Skip to main content

relay

note

Relay support was introduced in Nebula v1.6.0.

Relay hosts forward traffic between two peers. This can be useful if two nodes struggle to communicate directly with each other (e.g. some NATs can make it difficult to establish direct connections between two nodes.) NAT traversal and firewalls explains which NAT behaviors cause this and when relays are the right fix.

relay:
  relays:
    - 192.168.100.1
  am_relay: false
  use_relays: true

In order to act as a relay for other hosts, am_relay must be set to true (default false.) In order to use relays, a host must have use_relays set to true (default true.) Any host can be a relay; it does not need to be a lighthouse. However, like lighthouses, relay nodes should be deployed with a public internet IP and firewall rules that permit Nebula's UDP traffic inbound.

Hosts specify which other hosts may act as a relay when connecting to them via the relays option in the config. This allows hosts to specify relays that are "close" to them. For example, if you have some Nebula hosts in a private AWS VPC, you can set up a relay host dedicated to enabling connectivity to peers in that VPC.

You cannot relay to a relay. Hosts configured as a relay (am_relay: true) may not specify other hosts as relays in their own config: their relay.relays is ignored with a log line, and they do not use relays themselves.

relay.relays​

Reloadable

relays is a list of Nebula IPs that peers can use to relay packets to this host. IPs in this list must have am_relay set to true in their configs, otherwise they will reject relay requests.

relays:
  - 192.168.100.1
  - <other Nebula VPN IPs of hosts used as relays to access me>

This list of relays is reported to the lighthouse. When other nodes attempt to handshake with this host, the lighthouse will indicate its supported relays in addition to its known IP addresses. A reload that changes the list reports it to the lighthouses right away, without waiting for the next lighthouse.interval. An entry that is not an IP address is skipped with a warning, and fails the reload.

relay.am_relay​

Default: false Reloadable

Set am_relay to true to enable forwarding packets for other hosts. Peers only try to relay through the hosts that the destination lists in its own relay.relays, but a relay does not check that list: it forwards for any peer that asks it to reach a host it has a direct tunnel with.

relay.use_relays​

Default: true Reloadable

Set use_relays to false to prevent this instance from attempting to establish connections through relays. The default is true.