Forward UDP 443 for QUIC in external relay setup

[0xMudit]

Fixes the issue reported in netbirdio/netbird#6235

The relay serves WebSocket and QUIC on the same port (default :443). The relay code in netbirdio/netbird starts both listeners on that address: a TCP listener for WebSocket and a QUIC listener over UDP (relay/server/server.go). Docker only forwards TCP unless a port mapping carries the /udp suffix, so the compose example on this page silently disabled QUIC for external relays.

Changes:

• Add '443:443/udp' to the docker-compose example
• List 443/udp alongside 443/tcp in the firewall requirements

Question while I was here: high-availability.mdx also publishes relay traffic as 443:443 behind a load balancer. If QUIC is wanted there too, that deployment needs UDP forwarding through the LB as well, so I left it out of this change.

Summary by CodeRabbit

• Documentation
  • Updated the external relay setup guide to include UDP port 443 for QUIC.
  • Updated the Docker Compose example to expose port 443 for both TCP and UDP traffic.
  • Added explanations for WebSocket, QUIC, and Docker port forwarding requirements.

[vercel]

@Mudityadev is attempting to deploy a commit to the NetBird GmbH Team on Vercel.

A member of the Team first needs to authorize it.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: a68827a7-7619-45ba-84e1-66beedf511b0

📥 Commits

Reviewing files that changed from the base of the PR and between d905fda and a7ba2ad.

📒 Files selected for processing (1)

• src/pages/selfhosted/maintenance/scaling/set-up-external-relays.mdx

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The external relay setup guide now includes UDP port 443 for QUIC. Its Docker Compose example maps port 443 for both TCP WebSocket traffic and UDP QUIC traffic.

Changes

External relay QUIC setup

Layer / File(s)	Summary
Document WebSocket and QUIC ports src/pages/selfhosted/maintenance/scaling/set-up-external-relays.mdx	The firewall requirements include 443/udp. The Docker Compose example maps 443:443 for TCP and 443:443/udp for QUIC, with explanatory comments.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to a7ba2

This localized documentation update adds the required UDP forwarding guidance for external relay deployments, and no actionable merge-blocking risk remains.

Poem

I’m a rabbit by the relay door,
Hopping where the packets pour.
TCP knocks, and QUIC arrives,
UDP keeps the tunnel alive.
Port four-four-three now serves them all—
I nibble docs beside the wall.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main documentation change: forwarding UDP port 443 for QUIC in the external relay setup.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests

Warning

Some tools did not complete. Review the errors below.

🔧 ESLint

If the error stems from missing dependencies, add them to the package.json file. For unrecoverable errors (e.g., due to private dependencies), disable the tool in the CodeRabbit configuration.

src/pages/selfhosted/maintenance/scaling/set-up-external-relays.mdx

typescript-eslint does not support TS 7.0.
Please see https://devblogs.microsoft.com/typescript/announcing-typescript-7-0/#running-side-by-side-with-typescript-6.0 to run typescript-eslint using the TS 6 API.
See also typescript-eslint/typescript-eslint#10940 for tracking typescript-eslint's support for TS >=7.1

Oops! Something went wrong! :(

ESLint: 9.39.5

Error: typescript-eslint does not support TS 7.0.
at Object. (/node_modules/typescript-eslint/dist/index.js:52:11)
at Module._compile (node:internal/modules/cjs/loader:1830:14)
at Object..js (node:internal/modules/cjs/loader:1961:10)
at Module.load (node:internal/modules/cjs/loader:1553:32)
at Module._load (node:internal/modules/cjs/loader:1355:12)
at wrapModuleLoad (node:internal/modules/cjs/loader:255:19)
at Module.require (node:internal/modules/cjs/loader:1576:12)
at require (node:internal/modules/helpers:153:16)
at Object. (/node_modules/eslint-config-next/dist/index.js:5:64)
at Module._compile (node:internal/modules/cjs/loader:1830:14)

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}