Jack Carter 3f02e402da docs: masquerade-off HA is achievable, not impossible (#893)
* docs: masquerade-off HA is achievable, not impossible

Both the routing-peers page and the masquerade page stated that high
availability "stops working" with masquerade off. That reads as a flat
impossibility and loses a legitimate use case (source IP preservation for
audit, per-user database rules, or firewall policy keyed on the real source).

What is actually true is narrower: NetBird's half of the failover still
works, clients move to the standby peer on their own. What is missing is the
return route inside the destination network following that move. State the
condition instead of the impossibility, and add a short section on what
meeting it takes: distinct metrics so the active peer is the same for every
client, plus a virtual IP or a router-moved route so the next hop follows.
Both live outside NetBird, so the section names the pattern rather than
shipping a third-party config we would then own.

Also:

- Soften "failover is automatic and immediate". Clients re-select within
  seconds, which is fast but not instant, and "immediate" invites a support
  ticket from anyone who measures it. Phrased so it does not assert whether
  the client or the management side detects the loss, which this change did
  not verify.
- Warn against pointing the return route at both peers, as two static routes
  or an equal-cost pair. It is the intuitive fix and it fails silently.
- Note that the second interruption on recovery cannot be avoided by pinning
  the virtual IP to the standby, since the client's switch back is automatic.
  Pinning the route while the client moves back strands the return path.
- The return route can live on the destination subnet's default gateway even
  when the gateway and the routing peer share that subnet, which is the only
  option when the destination host is not the customer's to configure. The
  page previously offered the gateway only for a different-subnet
  destination, and its persistent-config steps assume host access throughout.

* docs: health check must cross the path, not test the peer

A routing peer can stay enrolled and report healthy, with its WireGuard
interface present, while being unable to forward from the tunnel to the
destination subnet: a failed LAN interface, or a firewall change. Nothing
fails over in that state. NetBird sees a reachable peer, and a health check
that only looks for the interface sees a healthy one, so the return route
stays pointed at a peer that forwards nothing until someone intervenes.

Say that the check has to reach a destination through the tunnel.

* docs: held connections stall across a failover, they do not reset

Measured on a routing-peer pair with masquerade off: a held TCP connection
survives the switch. Four failovers, graceful shutdown and hard kill, all
showed the same signature — one round trip with multi-second latency, then the
same connection continuing with monotonic sequence numbers. No resets, and no
RST on the wire in any of them.

The reason is a property of masquerade being off: the addresses on the
connection do not change when another peer takes over, so the flow is portable
between peers, and the routed ACL accepts on addresses rather than on
connection state, so the standby forwards mid-stream packets it never saw a
handshake for.

Note this is specific to masquerade being off. The general high-availability
section still says established connections reset, which is the masquerade-on
default, where the standby would translate to a different source address.

Also trims the mechanism guidance to name the pattern rather than lean on any
one implementation, since which mechanism is right may change.

* docs: scope the reset claim to masquerade on, fix leftover contradiction

Review of the branch turned up three problems.

The Networks overview still said disabling masquerade 'breaks high
availability', one click from the page arguing it does not. Reworded to say it
makes high availability something you arrange rather than something you get.

Neither reset/stall sentence named its masquerade scope, so a reader with
masquerade off met both and they flatly disagreed. The general failover section
now scopes its reset claim to masquerade on, names the reason (the standby
translates to a different source address), and links onward.

'Stalls for the length of the failover' understated it. Measured stalls were 6
to 13 seconds against a 6 second failover, because the sender waits for its
next retransmit after the path returns. Says so, with the range, and keeps the
claim hedged to what was observed rather than asserting connections are never
broken.
2026-08-03 09:52:02 +02:00
2024-03-08 16:27:55 +01:00
2026-07-27 11:08:52 +02:00
2023-05-25 11:32:38 +02:00
2026-07-27 11:08:52 +02:00
2026-07-27 11:08:52 +02:00
2026-02-02 17:33:09 +01:00
2026-07-10 21:31:28 +02:00
2026-07-27 11:08:52 +02:00
2025-11-21 11:24:17 +01:00
2026-01-12 23:01:42 +01:00

The NetBird documentation

This repository contains assets required to build the documentation website for NetBird. It is built using Next.js with MDX support, a modern React framework for building static and dynamic websites.

We're glad that you want to contribute!

Requirements

  • node 16
  • npm 8+

Installation

$ npm install

Local Development

$ npm run dev

This command starts a local development server and opens up a browser window. Most changes are reflected live without having to restart the server.

Contributing to the docs

You can click the Fork button in the upper-right area of the screen to create a copy of this repository in your GitHub account. This copy is called a fork. Make any changes you want in your fork, and when you are ready to send those changes to us, go to your fork and create a new pull request to let us know about it.

Once your pull request is created, a NetBird reviewer will take responsibility for providing clear, actionable feedback. As the owner of the pull request, it is your responsibility to modify your pull request to address the feedback that has been provided to you by the NetBird reviewer.

Also, note that you may end up having more than one NetBird reviewer provide you feedback or you may end up getting feedback from a NetBird reviewer that is different than the one initially assigned to provide you feedback.

