TCP throughput capped at ~95 Mbps through NetBird tunnel for incoming traffic only

[CicerBro]

Before posting

• I searched existing discussions and issues for similar questions.
• I reviewed the relevant NetBird documentation or troubleshooting guide.
• I removed or anonymized sensitive data from logs, screenshots, and configuration.

Topic

CLI

Deployment type

NetBird Cloud

Operating system or environment

Linux, macOS

NetBird version

0.74.7

Question

I am seeing a TCP throughput limit through Netbird.

Setup:

• Raspberry Pi 5 - Ubuntu 26 LTS
• Linux 7.0.0-1014-raspi (arm64)
• NetBird P2P connection (host/host, no relay)
• DigitalOcean VPS peer (1vCPU amd64) Ubuntu 26 LTS
• Macbook Pro (M1 Pro)
• RTT ~10-15 ms between Pi and VPS
• • RTT ~50-55 ms between Pi and Macbook (Normal latency for this path)

Results:

TCP Pi → VPS: ~95 mbps
TCP VPS → Pi: ~950 mbps
UDP: ~900 Mbps

The tunnel itself appears capable of high throughput, but TCP traffic in one direction of the Pi is very limited. Same results when going from Macbook to Pi, it's slow. But Macbook to VPS is fast. Pi can easily do ~950 Mbps to other internet facing public iPerf3 servers, not using the tunnel.

Things tested:

• TCP congestion control: cubic vs bbr (no meaningful change)
• MSS clamping (Manual TCPMSS rules)
• MTU changes
• GRO/GSO/TSO off and on
• TCP buffer/sysctl tuning

Zero improvement.

Example ss -ti during the slow TCP transfer:

mss:1228
pmtu:1280
rtt:12-17ms
delivery_rate:~85-95Mbps

CPU is not saturated during the slow tests (~95% idle).

Is there any known NetBird/WireGuard forwarding limitation or processing path that could explain asymmetric TCP throughput while UDP and reverse TCP reach ~900 Mbps?

I couldn't test Tailscale at the moment but I swear that easily did upwards of 400-500 mbit/s when using the Pi as an exit node before.

Desired outcome

No response

What have you tried?

No response

Relevant environment details

No response

Logs or output

No response

Additional context

No response

[CicerBro]

I am - yet again - an idiot. Spent an hour looking at this, trying things, turns out the underlying ISP connection on the Pi side changed to a DOCSIS modem. Ergo... capped at 1000/100 Mbps :-)