docs: document NB_PROXY_EXTERNAL_IP_MAP for proxy P2P behind NAT

[jnfrati]

What

Documents the new --external-ip-map / NB_PROXY_EXTERNAL_IP_MAP flag for netbird-proxy, added for netbirdio/netbird#8184 ("Enable p2p connection to reverse-proxy container behind NAT").

Changes in Enable Reverse Proxy:

• Environment variable reference: new NB_PROXY_EXTERNAL_IP_MAP row under "Networking and forwarding". It covers the IP / IP/internal-IP-or-interface format (same as the client --external-ip-map flag) and notes that the flag needs a fixed, forwarded NB_PROXY_WG_PORT.
• New "Enabling peer-to-peer connectivity" section: explains when the proxy falls back to relay (no STUN server, or one that cannot see its public address, such as an adjacent container) and how to fix it: set a fixed NB_PROXY_WG_PORT, forward that UDP port to the proxy host, and set NB_PROXY_EXTERNAL_IP_MAP. Includes proxy.env and docker-compose.yml examples, and a note that a fixed port only works with single-account deployments.

How this was verified

npm run lint:mdx and npm run build pass.

Summary by CodeRabbit

• Documentation
  • Added self-hosting migration instructions for enabling direct peer-to-peer connectivity to the proxy when STUN cannot discover its public address, including WireGuard port forwarding and external IP mapping.
  • Clarified that fixed ports are supported only for single-account deployments and that external IP mapping requires a fixed, forwarded port to take effect.
  • Documented the external IP map setting, its accepted formats, and how it can map a public IP to an internal IP or interface.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs	Ready	Preview	Oct 14, 2026 9:42am UTC

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 1f098b1d-4376-4925-b572-0108c40072ed

📥 Commits

Reviewing files that changed from the base of the PR and between daa41ba and dc6b7eb.

📒 Files selected for processing: 1

• src/pages/selfhosted/migration/enable-reverse-proxy.mdx

🚧 Files skipped from review as they are similar to previous changes: 1

• src/pages/selfhosted/migration/enable-reverse-proxy.mdx

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📝 Walkthrough

The migration guide adds instructions for direct peer-to-peer connectivity through the proxy. It documents a fixed WireGuard port, UDP forwarding, and the NB_PROXY_EXTERNAL_IP_MAP setting, including their deployment requirements.

Changes: Proxy connectivity documentation

Layer / File(s)	Summary
Document peer-to-peer setup src/pages/selfhosted/migration/enable-reverse-proxy.mdx	The guide explains how to configure and forward a fixed WireGuard UDP port and set NB_PROXY_EXTERNAL_IP_MAP. It documents the single-account requirement and the conditions for the external IP map to take effect.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~4 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to dc6b7

The documented port configuration is consistent with the Compose example; no merge-blocking issue was identified.

Pre-merge checks: 5

Passed checks: 5 passed

Check name	Status	Explanation
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main documentation change: documenting NB_PROXY_EXTERNAL_IP_MAP for proxy peer-to-peer connectivity behind NAT.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit reads the proxy guide,
Then maps the public path outside.
A fixed port hops through UDP,
While ICE candidates find their way.
The bunny bounds to peer-to-peer!}

_{Comment @coderabbitai help to get the list of available commands.}