UDP port 443 is not forwarded in the documentation for the external relay, leading to QUIC not working

[fuomag9]

Before posting

• I searched existing discussions and issues, including closed ones, and checked the relevant docs.
• I believe this is a product bug rather than a configuration or setup question.
• I can reproduce this issue, or for intermittent issues I've included trigger, frequency, and timing details below.
• I removed or anonymized sensitive data from logs, screenshots, and configuration.

Affected area

Documentation

Deployment type

Self-hosted - advanced/custom deployment

Operating system or environment

Linux

NetBird version and upgrade status

not relevant

Did this work before?

Not sure

Regression details

No response

Summary

https://docs.netbird.io/selfhosted/maintenance/scaling/set-up-external-relays#alternative-tls-with-existing-certificates is not forwarding the udp port in the docker-compose.yml section. By default docker will only forward the tcp port https://stackoverflow.com/a/60061893

Current behavior

By default docker will only forward the tcp port if used like in the docs

Expected behavior

Udp port should also be forwarded to allow for QUIC usage on relays

Steps to reproduce

open https://docs.netbird.io/selfhosted/maintenance/scaling/set-up-external-relays#alternative-tls-with-existing-certificates
read the docs

Environment and topology

not relevant

Self-hosted details, if available

not relevant

Logs, status output, or debug evidence

N/A

Related issues or discussions

No response

Impact

No response

Additional context

No response

[0xMudit]

Hi,

Thanks for the clear report — verified this against the relay source.

The relay serves WebSocket over TCP and QUIC over UDP on the same default
listen address (:443, both listeners are started in relay/server/server.go).
Since Docker forwards TCP only unless a mapping carries the /udp suffix, the
compose example on that page silently disabled QUIC for external relays.

Opened a PR fixing the docs:
netbirdio/docs#946

It adds '443:443/udp' to the compose example and lists 443/udp in the firewall
requirements. Would appreciate a review and merge when someone has a moment.
Note: the Vercel preview check on the PR shows as failed until a maintainer
authorizes the deploy for a first-time fork PR — the change itself is a two-line
docs edit.