Furthermore, in some cases, one of your reviewers might ask for a technical review from a NetBird author when needed. Reviewers will do their best to provide feedback in a timely fashion but response time can vary based on circumstances.

Code of conduct

Participation in the NetBird community is governed by the NetBirds' Code of Conduct.

Components and Use

This documentation uses several custom MDX components. Here's a guide to the most commonly used components:

Alert Components

Use these components to highlight important information:

Note

Displays informational content with an orange theme:

import {Note} from "@/components/mdx"

<Note>
    NetBird is an **[open-source](https://github.com/netbirdio/netbird)** project and can be self-hosted.
    See a comparison between the self-hosted and cloud-hosted versions [here](/selfhosted/self-hosted-vs-cloud-netbird).
</Note>

Warning

Displays warning content with a red theme:

import {Warning} from "@/components/mdx"

<Warning>
    The API is still in Beta state so some errors might not be handled properly yet.
</Warning>

Success

Displays success messages with a green theme:

import {Success} from "@/components/mdx"

<Success>
    Your configuration has been successfully applied.
</Success>

Tiles Component

Displays a grid of clickable cards with hover effects. Perfect for listing related resources or guides:

import {Tiles} from "@/components/Tiles"

<Tiles 
  title="About NetBird" 
  id="about-netbird" 
  items={[
    {
      href: '/about-netbird/how-netbird-works',
      name: 'How NetBird Works',
      description: 'Learn about NetBird concepts, architecture, protocols, and how it creates secure networks.',
    },
    {
      href: '/about-netbird/netbird-vs-traditional-vpn',
      name: 'NetBird vs. Traditional VPN',
      description: 'Discover how NetBird compares to traditional VPNs and understand the advantages of Zero Trust networking.',
    },
  ]} 
/>

Props:

  • title (string, required): The heading title for the tiles section
  • id (string, optional): Optional id for the heading anchor
  • items (array, required): Array of objects with href, name, and description
  • buttonText (string, optional): Button text (defaults to "Read more" - currently unused as cards are fully clickable)

YouTube Component

Embeds YouTube videos with customizable parameters:

import {YouTube} from "@/components/YouTube"

<YouTube videoId="CFa7SY4Up9k" />

// With custom parameters
<YouTube 
  videoId="CFa7SY4Up9k" 
  title="Video Title"
  start={175}
  color="white"
  modestbranding={1}
  rel={1}
/>

// Or use a URL instead of videoId
<YouTube url="https://www.youtube.com/watch?v=CFa7SY4Up9k" />

Props:

  • videoId (string): YouTube video ID
  • url (string): YouTube URL (alternative to videoId)
  • title (string, optional): Video title
  • start (number, optional): Start time in seconds
  • color (string, optional): Progress bar color - 'white' or 'red' (default: 'white')
  • modestbranding (number, optional): Reduces YouTube branding - 0 or 1 (default: 1)
  • controls (number, optional): Show/hide controls - 0, 1, or 2 (default: 1)
  • rel (number, optional): Show related videos - 0 or 1 (default: 1)

Button Component

Creates styled buttons with multiple variants:

import {Button} from "@/components/Button"

// Primary button (default)
<Button href="https://app.netbird.io/install" arrow="right">
  Get started
</Button>

// Secondary button
<Button href="/path" variant="secondary">
  Learn more
</Button>

// Outline button
<Button href="/path" variant="outline">
  Explore
</Button>

// Text button
<Button href="/path" variant="text" arrow="right">
  Read more
</Button>

// With left arrow
<Button href="/path" arrow="left">
  Back
</Button>

Props:

  • variant (string, optional): Button style - 'primary', 'secondary', 'filled', 'outline', or 'text' (default: 'primary')
  • href (string, optional): Link URL (creates a link if provided, otherwise renders as button)
  • arrow (string, optional): Arrow icon - 'left' or 'right'
  • children (required): Button text content

Other Common Components

Row and Col

Create two-column layouts:

import {Row, Col} from "@/components/mdx"

<Row>
  <Col>
    Left column content
  </Col>
  <Col sticky>
    Right column content (sticky on scroll)
  </Col>
</Row>

Properties and Property

Define API properties or configuration options:

import {Properties, Property} from "@/components/mdx"

<Properties>
  <Property name="apiKey" type="string" required>
    Your API key for authentication.
  </Property>
  <Property name="timeout" type="number" min={0} max={300}>
    Request timeout in seconds (default: 30).
  </Property>
</Properties>

Badge

Displays small status badges:

import {Badge} from "@/components/mdx"

<Badge>New</Badge>
<Badge variant="secondary">Beta</Badge>

Code Blocks

Code syntax highlighting (automatically available):

\`\`\`bash
npm install
npm run dev
\`\`\`

// Or use code groups for multiple languages
<CodeGroup>
  ```bash title="Installation"
  npm install
yarn install
```

Thank you

NetBird thrives on community participation, and we appreciate your contributions to our website and our documentation!

Description
No description provided
Readme BSD-3-Clause 310 MiB
Languages
MDX 91.2%
JavaScript 7.7%
TypeScript 0.5%
Shell 0.3%
CSS 0.1%