SVI/netbird
1
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-05-19 14:41:58 -04:00
Code Issues 3.0k Packages Projects Releases 10 Wiki Activity

Specify the UDP port range used by Netbird clients #541

New Issue
Open
opened 2025-11-20 05:13:25 -05:00 by saavagebueno · 12 comments
saavagebueno commented 2025-11-20 05:13:25 -05:00
Owner
Copy Link

Originally created by @d960124 on GitHub (Dec 12, 2023).

When the Netbird client connects to the server, how to fix the UDP port used by the P2P protocol of the backend WireGuard? Because the network environment has firewall restrictions, only designated ports can be opened. The problem now is that the UDP protocol port cannot be fixed. After setting the port currently used, Netbird will change the port to a new one later. How do I need to configure the client.
Netbird is self-hosted and configured with a default UDP port range!

Originally created by @d960124 on GitHub (Dec 12, 2023). When the Netbird client connects to the server, how to fix the UDP port used by the P2P protocol of the backend WireGuard? Because the network environment has firewall restrictions, only designated ports can be opened. The problem now is that the UDP protocol port cannot be fixed. After setting the port currently used, Netbird will change the port to a new one later. How do I need to configure the client. Netbird is self-hosted and configured with a default UDP port range!
saavagebueno added the feature-requestclienttriage-needed labels 2025-11-20 05:13:25 -05:00
saavagebueno commented 2025-11-20 05:13:25 -05:00
Author
Owner
Copy Link

@Fantu commented on GitHub (Dec 12, 2023):

If you mean the udp port range of coturn server (of netbird server selfhosted), I also had to did different range.
As you can see here you can specify range with these variables in setup.env:
TURN_MIN_PORT (that default is 49152)
TURN_MAX_PORT (that default is 65535)
If you need to change the wireguard port on the client, you need to change "wgport" on the config.json

@Fantu commented on GitHub (Dec 12, 2023): If you mean the udp port range of coturn server (of netbird server selfhosted), I also had to did different range. As you can see [here](https://github.com/netbirdio/netbird/blob/main/infrastructure_files/base.setup.env) you can specify range with these variables in setup.env: TURN_MIN_PORT (that default is 49152) TURN_MAX_PORT (that default is 65535) If you need to change the wireguard port on the client, you need to change "wgport" on the config.json
saavagebueno commented 2025-11-20 05:13:26 -05:00
Author
Owner
Copy Link

@d960124 commented on GitHub (Dec 12, 2023):

The default value is set here, but the client does not comply with this rule. There is a port value lower than this range. I don’t know where the problem is.

@d960124 commented on GitHub (Dec 12, 2023): The default value is set here, but the client does not comply with this rule. There is a port value lower than this range. I don’t know where the problem is.
saavagebueno commented 2025-11-20 05:13:26 -05:00
Author
Owner
Copy Link

@d960124 commented on GitHub (Dec 12, 2023):

listening-port=3478
tls-listening-port=5349
min-port=49152
max-port=50000
fingerprint
lt-cred-mech

@d960124 commented on GitHub (Dec 12, 2023): listening-port=3478 tls-listening-port=5349 min-port=49152 max-port=50000 fingerprint lt-cred-mech
saavagebueno commented 2025-11-20 05:13:26 -05:00
Author
Owner
Copy Link

@Fantu commented on GitHub (Dec 12, 2023):

These seem values of coturn config, I don't understand what you mean for "the client does not comply with this rule".
About coturn if take the correct turnserver.conf on docker start should listen on correct ports and range and to avoid issue.
There can be issue if you change docker-compose.yml and don't take the correct config (will start with default values instead) or if don't have "network_mode: host", can have issues.
Client when contact coturn should create relay connections with a port in the range setted.

@Fantu commented on GitHub (Dec 12, 2023): These seem values of coturn config, I don't understand what you mean for "the client does not comply with this rule". About coturn if take the correct turnserver.conf on docker start should listen on correct ports and range and to avoid issue. There can be issue if you change docker-compose.yml and don't take the correct config (will start with default values instead) or if don't have "network_mode: host", can have issues. Client when contact coturn should create relay connections with a port in the range setted.
saavagebueno commented 2025-11-20 05:13:26 -05:00
Author
Owner
Copy Link

@surik commented on GitHub (Dec 12, 2023):

Hi everyone, the port for the WG interface can be specified in the client config. On Unix-like, this is /etc/netbird/config.json. Which is "WgPort": 51820 by default. Please let me know if this is what you are looking for.

