feat(netbird): let peers connect directly to the in-cluster router

morten-olsen commented

2026-10-30 11:14:09 +01:00

Owner

Mission Control: HOMEIT-499. With Morten's UniFi forward (WAN UDP 51820 -> 192.168.20.180:51820), this adds a ServiceLB LoadBalancer Service for UDP 51820 (externalTrafficPolicy Local) to the router pod, NB_WIREGUARD_PORT=51820 and NB_EXTERNAL_IP_MAP=185.181.220.204. It also adds hostAliases netbird-client.olsen.cloud -> 192.168.20.180, so STUN reaches coturn on the node; via the CoreDNS rewrite it timed out at the Istio gateway. The node path was checked from a pod with the same alias: TLS verified, relay 426 (WebSocket upgrade), management gRPC 200. No hostNetwork, so host networking is untouched. The relay remains the fallback, and arch-desktop covers the restart.

morten-olsen added 1 commit

2026-10-30 11:14:09 +01:00

feat(netbird): let peers connect directly to the in-cluster router

ci/woodpecker/pr/charts Pipeline was successful

Details

ci/woodpecker/push/scan Pipeline was successful

Details

1995e5988a

UniFi forwards WAN UDP 51820 to the node. A ServiceLB Service (Local) carries
it to the router pod, which pins WireGuard/ICE to 51820 and advertises the WAN
address. A host alias sends netbird-client.olsen.cloud to the node so STUN
reaches coturn instead of timing out at the Istio gateway. Relay remains the
fallback.

Refs HOMEIT-499

morten-olsen merged commit 1995e5988a into main

2026-10-30 11:15:22 +01:00

morten-olsen referenced this pull request

2026-10-30 11:17:43 +01:00

fix(netbird): apply the router's declared settings on every start #189

Rows
Columns

feat(netbird): let peers connect directly to the in-cluster router #188