SVI/netbird
1
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-05-14 12:12:27 -04:00
Code Issues 3.0k Packages Projects Releases 10 Wiki Activity

stun server with tcp #917

New Issue
Closed
opened 2025-11-20 05:19:50 -05:00 by saavagebueno · 3 comments
saavagebueno commented 2025-11-20 05:19:50 -05:00
Owner
Copy Link

Originally created by @H777K on GitHub (May 22, 2024).

Describe the problem

Hi i am currently setting up a netbird self-hosted setup. I use coturn as stun/turn server. Coturn is exposed with port 80/tcp and internally forwarded to port 3478/tcp. In the management.json I have specified the tcp protocol for both the stun and the turn server. The turn server works perfectly, but the stun server does not:

netbird status -d output:

Relays: 
  [stun:<dns_name_placeholder>:80] is Unavailable, reason: stun request: context deadline exceeded
  [turn:<dns_name_placeholder>:80?transport=tcp] is Available

content of management.json:

{
    "Stuns": [
	{
            "Proto": "tcp",
            "URI": "stun:<dns_name_placeholder>:80",
            "Username": "",
            "Password": ""
        }
    ],
    "TURNConfig": {
        "TimeBasedCredentials": false,
        "CredentialsTTL": "0s",
        "Secret": "",
        "Turns": [
            {
                "Proto": "tcp",
                "URI": "turn:<dns_name_placeholder>:80?transport=tcp",
                "Username": "myuser",
                "Password": "mypassword"
            },
        ]
    },

If i set stun:<dns_name_placeholder>:80?transport=tcp in the management.json, the stun server no longer appears when i execute netbird status -d. If i remove the stun server completely from the management.json, everything still works.
This leads to some questions for me:

  1. How can i use the stun server with tcp, is something missing in my configuration?
  2. Is a stun server mandatory or is it sufficient to use just a turn server?
  3. What are the disadvantages of using the stun/turn server with tcp instead of udp?

Expected behavior

I would expect the stun server to also work via tcp, like the turn server

Are you using NetBird Cloud?

no (self-hosted NetBird's control plane)

NetBird version

0.27.7

Originally created by @H777K on GitHub (May 22, 2024). **Describe the problem** Hi i am currently setting up a netbird self-hosted setup. I use coturn as stun/turn server. Coturn is exposed with port 80/tcp and internally forwarded to port 3478/tcp. In the management.json I have specified the tcp protocol for both the stun and the turn server. The turn server works perfectly, but the stun server does not: **netbird status -d output:** ``` Relays: [stun:<dns_name_placeholder>:80] is Unavailable, reason: stun request: context deadline exceeded [turn:<dns_name_placeholder>:80?transport=tcp] is Available ``` **content of management.json:** ```json { "Stuns": [ { "Proto": "tcp", "URI": "stun:<dns_name_placeholder>:80", "Username": "", "Password": "" } ], "TURNConfig": { "TimeBasedCredentials": false, "CredentialsTTL": "0s", "Secret": "", "Turns": [ { "Proto": "tcp", "URI": "turn:<dns_name_placeholder>:80?transport=tcp", "Username": "myuser", "Password": "mypassword" }, ] }, ``` If i set `stun:<dns_name_placeholder>:80?transport=tcp` in the management.json, the stun server no longer appears when i execute `netbird status -d`. If i remove the stun server completely from the management.json, everything still works. This leads to some questions for me: 1. How can i use the stun server with tcp, is something missing in my configuration? 2. Is a stun server mandatory or is it sufficient to use just a turn server? 3. What are the disadvantages of using the stun/turn server with tcp instead of udp? **Expected behavior** I would expect the stun server to also work via tcp, like the turn server **Are you using NetBird Cloud?** no (self-hosted NetBird's control plane) **NetBird version** 0.27.7
saavagebueno added the self-hosting label 2025-11-20 05:19:50 -05:00
saavagebueno commented 2025-11-20 05:19:51 -05:00
Author
Owner
Copy Link

@lixmal commented on GitHub (May 22, 2024):

How can i use the stun server with tcp, is something missing in my configuration?

You will have to forward the UDP port instead of TCP. STUN is a UDP protocol.

