peer: VFwf0FkA56aB+Patbq9YEU3z6SId6l29Sg4G4V1/TEg= [WARNING] NETWORK (8467c148-c89c-417d-af98-bb183972d35e) Message: Default route disconnected due to peer unreachability Time: 16 minutes, 49 seconds ago Metadata: id: exit-****, network: 0.0.0.0/0, peer: VFwf0FkA56aB+Patbq9YEU3z6SId6l29Sg4G4V1/TEg= [INFO] NETWORK (ca58cc91-a6fa-4f84-86ef-ea688f3b1358) Message: Default route added Time: 16 minutes, 48 seconds ago Metadata: id: exit-****, network: 0.0.0.0/0, peer: sX/2PlPXLgzQaIyILeHBndjuMdHALlzN4WXdcb9Fj1E= [INFO] NETWORK (5fcf8844-845e-4b3f-9ffe-d4ab4ff69440) Message: Default route added Time: 16 minutes, 48 seconds ago Metadata: id: exit-****, network: 0.0.0.0/0, peer: sX/2PlPXLgzQaIyILeHBndjuMdHALlzN4WXdcb9Fj1E= OS: linux/amd64 Daemon version: 0.57.0 CLI version: 0.57.0 Profile: default Management: Connected to https://netbird.anon-64jdZ.domain:443 Signal: Connected to https://netbird.anon-64jdZ.domain:443 Relays: [stuns:netbird.anon-64jdZ.domain:5349] is Available [rels://netbird-exit-B.anon-64jdZ.domain:443] is Available Nameservers: [8.8.8.8:53, 1.1.1.1:53] for [.] is Available [100.79.1.10:5335, 100.79.1.11:5335, 8.8.8.8:53] for [anon-64jdZ.domain, anon-c1owV.domain] is Available FQDN: ****.peer.netbird.anon-64jdZ.domain NetBird IP: 100.79.122.114/16 Interface type: Kernel Quantum resistance: false Lazy connection: false Networks: - Forwarding rules: 0 Peers count: 9/9 Connected ``` </details> * Debug bundle: `d1064e6e14a1336c26f7abaf90ce06323515d634e9d4cfc7b50cdb9379ad84ba/63f83625-d34d-498e-a8a6-ad70f774e475` ##### Windows 11 * <details><summary>netbird status -dA (with some redacted info)</summary> ``` Peers detail: netbird-exit-A.peer.netbird.anon-8DL8x.domain: NetBird IP: 100.79.1.10 Public key: sX/2PlPXLgzQaIyILeHBndjuMdHALlzN4WXdcb9Fj1E= Status: Connected -- detail -- Connection type: P2P ICE candidate (Local/Remote): host/host ICE candidate endpoints (Local/Remote): 10.0.2.15:51820/198.51.100.0:51820 Relay server address: rels://netbird-exit-****.anon-8DL8x.domain:443 Last connection update: 2 hours ago Last WireGuard handshake: 48 seconds ago Transfer status (received/sent) 493.1 MiB/205.1 MiB Quantum resistance: false Networks: 0.0.0.0/0 Latency: 0s netbird-exit-B.peer.netbird.anon-8DL8x.domain: NetBird IP: 100.79.1.11 Public key: VFwf0FkA56aB+Patbq9YEU3z6SId6l29Sg4G4V1/TEg= Status: Connected -- detail -- Connection type: P2P ICE candidate (Local/Remote): host/host ICE candidate endpoints (Local/Remote): 127.0.0.1:51820/198.51.100.1:51820 Relay server address: rels://netbird-exit-B.anon-8DL8x.domain:443 Last connection update: 2 hours ago Last WireGuard handshake: 1 minute, 28 seconds ago Transfer status (received/sent) 5.6 KiB/19.4 KiB Quantum resistance: false Networks: - Latency: 0s ****.peer.netbird.anon-8DL8x.domain: NetBird IP: 100.79.51.78 Public key: t5vV8KdQdkjV44ArXoxW8VzMWOGakU3KgOC11c+GmUk= Status: Connected -- detail -- Connection type: P2P ICE candidate (Local/Remote): host/host ICE candidate endpoints (Local/Remote): 127.0.0.1:51820/198.51.100.2:51820 