Clarify how to get P2P connections

[Silex]

Is your feature request related to a problem? Please describe.

I have many 5G routers that runs netbird but have relayed connections with windows peers (behind firewall / home wifi). But with peers located on hetzner linux servers, they get P2P connections. I'm trying to open/forward ports so these routers also have P2P connection with the windows peers.

I tried forwarding UDP 51820 to my laptop (home wifi) but that does not seem to help.

I understand the 5G routers suffer from CGNAT issues/etc, but given the Hetzner server is able to get P2P connection with them, I should be able to open ports until I also get P2P connection with them at home.

From what I understand from the ICE logs, it basically tries all interfaces UDP port 51820 until one of them succeed.

Describe the solution you'd like

Something like this in the docs:

NetBird's agent doesn't require any incoming port to be open, but if you want to help it negociate P2P please open the following ports:

- Inbound UDP 51820

Describe alternatives you've considered

Access the 5G routers with a routing peer through the linux server that has P2P connection, but that sounds like a silly solution.

Additional context

I checked these for clues but found nothing:

https://docs.netbird.io/how-to/troubleshooting-client
https://docs.netbird.io/about-netbird/faq

I'm opening a technical issue about why P2P does not work and I'll link it for additional context.

[Blackclaws]

Have you tried changing the port from 51820? If multiple peers behind a firewall share a port it can lead to problems. We've had this issue behind a opnsense firewall.

Most of the things that hold for tailscale hold for netbird as well: https://tailscale.com/kb/1181/firewalls

[Silex]

@Blackclaws thanks, will give it a try.

[demanuPL]

Have you tried changing the port from 51820? If multiple peers behind a firewall share a port it can lead to problems. We've had this issue behind a opnsense firewall.

Most of the things that hold for tailscale hold for netbird as well: https://tailscale.com/kb/1181/firewalls

It working with tailscale, but not with netbird. I can clearly see how OPNSense is blocking netbird traffic to netbird port. I've changed port to 51821, still nothing, also tried to randromize port with -1 in config, still blocked, but tailscale connects p2p without issues, same 2 hosts, I've tried both on and only one (netbird or tailscale) on.

[Silex]

Same here, at home wifi it looks like netbird is unable to use UPnP while Zerotier can, and the rule for port 51820 does not help much (I'm the only netbird laptop at home):

There are ICE logs in the linked issue.

[lixmal]

@Silex did you also open up the firewall for the port or is that included in the port forwarding configuration?

Can you run tcpdump or similar to verify traffic actually arrives on the machine with netbird?

Netbird currently doesn't implement upnp and friends, that's the discrepancy you see

[demanuPL]

@Silex did you also open up the firewall for the port or is that included in the port forwarding configuration?

Can you run tcpdump or similar to verify traffic actually arrives on the machine with netbird?

Netbird currently doesn't implement upnp and friends, that's the discrepancy you see

Are there any plans to implement upnp? In cases like mine where I'm using OPNSense that is the best way to get p2p connection

[Silex]

@lixmal: ah, ok thanks I can stop trying to make UPnP work then 😁

I provided debug logs in #3964 and #3952, but I feel I can improve. I'll try to provide tcpdump traces as well.

I mainly have 2 issues:

• Cannot establish P2P despite opening ports.
• Relay not working or flakey for some peers (seems like it's tied to wiregard handshakes sometimes not happening anymore (e.g last handshake was 1h ago))

Are you ok if I ping you when I have all the debug/network traces? Also I'm in the process of adding more relay servers in the hope it helps isolate the issue.

[Silex]

Ah, good news! I get P2P connexions at home since I removed traefik in front of the relay server (I basically separated the relay server on a machine of its own and it serves HTTPS directly instead of being proxied through traefik).

That opens a lot of explorations, maybe traefik drops connexions or does not handle http3/websockets like netbird is expecting.

I don't get P2P everywhere but much more than before. Will try at work on monday.

[Silex]

These are the monitoring of pings of 8 routers, around 16h15 I switched to relay serving directly, I think the image speaks for itself.

The P2P connexions went away as they came (I'm not relayed again) so there's still investigations to be done but at least it's promising.

[Silex]

lololol @lixmal you were right, I also needed to open the port in windows firewall 🤯 I always assumed netbird took care of the firewall rule but apparently not. Ok I'll make a documentation PR with my findings.

[demanuPL]

It doesn't help in my case (OpenSuse Tumbleweed with firewalld), I have port open od UDP traffic on both firewalld and opnsense but still netbird cannot figure out how to open p2p connection to some hosts.

[Silex]

@demanuPL selfhosted or netbird.io ?

[demanuPL]

@demanuPL selfhosted or netbird.io ?

Self hosted, some of P2P connections works, but not when both routers between are pfSense or OPNSense. Other solutions clearly using NAT-PNP on these routers (both OPNSense and PFSense have upnp monitoring), but not netbird doesn't and falling back to Relayed Connection, even with ports open and NAT udp traffic redirection