From 88d06aa658a86d8fca22710ddbe1f45279673487 Mon Sep 17 00:00:00 2001 From: jnfrati Date: Thu, 15 Oct 2026 14:48:19 +0200 Subject: [PATCH] docs: explain why the external IP map exists and how relay fallback shows up --- src/pages/selfhosted/migration/enable-reverse-proxy.mdx | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/src/pages/selfhosted/migration/enable-reverse-proxy.mdx b/src/pages/selfhosted/migration/enable-reverse-proxy.mdx index 2af088d2..881af5c9 100644 --- a/src/pages/selfhosted/migration/enable-reverse-proxy.mdx +++ b/src/pages/selfhosted/migration/enable-reverse-proxy.mdx @@ -299,7 +299,11 @@ Apply both with `docker compose up -d proxy traefik`. The proxy's main port stay ### Enabling peer-to-peer connectivity -The proxy runs an embedded NetBird client to reach your peers. Like any NetBird client, it discovers its public address through STUN. If no STUN server is reachable, or the STUN server cannot see the proxy's public address (for example, when it runs in an adjacent container on the same host), the proxy only advertises its internal address and peers fall back to a relay. In that case, to let peers establish direct peer-to-peer connections to the proxy: +The proxy runs an embedded NetBird client to reach your peers. Like any NetBird client, it discovers its public address through STUN. If no STUN server is reachable, or the STUN server cannot see the proxy's public address (for example, when it runs in an adjacent container on the same host), the proxy only advertises its internal address and peers fall back to a relay. `NB_PROXY_EXTERNAL_IP_MAP` exists for this case: it tells the proxy which public address to advertise instead. + +Services keep working through the relay, so the failure is easy to miss. On a peer, `netbird status -d` shows the proxy's peer entry with `Connection type: Relayed` instead of `P2P`. See [Troubleshooting relayed connections](/help/troubleshooting-relayed-connections) for how to read this output. + +To let peers establish direct peer-to-peer connections to the proxy: 1. Set a fixed WireGuard port with `NB_PROXY_WG_PORT`. 2. Forward that UDP port on your NAT or firewall to the proxy host, and publish it on the proxy container.