Relay server address: rels://netbird-exit-B.anon-8DL8x.domain:443 Last connection update: 2 hours ago Last WireGuard handshake: 1 minute, 36 seconds ago Transfer status (received/sent) 5.3 KiB/19.2 KiB Quantum resistance: false Networks: - Latency: 0s ****.peer.netbird.anon-8DL8x.domain: NetBird IP: 100.79.54.216 Public key: GqMX7hOremH8/aKpP5M1v1LPBpLjkvGzgRAAb4i1nCc= Status: Connected -- detail -- Connection type: P2P ICE candidate (Local/Remote): host/host ICE candidate endpoints (Local/Remote): 10.0.2.15:51820/198.51.100.3:51820 Relay server address: rels://netbird-exit-A.anon-8DL8x.domain:443 Last connection update: 2 hours ago Last WireGuard handshake: 1 minute, 37 seconds ago Transfer status (received/sent) 5.3 KiB/19.2 KiB Quantum resistance: false Networks: - Latency: 0s ****.peer.netbird.anon-8DL8x.domain: NetBird IP: 100.79.76.202 Public key: DNTma0zJVuyYbcjWdDdTvjNMjDaHVatSi9C41BlJpjs= Status: Connected -- detail -- Connection type: P2P ICE candidate (Local/Remote): host/host ICE candidate endpoints (Local/Remote): 10.0.2.15:51820/198.51.100.4:51820 Relay server address: rels://netbird-exit-A.anon-8DL8x.domain:443 Last connection update: 2 hours ago Last WireGuard handshake: 1 minute, 37 seconds ago Transfer status (received/sent) 5.2 KiB/19.2 KiB Quantum resistance: false Networks: - Latency: 0s ****.peer.netbird.anon-8DL8x.domain: NetBird IP: 100.79.113.61 Public key: bVUboOCamFbXbOxK+xbX4jvONWj+E0MdOiEFBmg3uno= Status: Connected -- detail -- Connection type: P2P ICE candidate (Local/Remote): host/host ICE candidate endpoints (Local/Remote): 127.0.0.1:51820/198.51.100.5:51820 Relay server address: rels://netbird-exit-B.anon-8DL8x.domain:443 Last connection update: 2 hours ago Last WireGuard handshake: 1 minute, 36 seconds ago Transfer status (received/sent) 5.3 KiB/19.2 KiB Quantum resistance: false Networks: - Latency: 0s ****.peer.netbird.anon-8DL8x.domain: NetBird IP: 100.79.181.161 Public key: J1lirQtlw9qktjMV7PgcRhPw9v2QXj9XzfrBZsIKVks= Status: Connected -- detail -- Connection type: P2P ICE candidate (Local/Remote): host/host ICE candidate endpoints (Local/Remote): 127.0.0.1:51820/198.51.100.6:51820 Relay server address: rels://netbird-exit-A.anon-8DL8x.domain:443 Last connection update: 2 hours ago Last WireGuard handshake: 1 minute, 37 seconds ago Transfer status (received/sent) 5.2 KiB/19.2 KiB Quantum resistance: false Networks: - Latency: 0s ****.peer.netbird.anon-8DL8x.domain: NetBird IP: 100.79.219.166 Public key: gzdVmwvaMGIHlW01z5eLG7zMnFaYjqxr+43gWQQD9nU= Status: Connected -- detail -- Connection type: P2P ICE candidate (Local/Remote): host/host ICE candidate endpoints (Local/Remote): 127.0.0.1:51820/198.51.100.7:51820 Relay server address: rels://netbird-exit-B.anon-8DL8x.domain:443 Last connection update: 2 hours ago Last WireGuard handshake: 1 minute, 36 seconds ago Transfer status (received/sent) 5.3 KiB/19.2 KiB Quantum resistance: false Networks: - Latency: 0s ****.peer.netbird.anon-8DL8x.domain: NetBird IP: 100.79.246.75 Public key: