sendnrw/netbird-docs
2
0
Fork 0
mirror of https://github.com/netbirdio/docs.git synced 2026-08-29 03:01:26 +02:00
Code Issues Packages Projects Releases Wiki Activity

docs: add QUIC UDP/443 relay transport to Ports & Firewalls (#937)

Browse Source 
* docs: add QUIC UDP/443 relay transport to Ports & Firewalls

Add UDP/443 (QUIC) alongside TCP/443 (WebSocket) on the relay service
entry, list the current relay above the legacy TURN one, relabel the
TURN entry as legacy, and tighten its fallback note to lead with the
older-client case.

* docs: fix punctuation in relay IPv4 note
This commit is contained in:
Jack Carter
2026-08-19 10:41:36 +02:00
committed by GitHub
parent 25787828ec
commit f42c5c0882
1 changed files with 8 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
src/pages/about-netbird/ports-and-firewalls.mdx
View File

@@ -50,19 +50,20 @@ NetBird usually won't need open ports, but sometimes you or your IT team needs t
* In more restricted environments, `netbird status` will show `keepalive ping failed` errors without a firewall rule for STUN
* Example `nftables` outbound firewall rule: `ip daddr stun.netbird.io udp dport { 80, 443, 3478, 5555 } accept`
* Note that `nftables` resolves hostnames only when the ruleset is loaded, pinning the rule to the IPs resolved at that moment. Since the pool is dynamic and geo-distributed, reload the ruleset periodically or keep the allowlist updated by other means.
* Relay service (UDP/TCP):
* Relay service (TCP/QUIC):
* **Endpoints**: *.relay.netbird.io and relay.netbird.io
* **Ports**: TCP/443 (WebSocket) and UDP/443 (QUIC)
* Clients v0.36.0 and later try both transports and use whichever connects first. If UDP/443 is blocked, the client falls back to WebSocket over TCP/443, so QUIC is an optimization, not a requirement.
* **IPv4**: The list is dynamic and geo-distributed. The `netbird status -d` output shows which relay you are connecting to.
* It is advised to wildcard `*.relay.netbird.io` when possible, to avoid interrupts.
* Relay service (legacy):
* **Endpoint**: turn.netbird.io
* **Legacy fallback only**: clients v0.29.0 and later relay through the NetBird relay service below (`relay.netbird.io` and `*.relay.netbird.io`, TCP/443) and use the legacy TURN relay only when that relay is unreachable or the other peer runs an older client.
* **Legacy fallback only**: needed for clients older than v0.29.0. Newer clients relay through the NetBird relay service above and fall back to this TURN relay only if that relay is unreachable.
* **Port range**: UDP/80,443 and TCP/443-65535
* **IPv4**: The list is dynamic and geo-distributed; we advise you to check the nearest cluster with the following command:
* `nslookup turn.netbird.io`
* In more restricted environments, `netbird status` will show `keepalive ping failed` errors without a firewall rule for the relay
* Example `nftables` outbound firewall rule: `ip daddr turn.netbird.io tcp dport 443-65535 accept`
* Relay service (TCP):
* **Endpoints**: *.relay.netbird.io and relay.netbird.io
* **Port**: TCP/443
* **IPv4**: The list is dynamic and geo-distributed; When looking at the `netbird status -d` output, you can see which relay you are connecting to.
* It is advised to wildcard `*.relay.netbird.io` when possible, to avoid interrupts.
<Note>
Download the full list of NetBird Cloud STUN and Relay endpoints and port requirements in <a href="/docs-static/files/netbird-cloud-endpoints.json" download>JSON format.</a>