I have several remote networks that talk to each other via netbird (hosted).
The biggest problem we’re running into is that most of the servers are using Relayed instead of P2P.
Upon researching it more, it seems it’s due to NAT randomizing the outbound port.
We use opnsense firewalls at most of our sites.
Coming across docs.netbird.io/get-started/install/opnsense, docs suggest creating a manual outbound NAT entry to force the port, but that doesn’t work when there’s 50+ devices at each site.
I could set a range and force each client to use a different port, but that’s a lot of upkeep.
Am I missing something here? Is there a better way to do this to prevent all traffic being sent to our relay servers.
Hi, you could just create an alias with all the devices and use it in the outbound NAT as a source, and tick the static port checkbox in the rule. No need to specify ports or create one rule per device. That’s how I did it on my pfSense.
I need to correct myself. It doesn’t work with the alias in the NAT destination. There must be one port per peer. We have set up two routing peers behind pfSense. One listens on port 51820 and the other on port 51821. I’ve set up separate NAT rules for these ports and hosts, and the clients connect to both via P2P. I’ve enabled masquerading on the routing peers to avoid asymmetric routing and to avoid having to set up routes on the internal computers. One step we had to take was to add the private and public IP addresses to the Netbird configuration file. For some reason, the system couldn’t find its own public IP address and therefore switched back from P2P to relay mode after a large file transfer.
For the Outbound NAT, I had set up a rule like this. But it seems like it is not needed, as I disabled the rule now and it still connects via p2p.
If you have 50+ devices at a site, trying to manage static outbound NAT ports for every single endpoint behind OPNsense isn’t practical because Symmetric NAT randomizes the source port when multiple devices share the same public IP.
Two ways to handle this:
Use Routing Peers / Subnet Routers (Recommended):
Instead of running NetBird on all 50+ machines, deploy 1 or 2 dedicated routing peers per site and advertise the local subnet in the NetBird dashboard. You only need a static outbound NAT rule (with “Static Port” enabled) for those 1-2 routing peers (e.g. UDP 51820 and 51821), and enable masquerading to avoid asymmetric routing.
If all 50+ must run individual clients:
UPnP / NAT-PMP:
Enable UPnP on OPNsense restricted to your internal subnet. NetBird’s ICE/STUN implementation can request automatic port mappings without manually configuring NAT rules for every device.
Template unique ports:
If you deploy via MDM/Ansible, you can configure each client’s config.json with a unique WireGuard.Port and pair it with corresponding outbound NAT rules, though UPnP or subnet routers are much easier to maintain.