Clarify required ports and Caddy port bindings in self-hosted NetBird docs

[baltazartroisville]

Hello NetBird team and other readers,

First off, thank you for all the hard work on NetBird!

I’ve been setting up the self-hosted environment over the last couple of days and ran into a few confusing discrepancies in the documentation and generated compose files:

1. Unlisted ports (33073, 10000, 33080)

   • The self-hosted docs say tcp ports 33073, 10000, and 33080 must be open.
   • In practice I only see 10000 referenced (and only internally in the Caddyfile).
   • None of the compose services actually map to 33073, 10000 or 33080.
     Question: Are those three ports truly required? If so, which containers/services use them and why?

2. Coturn port mismatch

   • Coturn’s own docs list these required ports:
     • 3478 TCP & UDP
     • 5349 TCP & UDP
     • A configurable UDP range (for relayed media)
   • NetBird’s docs only mention 3478 UDP and the UDP range.
   • The default turnserver.conf in the repo maps 3478 for unencrypted and 5349 for encrypted—but doesn’t specify protocol.
     Question: Should coturn be listening on both TCP and UDP for 3478 and 5349? Please clarify which protocols are required.

3. Caddy port 8080 mapping

   • The generated Docker Compose maps container port 8080 → host port 8080 for Caddy.
   • However, the supplied Caddyfile only binds :80 and :443 tcp/udp.
     Question: Is there a hidden listener on 8080 I’m missing, or is this line vestigial and safe to remove?

Thanks in advance for any clarification. Have a great weekend! ❤

[nazarewk]

TLDR; this is correct:

• The VM should be publicly accessible on TCP ports 80, 443; and UDP ports: 3478, 49152-65535.

---

Unlisted ports (33073, 10000, 33080)

• The self-hosted docs say tcp ports 33073, 10000, and 33080 must be open.

• In practice I only see 10000 referenced (and only internally in the Caddyfile).

• None of the compose services actually map to 33073, 10000 or 33080.
  Question: Are those three ports truly required? If so, which containers/services use them and why?

Those are ports for very old clients, not sure exactly which versions, but at least a few months old.

Coturn port mismatch

• Coturn’s own docs list these required ports:

  • 3478 TCP & UDP
  • 5349 TCP & UDP
  • A configurable UDP range (for relayed media)

• NetBird’s docs only mention 3478 UDP and the UDP range.

• The default turnserver.conf in the repo maps 3478 for unencrypted and 5349 for encrypted—but doesn’t specify protocol.
  Question: Should coturn be listening on both TCP and UDP for 3478 and 5349? Please clarify which protocols are required.

I don't know the exact details, but the team mentioned only those UDP ports being required: 3478 & 49152-65535 .

• Question: Is there a hidden listener on 8080 I’m missing, or is this line vestigial and safe to remove?

I think it might be some kind of old version and/or debugging leftover, but asked the team for clarification.

[nazarewk]

We have PRs merged/pending review, so I'll close this as completed:

• [self-hosted] remove unneccessary ports from guides docs#384
• [misc] getting-started-with-zitadel.sh: drop unnecessary port 8080 #4075