Is a stun server mandatory or is it sufficient to use just a turn server?

It can be the same endpoint, but you will at minimum need STUN, unless there are no peers behind NAT.

What are the disadvantages of using the stun/turn server with tcp instead of udp?

TURN via TCP (e.g. on port 443) has a higher chance to be allowed in restricted client environments, otherwise UDP is preferable for performance for relayed connections

@lixmal commented on GitHub (May 22, 2024): > How can i use the stun server with tcp, is something missing in my configuration? You will have to forward the UDP port instead of TCP. STUN is a UDP protocol. > Is a stun server mandatory or is it sufficient to use just a turn server? It can be the same endpoint, but you will at minimum need STUN, unless there are no peers behind NAT. > What are the disadvantages of using the stun/turn server with tcp instead of udp? TURN via TCP (e.g. on port 443) has a higher chance to be allowed in restricted client environments, otherwise UDP is preferable for performance for relayed connections
saavagebueno commented 2025-11-20 05:19:51 -05:00
Author
Owner
Copy Link

@H777K commented on GitHub (Jun 24, 2024):

@lixmal Thank you for the explanation

@H777K commented on GitHub (Jun 24, 2024): @lixmal Thank you for the explanation
saavagebueno commented 2025-11-20 05:19:51 -05:00
Author
Owner
Copy Link

@markcst commented on GitHub (Dec 24, 2024):

I'm encountering this as well. Same error. I think I've opened all the right ports on my router (which is behind a modem that gives it the wan connection), I wrote firewall traffic rules (OpenWrt) but nothing to do, I can't reach out my stun/turn server (which is on a router vlan, btw). Idk if it's useful, but I'm using Traefik.

So my peers in lan can see each other and can ping themselves at the mesh IPs (after I wrote some traffic rules for the communication between their vlans), but my 4G (wan) Android peer can't even ping the ones in the lan - of course it's inside the vpn mesh and I can see it connected to it while it's in 4G.

On Trickle ICE I always end up like this
image

@markcst commented on GitHub (Dec 24, 2024): I'm encountering this as well. Same error. I think I've opened all the right ports on my router (which is behind a modem that gives it the wan connection), I wrote firewall traffic rules (OpenWrt) but nothing to do, I can't reach out my stun/turn server (which is on a router vlan, btw). Idk if it's useful, but I'm using Traefik. So my peers in lan can see each other and can ping themselves at the mesh IPs (after I wrote some traffic rules for the communication between their vlans), but my 4G (wan) Android peer can't even ping the ones in the lan - of course it's inside the vpn mesh and I can see it connected to it while it's in 4G. On [Trickle ICE](https://webrtc.github.io/samples/src/content/peerconnection/trickle-ice/) I always end up like this ![image](https://github.com/user-attachments/assets/865129d0-c9ba-4582-ac04-7c03130ccff4)
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
2021 Q4
2022 Q1
2022 Q1
accessibility
acl
agent
agent
Android
Android
api
authentik
automation
azure
battery-usage
bug
cache
client
client-ui
cloud
cloud-only
cloudflare
community
compatibility
config-idp
config-issue
connection
contribution
coturn
cross-vpn
dashboard
data-usage
distribution
dns
docker
documentation
duplicate
enhancement
enhancement
event-stream
feature-request
freebsd
getting-started
go
good first issue
gui
help wanted
home-assistant
idp
inconsistency
integration
integrations
ios
ipv6
jwt
k8s
keycloak
linux
login
macos
management-service
missing-docs
mobile
moved-internal
needs-review
netbird-ui
networking
new-platform
nginx
notification
okta
openwrt
packaging
peer-management
peer-management
peer-management
performance
postgres
posture-checks
psk
pull-request
Mirrored from GitHub Pull Request
 question
refactor
relay
release
rfc
routes
security
security-related
self-hosting
server
signal
sleep-issue
ssh
ssl
status
store
synology
system-compatibility-issue
test-suite
third-party-integration
triage
triage-needed
troubleshooting
UX
waiting-feedback
windows
wontfix
zitadel
No Label self-hosting
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
saavagebueno
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: SVI/netbird#917
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?