Can the relay support full traffic forwarding?

[changyoutianxia]

Nebula works great in most environments, but we have encountered limitations in certain NAT-restricted or symmetric NAT scenarios where direct connectivity between nodes fails.

Currently, the relay functionality only assists in handshake or discovery, but it does not proxy full traffic between nodes. In environments where NAT traversal fails, this prevents communication entirely.

We would like to propose the following feature:

Full traffic relay through relay nodes

Allow relay nodes to act as full proxies for node-to-node traffic when direct connections cannot be established.

Relay should be optional and configurable per network or per node.

Ensure end-to-end encryption is maintained, possibly via existing Noise protocol, even when relayed.

Potential benefits:

Improve connectivity in symmetric NAT or restrictive firewall scenarios.

Enable Nebula to be more usable in enterprise or multi-NAT environments.

[brad-defined]

relays do forward traffic between peers when direct connections cannot be established.

https://nebula.defined.net/docs/config/relay/

[timteka]

Correct me if I'm wrong, but... We also faced some misunderstanding on initial experiments with relaying. When direct connection was possible (even buggy/slow), traffic still used direct tunnels (though relay was turned on) . We overcomed this by limiting hosts involved via remote_allow_list (with lighthouses and relays as members) . This way the relay was involved indeed.

[johnmaguire]

Closing as this functionality already exists in Nebula.