What firewall ports should I open to use NetBird?

Incoming ports

NetBird's agent doesn't require any incoming port to be open; It negotiates the connection with the support of the signal and relay services.

Outgoing ports

NetBird usually won't need open ports, but sometimes you or your IT team needs to secure and verify all outgoing traffic, and that may affect how NetBird clients connect to the control layer and negotiate the peer-to-peer connections.

Below is the list of NetBird hosted endpoints and ports they listen to:

• Management service:
• Endpoint: api.wiretrustee.com
• Port: TCP/443
• Signal service:
  • Endpoint: signal2.wiretrustee.com
  • Port: TCP/443
• Relay (TURN) service:
  • Endpoint: turn.netbird.io
  • Port range: UDP/5555-65535

Why and what are the anonymous usage metrics?

Why we added metrics collection?

As an open-source project and business, making decisions based on data is essential. We will know our adoption rate, feature usage, and client type with anonymous metrics.

If the metric collection infringes any internal regulation or policy, it can be disabled by setting the flag --disable-anonymous-metrics=true to the management service startup command.

What are the metrics being collected?

We are collecting the following metrics:

• Number of accounts
• Number of users
• Number of peers
• Number of active peers in the last 24 hours
• Number of peers per operating system
• Number of setup keys usage
• Number of peers activated by users
• Number of rules
• Number of groups
• Number of routes
• Number of nameservers
• Service uptime
• Service version
• Metrics generation time

Metrics UUID

We are using an installation ID for each management service which is generated once and stored in your management store database. It doesn't have any trace of any other private information, and it helps distinguish each deployment.

Metrics pusher IP

We are not storing the pusher IP address; it gets discarded once the request is complete.