bGwUYnC3o4ldL35eLg/6f9A5AarQON+zXRkvy9ZmWgo= Status: Connected -- detail -- Connection type: P2P ICE candidate (Local/Remote): host/host ICE candidate endpoints (Local/Remote): 10.0.2.15:51820/198.51.100.8:51820 Relay server address: rels://netbird-exit-B.anon-8DL8x.domain:443 Last connection update: 2 hours ago Last WireGuard handshake: 1 minute, 36 seconds ago Transfer status (received/sent) 5.2 KiB/19.2 KiB Quantum resistance: false Networks: - Latency: 0s Events: [INFO] SYSTEM (d7b955d7-f578-4a9e-a0c5-a8ce65b7e78d) Message: Network map updated Time: 2 hours ago [INFO] SYSTEM (8b54e581-126a-4f08-951c-deb2da22e263) Message: Network selection changed Time: 1 hour, 57 minutes ago Metadata: all: false, append: true, networks: exit-**** [INFO] NETWORK (e3026528-54d4-4241-8830-251ba0e17ff6) Message: Default route added Time: 1 hour, 57 minutes ago Metadata: id: exit-****, network: 0.0.0.0/0, peer: sX/2PlPXLgzQaIyILeHBndjuMdHALlzN4WXdcb9Fj1E= [INFO] NETWORK (23df2d30-b2d9-4359-b01e-97b46193f78d) Message: Default route added Time: 1 hour, 57 minutes ago Metadata: id: exit-****, network: 0.0.0.0/0, peer: sX/2PlPXLgzQaIyILeHBndjuMdHALlzN4WXdcb9Fj1E= [INFO] NETWORK (17d5e15d-9944-4394-b05c-dbc653c1a3bf) Message: Default route removed Time: 1 hour, 53 minutes ago Metadata: id: exit-****, network: 0.0.0.0/0, peer: sX/2PlPXLgzQaIyILeHBndjuMdHALlzN4WXdcb9Fj1E= [INFO] SYSTEM (b45fb82a-d3aa-4436-bb2b-708547ead430) Message: Network deselection changed Time: 1 hour, 53 minutes ago Metadata: all: false, append: false, networks: exit-**** [INFO] SYSTEM (a3f89868-98be-44bb-833b-61867d6c122b) Message: Network selection changed Time: 1 hour, 5 minutes ago Metadata: all: false, append: true, networks: exit-**** [INFO] NETWORK (d47825c3-c230-4b34-9a3f-476414bbd73f) Message: Default route added Time: 1 hour, 5 minutes ago Metadata: id: exit-****, network: 0.0.0.0/0, peer: sX/2PlPXLgzQaIyILeHBndjuMdHALlzN4WXdcb9Fj1E= [INFO] NETWORK (74d3bb5e-e01f-4dc4-abea-ad747dd45bf1) Message: Default route added Time: 1 hour, 5 minutes ago Metadata: id: exit-****, network: 0.0.0.0/0, peer: sX/2PlPXLgzQaIyILeHBndjuMdHALlzN4WXdcb9Fj1E= OS: windows/amd64 Daemon version: 0.57.0 CLI version: 0.57.0 Profile: default Management: Connected to https://netbird.anon-8DL8x.domain:443 Signal: Connected to https://netbird.anon-8DL8x.domain:443 Relays: [stuns:netbird.anon-8DL8x.domain:5349] is Available [rels://netbird-exit-A.anon-8DL8x.domain:443] is Available Nameservers: [8.8.8.8:53, 1.1.1.1:53] for [.] is Available [100.79.1.10:5335, 100.79.1.11:5335, 8.8.8.8:53] for [anon-8DL8x.domain, anon-NXZHG.domain] is Available FQDN: ****.peer.netbird.anon-8DL8x.domain NetBird IP: 100.79.213.197/16 Interface type: Userspace Quantum resistance: false Lazy connection: false Networks: - Forwarding rules: 0 Peers count: 9/9 Connected ``` </details> * Debug bundle: `d1064e6e14a1336c26f7abaf90ce06323515d634e9d4cfc7b50cdb9379ad84ba/8418052e-cb79-4c46-8e3b-e04493708073`
saavagebueno added the triage-needed label 2025-11-20 07:07:03 -05:00
Author
Owner

