Devices join AZIS with the NetBird client. Before anyone at your site enrolls, your network must allow the outbound connections below. Many organisation networks allow the first row (ordinary HTTPS) but block the others.
| Host name | Port / protocol | Purpose | Needed |
|---|---|---|---|
netbird.azis.lv | TCP 443 | Joining the network (control) | Usually already allowed |
stun.cloudflare.com | UDP 3478 | Path discovery (STUN) | Strongly recommended |
| Other AZIS devices (any address) | UDP, high ports | Direct connections between devices; faster than relaying | Recommended |
Allow every host listed: a device opens connections to more than one relay.
Run this from a computer on your site network. It must report the connection as succeeded or open.
nc -zv <relay host> <relay port>
NetBird shows "Connected" but 0 peers connected, and the login link does not open. The device has registered, but it cannot reach any other device, so no AZIS service is reachable from it. Run netbird status -d: if relays show context deadline exceeded and the peer count is 0, the site network is blocking the ports above.