Devices join EFDI with the NetBird client. Before anyone at your site enrolls, your network must allow the outbound connections below. Many organisation networks allow the first row (ordinary HTTPS) but block the others.
| Host name | Port / protocol | Purpose | Needed |
|---|---|---|---|
netbird.efdi-backbone.net | TCP 443 | Joining the network (control) | Usually already allowed |
relay-fra.efdi-backbone.net | TCP 33073, UDP 3478, UDP 33073 | Relayed connections between devices | Required |
relay-dub.efdi-backbone.net | TCP 33073, UDP 3478, UDP 33073 | Relayed connections between devices | Required |
relay-arn.efdi-backbone.net | TCP 33073, UDP 3478, UDP 33073 | Relayed connections between devices | Required |
relay-iad.efdi-backbone.net | TCP 33073, UDP 3478, UDP 33073 | Relayed connections between devices | Required |
relay-pdx.efdi-backbone.net | TCP 33073, UDP 3478, UDP 33073 | Relayed connections between devices | Required |
| Other EFDI devices (any address) | UDP, high ports | Direct connections between devices; faster than relaying | Recommended |
Allow every host listed: a device opens connections to more than one relay.
Run this from a computer on your site network. It must report the connection as succeeded or open.
nc -zv relay-fra.efdi-backbone.net 33073
NetBird shows "Connected" but 0 peers connected, and the login link does not open. The device has registered, but it cannot reach any other device, so no EFDI service is reachable from it. Run netbird status -d: if relays show context deadline exceeded and the peer count is 0, the site network is blocking the ports above.