SVI/netbird
1
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-06-10 17:31:53 -04:00
Code Issues 3.0k Packages Projects Releases 10 Wiki Activity

Does netbird support tcp relay(coturn)? #681

New Issue
Closed
opened 2025-11-20 05:15:55 -05:00 by saavagebueno · 5 comments
saavagebueno commented 2025-11-20 05:15:55 -05:00
Owner
Copy Link

Originally created by @xiaolei0125 on GitHub (Mar 6, 2024).

Describe the problem

Does netbird support tcp relay?
if I set no-udp and no-udp-relay in coturn turnserver.conf, the netbird get error

netbird status -d
Relays: 
  [stun:stunserver.stunprotocol.org:3478] is Available
  [stun:stun.freeswitch.org:3478] is Available
  [turn:turn.xx.top:3478?transport=tcp] is Unavailable, reason: allocate: Allocate error response (error 442: UDP Transport is not allowed by the TURN Server configuration)

if I set no-udp, but unset no-udp-relay in coturn turnserver.conf, the netbird status no error, but It seem that netbird client use udp to connect coturn relay :

netbird status -d
Relays: 
  [stun:stunserver.stunprotocol.org:3478] is Available
  [stun:stun.freeswitch.org:3478] is Available
  [turn:turn.xx.top:3478?transport=tcp] is Available

NetBird version

Daemon version: 0.26.2
CLI version: 0.26.2
Management: Connected to https://nb.xx.top:8443
Signal: Connected to https://nb.xx.top:8443
Relays: 
  [stun:stunserver.stunprotocol.org:3478] is Available
  [stun:stun.freeswitch.org:3478] is Available
  [turn:turn.xx.top:3478?transport=tcp] is Available
FQDN: m1.nb.iot
NetBird IP: 100.64.0.3/16
Interface type: Kernel
Quantum resistance: false
Peers count: 3/6 Connected

Maybe Related issue:
#414

Originally created by @xiaolei0125 on GitHub (Mar 6, 2024). **Describe the problem** Does netbird support tcp relay? if I set no-udp and no-udp-relay in coturn turnserver.conf, the netbird get error ``` netbird status -d Relays: [stun:stunserver.stunprotocol.org:3478] is Available [stun:stun.freeswitch.org:3478] is Available [turn:turn.xx.top:3478?transport=tcp] is Unavailable, reason: allocate: Allocate error response (error 442: UDP Transport is not allowed by the TURN Server configuration) ``` if I set no-udp, but unset no-udp-relay in coturn turnserver.conf, the netbird status no error, but It seem that netbird client use udp to connect coturn relay : ``` netbird status -d Relays: [stun:stunserver.stunprotocol.org:3478] is Available [stun:stun.freeswitch.org:3478] is Available [turn:turn.xx.top:3478?transport=tcp] is Available ``` **NetBird version** ``` Daemon version: 0.26.2 CLI version: 0.26.2 Management: Connected to https://nb.xx.top:8443 Signal: Connected to https://nb.xx.top:8443 Relays: [stun:stunserver.stunprotocol.org:3478] is Available [stun:stun.freeswitch.org:3478] is Available [turn:turn.xx.top:3478?transport=tcp] is Available FQDN: m1.nb.iot NetBird IP: 100.64.0.3/16 Interface type: Kernel Quantum resistance: false Peers count: 3/6 Connected ``` Maybe Related issue: #414
saavagebueno added the questionself-hostingcoturn labels 2025-11-20 05:15:55 -05:00
saavagebueno commented 2025-11-20 05:15:56 -05:00
Author
Owner
Copy Link

@mlsmaycon commented on GitHub (Mar 8, 2024):

It does, but you need to configure it with TLS.

Mainly, you need to configure the certificates for Coturn, then in the management.json, replace the following:

turn:netbird.example.com:3478 -> turns:netbird.example.com:3478?transport=tcp
@mlsmaycon commented on GitHub (Mar 8, 2024): It does, but you need to configure it with TLS. Mainly, you need to configure the certificates for Coturn, then in the management.json, replace the following: ``` turn:netbird.example.com:3478 -> turns:netbird.example.com:3478?transport=tcp ```
saavagebueno commented 2025-11-20 05:15:56 -05:00
Author
Owner
Copy Link

@xiaolei0125 commented on GitHub (Mar 11, 2024):

@mlsmaycon Thanks for you reply.
I configured the certificates for Coturn server and set tls-listening-port=6479, then changed management.json to use turns, but still get same error:

Relays: 
  [stun:stun.freeswitch.org:3478] is Available
  [turns:turn-home.xxx.top:6479?transport=tcp] is Unavailable, reason: allocate: Allocate error response (error 442: UDP Transport is not allowed by the TURN Server configuration)

When I unset(remove) no-udp-relay in coturn turnserver.conf, the netbird status get normal.