@surik commented on GitHub (Dec 12, 2023): Hi everyone, the port for the WG interface can be specified in the client config. On Unix-like, this is `/etc/netbird/config.json`. Which is `"WgPort": 51820` by default. Please let me know if this is what you are looking for.
saavagebueno commented 2025-11-20 05:13:26 -05:00
Author
Owner
Copy Link

@d960124 commented on GitHub (Dec 12, 2023):

The configuration in /etc/netbird/config.json is 51280. However, netbird actually uses many different UDP ports and they will change. As a result, firewall rules cannot be configured because it is not sure which ports the netbird client needs to use.
So, my question is, how do I specify the port range to use on the Linux client? After specifying the range, I can configure the system firewall and the security group configuration of the cloud host.

image

/etc/netbird/config.json
image

@d960124 commented on GitHub (Dec 12, 2023): The configuration in /etc/netbird/config.json is 51280. However, netbird actually uses many different UDP ports and they will change. As a result, firewall rules cannot be configured because it is not sure which ports the netbird client needs to use. So, my question is, how do I specify the port range to use on the Linux client? After specifying the range, I can configure the system firewall and the security group configuration of the cloud host. ![image](https://github.com/netbirdio/netbird/assets/48110764/82b22ef8-24c0-4459-b757-b54ca7f09f9a) /etc/netbird/config.json ![image](https://github.com/netbirdio/netbird/assets/48110764/6d83c238-9bb8-40bd-bfd6-485c89a5f6eb)
saavagebueno commented 2025-11-20 05:13:26 -05:00
Author
Owner
Copy Link

@d960124 commented on GitHub (Dec 12, 2023):

If you mean the udp port range of coturn server (of netbird server selfhosted), I also had to did different range.
As you can see here you can specify range with these variables in setup.env:
TURN_MIN_PORT (that default is 49152)
TURN_MAX_PORT (that default is 65535)
If you need to change the wireguard port on the client, you need to change "wgport" on the config.json

This configuration only affects the server side of Netbird. As for the port used by the client, does it have nothing to do with this configuration?

@d960124 commented on GitHub (Dec 12, 2023): > If you mean the udp port range of coturn server (of netbird server selfhosted), I also had to did different range. As you can see [here](https://github.com/netbirdio/netbird/blob/main/infrastructure_files/base.setup.env) you can specify range with these variables in setup.env: TURN_MIN_PORT (that default is 49152) TURN_MAX_PORT (that default is 65535) If you need to change the wireguard port on the client, you need to change "wgport" on the config.json[](https://github.com/netbirdio/netbird/blob/main/infrastructure_files/base.setup.env) This configuration only affects the server side of Netbird. As for the port used by the client, does it have nothing to do with this configuration?
saavagebueno commented 2025-11-20 05:13:26 -05:00
Author
Owner
Copy Link

@d960124 commented on GitHub (Dec 12, 2023):

To add, the netbird client is not installed using docker.

@d960124 commented on GitHub (Dec 12, 2023): To add, the netbird client is not installed using docker.
saavagebueno commented 2025-11-20 05:13:27 -05:00
Author
Owner
Copy Link

@mlsmaycon commented on GitHub (Dec 12, 2023):

Hello, @d960124, the port list you shared is used for relay connections. They usually don't need any explicit incoming firewall rules, but the agent needs to be able to send traffic using the UDP connection.

These relay connections are used in case some of the peers are behind a more restricted NAT, like mobile networks, and they ensure peer connectivity when there is no possibility of establishing a direct P2P connection.

If you have a limitation regarding allowing outgoing UDP for some peers, you can configure a relay service with TCP and TLS, so that you can enable communication using a single port, but that only works if only a small part of your netbird peers have this restriction since it will force the other side of the connection to use the dynamic ports.

