* docs: add corporate firewalls table to Ports & Firewalls Add a "Corporate firewalls" section covering common enterprise firewall and SASE products (Palo Alto, Fortinet, Cisco, Check Point, Zscaler, Netskope, Cloudflare Gateway, Sophos, SonicWall, Barracuda). It explains how NetBird behaves through a corporate firewall, that it falls back to the TCP/443 relay when direct peer-to-peer is blocked so peers stay connected, and what to allow per product, including which TLS inspection feature to exclude the NetBird domains from. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * docs: refine corporate firewalls section and cross-link from troubleshooting Address review feedback on the new Corporate firewalls section: - Distinguish the two firewall failure modes. Blocking outbound UDP falls back to the TCP/443 relay, but TLS/DPI inspection of the control plane can prevent connecting at all. - Correct the STUN vs TURN roles. STUN enables direct connections, while TURN and the relay service are the fallback, not a way to keep connections direct. - Make the relay domains explicit in the inspection-bypass guidance, since a *.netbird.io wildcard does not match the deeper *.relay.netbird.io hosts. Cross-link the section from the relayed-connections guide (Step 3) and the troubleshooting hub, since a corporate firewall blocking UDP is a common cause of relayed connections. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * docs: add Palo Alto source-NAT guidance and surface firewalls at relay escalation Corporate firewalls: note that some enterprise firewalls apply per-destination (symmetric) source NAT, which defeats hole punching and forces the relay. Add the port-preserving fix, with Palo Alto's Persistent Dynamic IP And Port mode in its row and a general note covering the pattern and UDP session timeouts. Relayed connections: the symmetric-NAT cause is often a corporate firewall the operator controls, so reference the Corporate firewalls section at the final escalation step, and scope the earlier "no firewall tuning will change that" claim to mobile and cloud NAT where it actually holds. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * docs: address second review pass on corporate firewalls guidance - Broaden the firewall failure modes beyond UDP blocking and TLS inspection to include blocked or proxied outbound TCP/443 and strict destination egress, which break the control plane before any inspection. - Note that reaching the NetBird service endpoints does not by itself prove a direct peer path, since a firewall can allow STUN/TURN yet block UDP to peer addresses. Qualify the relayed-connections conclusion accordingly. - Match the STUN/TURN fix to the transport that netbird status reports: STUN is UDP 80/443/3478/5555, TURN is UDP 80/443 plus TCP 443-65535, rather than applying STUN's UDP ports to TURN. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * docs: drop TURN wording from corporate firewalls guidance Refer to the outbound relay endpoints as "relay" rather than "STUN/TURN" and "Relay (TURN)" in the Corporate firewalls section, in line with NetBird's relay terminology. Endpoint hostnames are unchanged. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * docs: replace TURN wording with relay in user-facing docs TURN is legacy in NetBird, so the user-facing docs now call it the relay service: - Ports & Firewalls: rename the "Relay (TURN) service" endpoint and split the two relay endpoints by transport (UDP/TCP and TCP) to keep them distinct, and drop TURN from the notes and the JSON-download line. - Relayed-connections and troubleshooting hub: drop TURN from the status and rollout wording and the connectivity chip label. - Zero Trust use case: describe STUN and relay instead of STUN/TURN. Endpoint hostnames (turn.netbird.io) and the netbird status output are unchanged. Self-hosted coturn documentation is intentionally left as-is, since there TURN refers to the actual legacy software. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * docs: scope TURN wording changes to Ports & Firewalls and relayed connections Revert the TURN wording in the troubleshooting hub chip and the Zero Trust use case, keeping the TURN-to-relay rename limited to the Ports & Firewalls and relayed-connections docs for now. The corporate-firewalls cross-link chip in the hub stays. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * docs: sort the corporate firewalls table alphabetically Order the firewall and SASE rows alphabetically by product (Barracuda through Zscaler) so readers can scan for their vendor. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * docs: add pfSense and OPNsense to the corporate firewalls table Add pfSense and OPNsense rows, each linking to its existing NetBird setup section for keeping connections direct (Static Port outbound NAT, or Endpoint-Independent NAT / EIM-NAT beta on pfSense). Broaden the table intro from "enterprise" firewalls since these are open-source firewalls. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
The NetBird documentation
This repository contains assets required to build the documentation website for NetBird. It is built using Next.js with MDX support, a modern React framework for building static and dynamic websites.
We're glad that you want to contribute!
Requirements
- node 16
- npm 8+
Installation
$ npm install
Local Development
$ npm run dev
This command starts a local development server and opens up a browser window. Most changes are reflected live without having to restart the server.
Contributing to the docs
You can click the Fork button in the upper-right area of the screen to create a copy of this repository in your GitHub account. This copy is called a fork. Make any changes you want in your fork, and when you are ready to send those changes to us, go to your fork and create a new pull request to let us know about it.
