From b05814980f4bc00e08270e6e2e1dffd08a1d7eb4 Mon Sep 17 00:00:00 2001
From: ahmzaa <hamza@ahmza.com>
Date: Sat, 25 Jul 2026 01:46:28 +0100
Subject: [PATCH] Update Netbird debug to probe correct data-plane ports

The Netbird server multiplexes management + signal + dashboard behind
Traefik on :443 (no separate :10000 signal port). The tunnel data plane
is WireGuard on 51820/udp and STUN on 3478/udp. Update the debug step to
probe those UDP ports plus a general outbound-UDP check (public STUN) to
determine whether the runner network blocks UDP egress -- the likely
cause of 'netbird up' timing out after the control plane connects fine.
---
 .github/workflows/build-docker-images.yml | 40 +++++++++++++++++++----
 1 file changed, 34 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/build-docker-images.yml b/.github/workflows/build-docker-images.yml
index 86ecd69..ebb0418 100644
--- a/.github/workflows/build-docker-images.yml
+++ b/.github/workflows/build-docker-images.yml
@@ -71,13 +71,41 @@ jobs:
           echo "=== DNS resolution ==="
           getent hosts "$host" || nslookup "$host" || echo "DNS resolution FAILED for $host"
 
-          echo "=== HTTPS reachability (management API, :443) ==="
-          curl -sS -o /dev/null -w "HTTP %{http_code}  connect=%{time_connect}s  total=%{time_total}s\n" \
-            --max-time 15 "https://${host}/" || echo "curl to management API FAILED"
+          # This deployment multiplexes management + signal + dashboard
+          # behind Traefik on :443 (gRPC-over-HTTP/2). There is no separate
+          # :10000 signal port. The data plane is WireGuard on 51820/udp and
+          # STUN on 3478/udp -- those are the ports that actually matter for
+          # 'netbird up' to complete the tunnel handshake.
 
-          echo "=== Signal server port (:10000 gRPC) TCP check ==="
-          timeout 10 bash -c "cat < /dev/null > /dev/tcp/${host}/10000" \
-            && echo "TCP :10000 reachable" || echo "TCP :10000 NOT reachable (signal server / firewall?)"
+          echo "=== Control plane: HTTPS :443 (mgmt + signal via Traefik) ==="
+          curl -sS -o /dev/null -w "HTTP %{http_code}  connect=%{time_connect}s  total=%{time_total}s\n" \
+            --max-time 15 "https://${host}/" || echo "curl to :443 FAILED"
+
+          ip="$(getent hosts "$host" | awk '{print $1; exit}')"
+          echo "Resolved IP: ${ip:-<none>}"
+
+          echo "=== Data plane: WireGuard 51820/udp (nc UDP probe) ==="
+          if command -v nc >/dev/null 2>&1; then
+            nc -zu -w 5 "$host" 51820 \
+              && echo "UDP 51820 appears OPEN/reachable" \
+              || echo "UDP 51820 probe returned non-zero (may be filtered/blocked -- prime suspect)"
+          else
+            echo "nc not available; installing..."
+            (apt-get update -qq && apt-get install -y -qq netcat-openbsd) >/dev/null 2>&1 || true
+            nc -zu -w 5 "$host" 51820 \
+              && echo "UDP 51820 appears OPEN/reachable" \
+              || echo "UDP 51820 probe returned non-zero (may be filtered/blocked -- prime suspect)"
+          fi
+
+          echo "=== STUN 3478/udp (nc UDP probe) ==="
+          nc -zu -w 5 "$host" 3478 \
+            && echo "UDP 3478 appears OPEN/reachable" \
+            || echo "UDP 3478 probe returned non-zero (may be filtered/blocked)"
+
+          echo "=== Outbound UDP allowed at all? (probe public STUN) ==="
+          nc -zu -w 5 stun.l.google.com 19302 \
+            && echo "General outbound UDP works (reached Google STUN)" \
+            || echo "General outbound UDP may be BLOCKED on this runner network"
 
           echo "=== done (this step never fails the build) ==="
         continue-on-error: true