@mlsmaycon commented on GitHub (Dec 12, 2023): Hello, @d960124, the port list you shared is used for relay connections. They usually don't need any explicit incoming firewall rules, but the agent needs to be able to send traffic using the UDP connection. These relay connections are used in case some of the peers are behind a more restricted NAT, like mobile networks, and they ensure peer connectivity when there is no possibility of establishing a direct P2P connection. If you have a limitation regarding allowing outgoing UDP for some peers, you can configure a relay service with TCP and TLS, so that you can enable communication using a single port, but that only works if only a small part of your netbird peers have this restriction since it will force the other side of the connection to use the dynamic ports.
saavagebueno commented 2025-11-20 05:13:27 -05:00
Author
Owner
Copy Link

@d960124 commented on GitHub (Dec 12, 2023):

How do I configure it now?
If I open the firewall of this node, other hosts cannot access this node. After closing it, they can access it.
Port 51280 has been opened in the firewall!

@d960124 commented on GitHub (Dec 12, 2023): How do I configure it now? If I open the firewall of this node, other hosts cannot access this node. After closing it, they can access it. Port 51280 has been opened in the firewall!
saavagebueno commented 2025-11-20 05:13:27 -05:00
Author
Owner
Copy Link

@bangonkali commented on GitHub (Sep 19, 2024):

Hi guys, i have a beginner level question about the PORT 51280 and how it is being used.

Who actually needs access to it if the port can be closed on firewall for clients?

My understanding is this is only essential on the server side. And should all WG PORT be the same for all peers in a

In the image I changed it to 51281 because I have legacy WG working side by side with Netbird. And it feels like there is an issue if both of them use 51280 but I'm curious why it still works even if I change Netbird's WG PORT to 51281 without changing WG PORT on the netbird server to 51281.

image

@bangonkali commented on GitHub (Sep 19, 2024): Hi guys, i have a beginner level question about the PORT 51280 and how it is being used. Who actually needs access to it if the port can be closed on firewall for clients? My understanding is this is only essential on the server side. And should all WG PORT be the same for all peers in a In the image I changed it to 51281 because I have legacy WG working side by side with Netbird. And it feels like there is an issue if both of them use 51280 but I'm curious why it still works even if I change Netbird's WG PORT to 51281 without changing WG PORT on the netbird server to 51281. ![image](https://github.com/user-attachments/assets/9020a3c1-c9bf-4f84-8b84-79264150e8aa)
saavagebueno commented 2025-11-20 05:13:27 -05:00
Author
Owner
Copy Link

@nazarewk commented on GitHub (Jun 6, 2025):

cross-linking issues related to WireGuard Port selection so they're easier to discover:

@nazarewk commented on GitHub (Jun 6, 2025): cross-linking issues related to WireGuard Port selection so they're easier to discover: - https://github.com/netbirdio/netbird/issues/2703 - https://github.com/netbirdio/netbird/issues/1378 - https://github.com/netbirdio/netbird/issues/546 - https://github.com/netbirdio/netbird/issues/1679
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
2021 Q4
2022 Q1
2022 Q1
accessibility
acl
agent
agent
Android
Android
api
authentik
automation
azure
battery-usage
bug
cache
client
client-ui
cloud
cloud-only
cloudflare
community
compatibility
config-idp
config-issue
connection
contribution
coturn
cross-vpn
dashboard
data-usage
distribution
dns
docker
documentation
duplicate
enhancement
enhancement
event-stream
feature-request
freebsd
getting-started
go
good first issue
gui
help wanted
home-assistant
idp
inconsistency
integration
integrations
ios
ipv6
jwt
k8s
keycloak
linux
login
macos
management-service
missing-docs
mobile
moved-internal
needs-review
netbird-ui
networking
new-platform
nginx
notification
okta
openwrt
packaging
peer-management
peer-management
peer-management
performance
postgres
posture-checks
psk
pull-request
Mirrored from GitHub Pull Request
 question
refactor
relay
release
rfc
routes
security
security-related
self-hosting
server
signal
sleep-issue
ssh
ssl
status
store
synology
system-compatibility-issue
test-suite
third-party-integration
triage
triage-needed
troubleshooting
UX
waiting-feedback
windows
wontfix
zitadel
No Label client feature-request triage-needed
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
saavagebueno
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: SVI/netbird#541
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?