Once your pull request is created, a NetBird reviewer will take responsibility for providing clear, actionable feedback. As the owner of the pull request, it is your responsibility to modify your pull request to address the feedback that has been provided to you by the NetBird reviewer.
Also, note that you may end up having more than one NetBird reviewer provide you feedback or you may end up getting feedback from a NetBird reviewer that is different than the one initially assigned to provide you feedback.
Furthermore, in some cases, one of your reviewers might ask for a technical review from a NetBird author when needed. Reviewers will do their best to provide feedback in a timely fashion but response time can vary based on circumstances.
Code of conduct
Participation in the NetBird community is governed by the NetBirds' Code of Conduct.
Components and Use
This documentation uses several custom MDX components. Here's a guide to the most commonly used components:
Alert Components
Use these components to highlight important information:
Note
Displays informational content with an orange theme:
import {Note} from "@/components/mdx"
<Note>
NetBird is an **[open-source](https://github.com/netbirdio/netbird)** project and can be self-hosted.
See a comparison between the self-hosted and cloud-hosted versions [here](/selfhosted/self-hosted-vs-cloud-netbird).
</Note>
Warning
Displays warning content with a red theme:
import {Warning} from "@/components/mdx"
<Warning>
The API is still in Beta state so some errors might not be handled properly yet.
</Warning>
Success
Displays success messages with a green theme:
import {Success} from "@/components/mdx"
<Success>
Your configuration has been successfully applied.
</Success>
Tiles Component
Displays a grid of clickable cards with hover effects. Perfect for listing related resources or guides:
import {Tiles} from "@/components/Tiles"
<Tiles
title="About NetBird"
id="about-netbird"
items={[
{
href: '/about-netbird/how-netbird-works',
name: 'How NetBird Works',
description: 'Learn about NetBird concepts, architecture, protocols, and how it creates secure networks.',
},
{
href: '/about-netbird/netbird-vs-traditional-vpn',
name: 'NetBird vs. Traditional VPN',
description: 'Discover how NetBird compares to traditional VPNs and understand the advantages of Zero Trust networking.',
},
]}
/>
Props:
title(string, required): The heading title for the tiles sectionid(string, optional): Optional id for the heading anchoritems(array, required): Array of objects withhref,name, anddescriptionbuttonText(string, optional): Button text (defaults to "Read more" - currently unused as cards are fully clickable)
YouTube Component
Embeds YouTube videos with customizable parameters:
import {YouTube} from "@/components/YouTube"
<YouTube videoId="CFa7SY4Up9k" />
// With custom parameters
<YouTube
videoId="CFa7SY4Up9k"
title="Video Title"
start={175}
color="white"
modestbranding={1}
rel={1}
/>
// Or use a URL instead of videoId
<YouTube url="https://www.youtube.com/watch?v=CFa7SY4Up9k" />
Props:
videoId(string): YouTube video IDurl(string): YouTube URL (alternative to videoId)title(string, optional): Video titlestart(number, optional): Start time in secondscolor(string, optional): Progress bar color -'white'or'red'(default:'white')modestbranding(number, optional): Reduces YouTube branding -0or1(default:1)controls(number, optional): Show/hide controls -0,1, or2(default:1)rel(number, optional): Show related videos -0or1(default:1)
Button Component
Creates styled buttons with multiple variants:
import {Button} from "@/components/Button"
// Primary button (default)
<Button href="https://app.netbird.io/install" arrow="right">
Get started
</Button>
// Secondary button
<Button href="/path" variant="secondary">
Learn more
</Button>
// Outline button
<Button href="/path" variant="outline">
Explore
</Button>
// Text button
<Button href="/path" variant="text" arrow="right">
Read more
</Button>
// With left arrow
<Button href="/path" arrow="left">
Back
</Button>
Props:
variant(string, optional): Button style -'primary','secondary','filled','outline', or'text'(default:'primary')href(string, optional): Link URL (creates a link if provided, otherwise renders as button)arrow(string, optional): Arrow icon -'left'or'right'children(required): Button text content
Other Common Components
Row and Col
Create two-column layouts:
import {Row, Col} from "@/components/mdx"
<Row>
<Col>
Left column content
</Col>
<Col sticky>
Right column content (sticky on scroll)
</Col>
</Row>
Properties and Property
Define API properties or configuration options:
import {Properties, Property} from "@/components/mdx"
<Properties>
<Property name="apiKey" type="string" required>
Your API key for authentication.
</Property>
<Property name="timeout" type="number" min={0} max={300}>
Request timeout in seconds (default: 30).
</Property>
</Properties>
Badge
Displays small status badges:
import {Badge} from "@/components/mdx"
<Badge>New</Badge>
<Badge variant="secondary">Beta</Badge>
Code Blocks
Code syntax highlighting (automatically available):
\`\`\`bash
npm install
npm run dev
\`\`\`
// Or use code groups for multiple languages
<CodeGroup>
```bash title="Installation"
npm install
yarn install
Thank you
NetBird thrives on community participation, and we appreciate your contributions to our website and our documentation!