sendnrw/netbird-docs
2
0
Fork 0
mirror of https://github.com/netbirdio/docs.git synced 2026-10-17 02:59:04 +02:00
Code Issues Packages Projects Releases Wiki Activity

docs: name every installer port to close when the node moves behind the load balancer

Browse Source
This commit is contained in:
Jack Carter
2026-09-24 09:16:16 +02:00
parent 0c5ce803b2
commit 31ce871d33
1 changed files with 6 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/pages/selfhosted/maintenance/scaling/high-availability-from-installer.mdx
+6 -1
View File
@@ -295,7 +295,12 @@ From here on, TLS and routing move from the installer's Traefik to your load bal
Keep the installer's `.env` beside it: it supplies the domain, image tags and license key.
Before you start the node, allow ports 80 and 8080 on it from the load balancer only, at a network firewall or cloud security group. The server serves its API and login page on port 80 in plain HTTP, so it must not be reachable from anywhere else. Remove the rules that opened ports 80 and 443 to the internet for Traefik. A host firewall such as UFW or firewalld does not restrict these ports, because Docker-published ports bypass those rules.
Before you start the node, change its rules at a network firewall or cloud security group:
- Allow TCP 80 and 8080 from the load balancer only. The server serves its API and login page on port 80 in plain HTTP, so it must not be reachable from anywhere else.
- Remove the rules the installer needed: TCP 80 and 443 from the internet, which Traefik used, and UDP 3478, which the built-in STUN server used. STUN now runs on the relay instances.
A host firewall such as UFW or firewalld does not restrict these ports, because Docker-published ports bypass those rules.
Then start the node: