sendnrw/netbird-docs
2
0
Fork 0
mirror of https://github.com/netbirdio/docs.git synced 2026-09-28 17:59:05 +02:00
Code Issues Packages Projects Releases Wiki Activity

docs: explain why the WireGuard port is not a required firewall rule (#1005)

Browse Source
This commit is contained in:
Jack Carter
2026-09-28 11:38:01 +02:00
committed by GitHub
parent 4df2518616
commit 8eafcdc59e
1 changed files with 4 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/pages/about-netbird/ports-and-firewalls.mdx
+4
View File
@@ -18,6 +18,10 @@ This section covers **network/perimeter firewall** requirements (e.g., Fortigate
The NetBird client doesn't require any inbound port to be open; it negotiates the connection with the support of the signal and relay services.
<Note>
NetBird peers use WireGuard over UDP (default port `51820`), but you don't need to open that port inbound. Peers connect outbound and use hole punching. If a direct connection isn't possible, they fall back to the relay over UDP/443 (QUIC) or TCP/443 (WebSocket). An outbound rule for UDP port 51820 won't reliably help either: the port a peer sends to is whatever the NAT in front of the other peer assigned, and that is often not 51820. If your policy requires fixed ports, see [Static peer ports for site-to-site firewall rules](#static-peer-ports-for-site-to-site-firewall-rules).
</Note>
### Outbound ports
NetBird usually won't need open ports, but sometimes you or your IT team needs to secure and verify all outbound traffic, and that may affect how NetBird clients connect to the [control plane](/about-netbird/how-netbird-works) and negotiate the peer-to-peer connections.