The Netbird server multiplexes management + signal + dashboard behind Traefik on :443 (no separate :10000 signal port). The tunnel data plane is WireGuard on 51820/udp and STUN on 3478/udp. Update the debug step to probe those UDP ports plus a general outbound-UDP check (public STUN) to determine whether the runner network blocks UDP egress -- the likely cause of 'netbird up' timing out after the control plane connects fine.