From 31f2b6c7ad46a1daa37cdbbcdbdd72c0e9d3490c Mon Sep 17 00:00:00 2001 From: Bruno Mercier Costa <94469565+emrcbrn@users.noreply.github.com> Date: Wed, 15 Jul 2026 13:55:09 +0200 Subject: [PATCH] Surface the DC WireGuard port conflict in the troubleshooting flow (#853) Link the existing "WireGuard port conflict on Domain Controllers" guidance (on /manage/dns/internal-dns-servers) from two pages a troubleshooting-hub user could not previously reach it from: - Windows client troubleshooting: a bullet under Windows DNS scenarios for the "NetBird won't start on a DC" symptom. - DNS troubleshooting: a note after the AD/DC issue, disambiguating the client-running-on-the-DC case. No content duplicated; both are pointers to the one existing section. Co-authored-by: Claude Opus 4.8 --- src/pages/help/troubleshooting-client/windows.mdx | 1 + src/pages/manage/dns/troubleshooting.mdx | 4 ++++ 2 files changed, 5 insertions(+) diff --git a/src/pages/help/troubleshooting-client/windows.mdx b/src/pages/help/troubleshooting-client/windows.mdx index 5185322e..ea4e16ed 100644 --- a/src/pages/help/troubleshooting-client/windows.mdx +++ b/src/pages/help/troubleshooting-client/windows.mdx @@ -41,6 +41,7 @@ DNS on Windows has a few platform-specific failure modes worth checking separate - **Match-domain names don't resolve, even though the NRPT (Name Resolution Policy Table) rule was written.** A lingering Group Policy `DnsPolicyConfig` container can stop NetBird's rule from taking effect on an off-domain machine. See [DNS Troubleshooting: Issue 8 (lingering GPO)](/manage/dns/troubleshooting#issue-8-windows-nrpt-rule-is-written-but-never-takes-effect-lingering-gpo). - **Active Directory login, mapped drives, or DFS fail** while a file share by IP works. This is usually a DC-locator (`SRV` record) problem. See [Domain Controllers as routing peers](/manage/dns/internal-dns-servers#domain-controllers-as-routing-peers). +- **NetBird won't start on a Domain Controller** and the peer shows disconnected. The Windows DNS Server service can claim WireGuard's UDP port 51820 before NetBird does, so the tunnel never comes up. See [WireGuard port conflict on Domain Controllers](/manage/dns/internal-dns-servers#wire-guard-port-conflict-on-domain-controllers). For the full DNS diagnostic flow on any platform, see [DNS Troubleshooting](/manage/dns/troubleshooting). diff --git a/src/pages/manage/dns/troubleshooting.mdx b/src/pages/manage/dns/troubleshooting.mdx index bd6659b6..7b48200a 100644 --- a/src/pages/manage/dns/troubleshooting.mdx +++ b/src/pages/manage/dns/troubleshooting.mdx @@ -473,6 +473,10 @@ A domain resource only resolves `A`/`AAAA` records. Active Directory also depend - Add a **DNS nameserver** with match domain `corp.example.com` pointing at the DC's IP, distributed to your remote-users group — see [Active Directory & Windows File Shares → Give clients corp DNS](/use-cases/remote-access/active-directory#step-5-give-clients-corp-dns). - Confirm the DC itself is reachable through the routing peer on the AD ports — see [Reaching a Domain Controller through a routing peer](/manage/dns/internal-dns-servers#reaching-a-domain-controller-through-a-routing-peer). + +Running the NetBird client directly **on** a Domain Controller is a separate case: it can fail to start when the Windows DNS Server service has already claimed WireGuard's UDP port 51820. See [WireGuard port conflict on Domain Controllers](/manage/dns/internal-dns-servers#wire-guard-port-conflict-on-domain-controllers). + + --- ### Issue 8: Windows NRPT rule is written but never takes effect (lingering GPO)