Relays: 
  [stun:stun.freeswitch.org:3478] is Available
  [turns:turn-home.xxx.top:6479?transport=tcp] is Available

But netbird client still use udp for relay connection.

# netstat -luntp | grep turn
tcp        0      0 192.168.1.105:6479      0.0.0.0:*               LISTEN      325933/turnserver   
udp        0      0 192.168.1.105:49014     0.0.0.0:*                           325933/turnserver   
udp        0      0 192.168.1.105:49039     0.0.0.0:*                           325933/turnserver

This coturn server logs:

121: (1): INFO: IPv4. tcp or tls connected to: 61.183.86.1:4187
121: (1): INFO: session 000000000000000016: realm <turn-home.xxx.top> user <>: incoming packet message processed, error 401: Unauthorized
121: (1): INFO: session 000000000000000016: realm <turn-home.xxx.top> user <self>: incoming packet ALLOCATE processed, error 442: UDP Transport is not allowed by the TURN Server configuration
121: (1): INFO: session 000000000000000016: realm <turn-home.xxx.top> user <self>: incoming packet message processed, error 442: UDP Transport is not allowed by the TURN Server configuration
121: (1): INFO: session 000000000000000016: TCP socket closed remotely 61.183.86.1:4187
121: (1): INFO: session 000000000000000016: usage: realm=<turn-home.xxx.top>, username=<self>, rp=2, rb=148, sp=2, sb=216
121: (1): INFO: session 000000000000000016: peer usage: realm=<turn-home.xxx.top>, username=<self>, rp=0, rb=0, sp=0, sb=0
121: (1): INFO: session 000000000000000016: closed (2nd stage), user <self> realm <turn-home.xxx.top> origin <>, local 192.168.1.105:6479, remote 61.183.86.1:4187, reason: TCP connection closed by client (callback)
@xiaolei0125 commented on GitHub (Mar 11, 2024): @mlsmaycon Thanks for you reply. I configured the certificates for Coturn server and set `tls-listening-port=6479`, then changed management.json to use turns, but still get same error: ``` Relays: [stun:stun.freeswitch.org:3478] is Available [turns:turn-home.xxx.top:6479?transport=tcp] is Unavailable, reason: allocate: Allocate error response (error 442: UDP Transport is not allowed by the TURN Server configuration) ``` When I unset(remove) `no-udp-relay` in coturn turnserver.conf, the netbird status get normal. ``` Relays: [stun:stun.freeswitch.org:3478] is Available [turns:turn-home.xxx.top:6479?transport=tcp] is Available ``` But netbird client still use udp for relay connection. ``` # netstat -luntp | grep turn tcp 0 0 192.168.1.105:6479 0.0.0.0:* LISTEN 325933/turnserver udp 0 0 192.168.1.105:49014 0.0.0.0:* 325933/turnserver udp 0 0 192.168.1.105:49039 0.0.0.0:* 325933/turnserver ``` This coturn server logs: ``` 121: (1): INFO: IPv4. tcp or tls connected to: 61.183.86.1:4187 121: (1): INFO: session 000000000000000016: realm <turn-home.xxx.top> user <>: incoming packet message processed, error 401: Unauthorized 121: (1): INFO: session 000000000000000016: realm <turn-home.xxx.top> user <self>: incoming packet ALLOCATE processed, error 442: UDP Transport is not allowed by the TURN Server configuration 121: (1): INFO: session 000000000000000016: realm <turn-home.xxx.top> user <self>: incoming packet message processed, error 442: UDP Transport is not allowed by the TURN Server configuration 121: (1): INFO: session 000000000000000016: TCP socket closed remotely 61.183.86.1:4187 121: (1): INFO: session 000000000000000016: usage: realm=<turn-home.xxx.top>, username=<self>, rp=2, rb=148, sp=2, sb=216 121: (1): INFO: session 000000000000000016: peer usage: realm=<turn-home.xxx.top>, username=<self>, rp=0, rb=0, sp=0, sb=0 121: (1): INFO: session 000000000000000016: closed (2nd stage), user <self> realm <turn-home.xxx.top> origin <>, local 192.168.1.105:6479, remote 61.183.86.1:4187, reason: TCP connection closed by client (callback) ```
saavagebueno commented 2025-11-20 05:15:56 -05:00
Author
Owner
Copy Link

@xiaolei0125 commented on GitHub (Mar 18, 2024):

@mlsmaycon Can you give me some guidance on this issue? Thanks!

@xiaolei0125 commented on GitHub (Mar 18, 2024): @mlsmaycon Can you give me some guidance on this issue? Thanks!
saavagebueno commented 2025-11-20 05:15:56 -05:00
Author
Owner
Copy Link

@Zaunei commented on GitHub (Jun 18, 2024):

It does, but you need to configure it with TLS.

Seems to work even without TLS 🤔

❯ netbird status -d
Peers detail:
 client01.netbird.selfhosted:
  NetBird IP: 100.118.118.52
  Public key: xxx
  Status: Connected
  -- detail --
  Connection type: Relayed
  Direct: false
  ICE candidate (Local/Remote): relay/relay
  ICE candidate endpoints (Local/Remote): 172.16.24.5:50566/172.16.24.5:59589
  Last connection update: 11 minutes, 31 seconds ago
  Last WireGuard handshake: 44 seconds ago
  Transfer status (received/sent) 8.4 MiB/303.0 KiB
  Quantum resistance: false
  Routes: 10.101.0.0/16, 10.102.0.0/16, 10.109.0.0/16
  Latency: 28.6305ms

OS: darwin/arm64
Daemon version: 0.27.10
CLI version: 0.27.10
Management: Connected to https://netbird-poc.dummy.tld:443
Signal: Connected to https://netbird-poc.dummy.tld:443
Relays:
  [stun:netbird-poc-turn.domain.tld:3478] is Available
  [stun:netbird-poc-turn.domain.tld:443] is Available
  [turn:netbird-poc-turn.domain.tld:3478?transport=udp] is Available
  [turn:netbird-poc-turn.domain.tld:443?transport=tcp] is Available
Nameservers:
FQDN: xyz.netbird.selfhosted
NetBird IP: 100.118.92.35/16
Interface type: Userspace
Quantum resistance: false
Routes: -
Peers count: 1/1 Connected
@Zaunei commented on GitHub (Jun 18, 2024): > It does, but you need to configure it with TLS. Seems to work even without TLS 🤔 ``` ❯ netbird status -d Peers detail: client01.netbird.selfhosted: NetBird IP: 100.118.118.52 Public key: xxx Status: Connected -- detail -- Connection type: Relayed Direct: false ICE candidate (Local/Remote): relay/relay ICE candidate endpoints (Local/Remote): 172.16.24.5:50566/172.16.24.5:59589 Last connection update: 11 minutes, 31 seconds ago Last WireGuard handshake: 44 seconds ago Transfer status (received/sent) 8.4 MiB/303.0 KiB Quantum resistance: false Routes: 10.101.0.0/16, 10.102.0.0/16, 10.109.0.0/16 Latency: 28.6305ms OS: darwin/arm64 Daemon version: 0.27.10 CLI version: 0.27.10 Management: Connected to https://netbird-poc.dummy.tld:443 Signal: Connected to https://netbird-poc.dummy.tld:443 Relays: [stun:netbird-poc-turn.domain.tld:3478] is Available [stun:netbird-poc-turn.domain.tld:443] is Available [turn:netbird-poc-turn.domain.tld:3478?transport=udp] is Available [turn:netbird-poc-turn.domain.tld:443?transport=tcp] is Available Nameservers: FQDN: xyz.netbird.selfhosted NetBird IP: 100.118.92.35/16 Interface type: Userspace Quantum resistance: false Routes: - Peers count: 1/1 Connected ```
saavagebueno commented 2025-11-20 05:15:57 -05:00
Author
Owner
Copy Link

@xiaolei0125 commented on GitHub (Jun 24, 2024):

@Zaunei No, you need to set coturn server to closed udp

@xiaolei0125 commented on GitHub (Jun 24, 2024): @Zaunei No, you need to set coturn server to closed udp
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
2021 Q4
2022 Q1
2022 Q1
accessibility
acl
agent
agent
Android
Android
api
authentik
automation
azure
battery-usage
bug
cache
client
client-ui
cloud
cloud-only
cloudflare
community
compatibility
config-idp
config-issue
connection
contribution
coturn
cross-vpn
dashboard
data-usage
distribution
dns
docker
documentation
duplicate
enhancement
enhancement
event-stream
feature-request
freebsd
getting-started
go
good first issue
gui
help wanted
home-assistant
idp
inconsistency
integration
integrations
ios
ipv6
jwt
k8s
keycloak
linux
login
macos
management-service
missing-docs
mobile
moved-internal
needs-review
netbird-ui
networking
new-platform
nginx
notification
okta
openwrt
packaging
peer-management
peer-management
peer-management
performance
postgres
posture-checks
psk
pull-request
Mirrored from GitHub Pull Request
 question
refactor
relay
release
rfc
routes
security
security-related
self-hosting
server
signal
sleep-issue
ssh
ssl
status
store
synology
system-compatibility-issue
test-suite
third-party-integration
triage
triage-needed
troubleshooting
UX
waiting-feedback
windows
wontfix
zitadel
No Label coturn question self-hosting
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
saavagebueno
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: SVI/netbird#681
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?