@saule1508 commented on GitHub (Sep 15, 2025):

I believe this is the same as this one: https://github.com/netbirdio/netbird/issues/4069
It was solved for windows and mac, but it is not working on linux

@saule1508 commented on GitHub (Sep 15, 2025): I believe this is the same as this one: https://github.com/netbirdio/netbird/issues/4069 It was solved for windows and mac, but it is not working on linux
Author
Owner

@qay21 commented on GitHub (Oct 3, 2025):

I can confirm that we have the problem as of today with laptops on Linux using an exit node in our private cloud, emulating some kind of "road warrior" VPN. As soon as the exit node is enabled on the client, the connection drops to relayed. Disabling the exit node makes the connection pop back up to P2P.

This behavior is not observed on Android nodes.

@qay21 commented on GitHub (Oct 3, 2025): I can confirm that we have the problem as of today with laptops on Linux using an exit node in our private cloud, emulating some kind of "road warrior" VPN. As soon as the exit node is enabled on the client, the connection drops to relayed. Disabling the exit node makes the connection pop back up to P2P. This behavior is not observed on Android nodes.
Author
Owner

@lepazca commented on GitHub (Nov 6, 2025):

I’m also experiencing this issue. As soon as I start using the exit node, all connections to peers switch from P2P to Relayed, including the connection to the peer acting as the exit node itself. Running on a self-hosted setup here.

Edit: adding debug bundle
c04854b95ffd40870e1dff93227236c1cce3c359fdeb83899a046975941e66e7/81f7c53d-ecc6-4266-bece-6354724505c7

@lepazca commented on GitHub (Nov 6, 2025): I’m also experiencing this issue. As soon as I start using the exit node, all connections to peers switch from P2P to Relayed, including the connection to the peer acting as the exit node itself. Running on a self-hosted setup here. Edit: adding debug bundle `c04854b95ffd40870e1dff93227236c1cce3c359fdeb83899a046975941e66e7/81f7c53d-ecc6-4266-bece-6354724505c7`
Author
Owner

@davidchi2020 commented on GitHub (Nov 7, 2025):

I am experiencing the same issue. I deployed the NetBird management server using a self-hosted setup, with Node A and Node B installed on CentOS 9. Initially, I established a direct P2P connection between them. However, when I configured Node A as an exit node and advertised the default route to Node B, their connection switched to a relayed mode. After disabling the exit node setting, the connection returned to P2P.

Then, I added two routes on Node B, directing the IP of the NetBird management platform and the public IP of Node A to the next-hop address and physical network interface specified by the system’s default route. After reconfiguring the exit node, everything worked correctly, and the connection remained in P2P state.

When checking the routing rules using the  ip rule  command, I noticed that rule 110 matches all traffic not marked with  0x1bd00  and queries the NetBird routing table. My understanding is that the NetBird client should mark management traffic—such as communication with the NetBird management platform and connections to other peers—with the  0x1bd00  tag, so that it bypasses rule 110 and matches the default route in the system’s main routing table. However, in practice, the traffic does not seem to be handled as expected. I suspect that the NetBird client on CentOS may not be correctly marking the management or encapsulated traffic, or the system is not processing the marked traffic properly.

Although I temporarily resolved the issue by manually adding routes, I hope this can be fixed in a future release to reduce the need for manual route configuration, which increases workload and is prone to errors.mmexport1762491425704.jpg

@davidchi2020 commented on GitHub (Nov 7, 2025): I am experiencing the same issue. I deployed the NetBird management server using a self-hosted setup, with Node A and Node B installed on CentOS 9. Initially, I established a direct P2P connection between them. However, when I configured Node A as an exit node and advertised the default route to Node B, their connection switched to a relayed mode. After disabling the exit node setting, the connection returned to P2P. Then, I added two routes on Node B, directing the IP of the NetBird management platform and the public IP of Node A to the next-hop address and physical network interface specified by the system’s default route. After reconfiguring the exit node, everything worked correctly, and the connection remained in P2P state. When checking the routing rules using the  ip rule  command, I noticed that rule 110 matches all traffic not marked with  0x1bd00  and queries the NetBird routing table. My understanding is that the NetBird client should mark management traffic—such as communication with the NetBird management platform and connections to other peers—with the  0x1bd00  tag, so that it bypasses rule 110 and matches the default route in the system’s main routing table. However, in practice, the traffic does not seem to be handled as expected. I suspect that the NetBird client on CentOS may not be correctly marking the management or encapsulated traffic, or the system is not processing the marked traffic properly. Although I temporarily resolved the issue by manually adding routes, I hope this can be fixed in a future release to reduce the need for manual route configuration, which increases workload and is prone to errors.![mmexport1762491425704.jpg](https://github.com/user-attachments/assets/84ba5436-7ab9-45e8-bc8a-50182e9f4224)
Sign in to join this conversation.
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: SVI/netbird#2285