sendnrw/netbird-docs
2
0
Fork 0
mirror of https://github.com/netbirdio/docs.git synced 2026-10-20 04:29:04 +02:00
Code Issues Packages Projects Releases Wiki Activity

docs: BYOP run command and exposing L4 ports, with a host-networking option (#1008)

Browse Source 
* docs: BYOP run command and exposing L4 ports, with a host-networking option

- Bring Your Own Proxy: update the docker run commands to the dashboard
  wizard's current form (NB_PROXY_ADDRESS=:443, named certificate volume);
  the image listens on 8443 by default and runs as uid 1000.
- Bring Your Own Proxy: new section on exposing TCP and UDP services:
  publish and open each listen port, the recreate it takes, a pre-published
  range, or host networking and its port-1024 limit.
- Enable Reverse Proxy: note that changing ports recreates the proxy, and
  document host networking with the two settings it needs.
- Reverse Proxy overview: point BYOP users to the new section.

* docs(reverse-proxy): UFW does not filter Docker-published ports; host mode needs Traefik's ProxyService route
This commit is contained in:
Jack Carter
2026-09-30 18:59:24 +02:00
committed by GitHub
parent 24fe038a7d
commit dff289cb8b
3 changed files with 82 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/pages/manage/reverse-proxy/index.mdx
+1 -1
View File
@@ -378,7 +378,7 @@ The dashboard indicates whether a proxy cluster supports custom ports when you s
</Note>
<Warning>
**Self-hosted Docker deployments:** The default Docker Compose configuration only routes port 443 (via Traefik TLS passthrough) to the proxy container, where the proxy's main port is `8443` (`NB_PROXY_ADDRESS`). A TLS service given listen port `443` in such a deployment therefore listens on a custom port inside the container, not on the main port. L4 services that listen on additional TCP or UDP ports require you to manually expose those ports in your `docker-compose.yml`. See the [migration guide](/selfhosted/migration/enable-reverse-proxy#exposing-l4-ports) for instructions.
**Self-hosted Docker deployments:** The default Docker Compose configuration only routes port 443 (via Traefik TLS passthrough) to the proxy container, where the proxy's main port is `8443` (`NB_PROXY_ADDRESS`). A TLS service given listen port `443` in such a deployment therefore listens on a custom port inside the container, not on the main port. L4 services that listen on additional TCP or UDP ports require you to manually expose those ports in your `docker-compose.yml`. See the [migration guide](/selfhosted/migration/enable-reverse-proxy#exposing-l4-ports) for instructions. A Bring Your Own Proxy deployment has the same requirement; see [Expose TCP and UDP services](/manage/reverse-proxy/bring-your-own-proxy#expose-tcp-and-udp-services). In both cases, running the proxy on the host network removes the per-port Docker step.
</Warning>
### How services share ports