Antivirus, VPNs, and Corporate Proxies

Security products interpose on exactly the things a mesh agent depends on: they re-sign TLS connections, pull traffic into their own tunnels, and filter packets. On a machine running one — most corporate laptops, and any consumer machine with a security suite — noBGP works, but a few products need to be told about it. This page covers what to exclude, per vendor, and how to recognize which product is interfering.

What noBGP traffic looks like

Everything the agent does is outbound. It never needs an inbound port opened.

Traffic	Protocol	Destination
Control channel + mesh	QUIC, UDP 443	your router (e.g. router.nobgp.com)
Fallback control channel + mesh	TLS (wss), TCP 443	same
Install and upgrades	HTTPS, TCP 443	downloads.nobgp.com

If UDP 443 is blocked, the agent detects it and falls back to TLS over TCP on its own — a firewall that drops UDP costs some latency, never connectivity.

Recognizing the interference

Symptom	Likely cause
Certificate error during install or upgrade	HTTPS inspection (antivirus "web shield" or corporate proxy) re-signing the download connection
Node registers and shows online, but connections to peers stall or drop	A VPN client's virtual adapter pulling routes (its adapter usually shows a 169.254.x.x or its own tunnel address)
Agent always on wss, never quic	Outbound UDP 443 blocked — harmless, see above

nobgp status reports which transport the node is actually using (router.transport), and recent agents also flag detected TLS interception and foreign VPN adapters directly in the status output.

What to exclude

You never need to disable a security product. Three narrow exclusions cover everything:

1. Exclude from HTTPS/SSL scanning: downloads.nobgp.com and your router's domain (router.nobgp.com unless self-hosted). Inspection proxies replace the server certificate, which breaks the installer's certificate validation.
2. Allow the agent through the firewall: the nobgp binary (/usr/local/bin/nobgp, C:\Program Files\nobgp\nobgp.exe), outbound TCP 443 and UDP 443.
3. If a VPN client is active: add noBGP to its split-tunnel exclusions so overlay traffic doesn't get pulled into the VPN's tunnel.

Per-vendor notes

Norton 360 / Norton Security

Two separate components interfere, and they produce different symptoms:

• Web/Mail Shield re-signs HTTPS (its root certificate is literally named "generated by Norton Antivirus for SSL/TLS scanning") — this is the install-time certificate error. Settings → Antivirus → Scans and Risks → Web/Mail Shield → exclude downloads.nobgp.com and your router domain, or disable HTTPS scanning.
• Norton VPN installs Wintun/OpenVPN adapters that grab routes — this is the "online but peers flaky" symptom. Either enable split-tunneling for nobgp under the VPN's settings, or turn the VPN component off.
• Norton Firewall: Settings → Firewall → Traffic Rules → allow nobgp.exe, outbound TCP/UDP 443.

Windows Defender

Defender does not inspect TLS and normally coexists cleanly. Two known cases:

• During install, real-time scanning of the freshly written binary can delay the service's first start by a few seconds. No action needed; the installer waits.
• If Controlled Folder Access is enabled, allow nobgp.exe under Ransomware protection → Allow an app.

Corporate proxies (Zscaler, Netskope, Palo Alto, Cisco Umbrella)

These re-sign all TLS, with a root certificate your IT department deployed via MDM — so connections succeed, silently inspected, on managed machines. noBGP still works, but ask IT to add downloads.nobgp.com and your router domain to the SSL-inspection bypass list: inspection middleboxes buffer long-lived connections and can drop the agent's control channel on idle. On an unmanaged machine behind such a proxy, the missing root causes the same certificate errors as consumer antivirus — the bypass list is the fix there too.

Zscaler Client Connector and similar agents also install a packet-filter tunnel; if peers are unreachable, ask IT to add the noBGP overlay range (100.64.0.0/10) to the tunnel's exclusions.

macOS: MDM profiles, Little Snitch, LuLu

• Managed Macs trust MDM-deployed inspection roots, so installs succeed even under inspection — see the corporate-proxy section above.
• Little Snitch / LuLu prompt on the agent's first outbound connection. Approve nobgp for TCP and UDP 443 to your router domain and downloads.nobgp.com. If you dismissed the prompt, the agent appears installed-but-offline; open the firewall's rule list and allow nobgp.

Other VPN clients (WireGuard, Tailscale, OpenVPN, vendor VPNs)

noBGP coexists with other overlay networks — it detects a VPN already holding a CGNAT (100.64.x.x) address and carves its own range around it. Interference, when it happens, is route-based: a full-tunnel VPN that claims the default route can swallow overlay traffic. Prefer split-tunnel mode, or exclude 100.64.0.0/10 from the VPN's routes.

Still stuck?

Run nobgp status. The agent reports interference in three different places, and which one is populated tells you what kind of problem you have:

Where	Field	Means
router	transport	What is actually carrying traffic (quic or wss).
router	tls_intercepted	Something re-signed the control channel — antivirus HTTPS scanning or a corporate proxy. Names the certificate's owner.
environment	tunnels	Another product's active VPN adapter, with the address it holds — the usual route thief.
environment	security_products	Third-party antivirus or firewall registered with the OS.
network	route	missing means overlay traffic is not going through the noBGP interface (Windows: another product's route is winning).

The environment block is deviation-only: it is omitted entirely when nothing was detected, so on a clean machine you will not see it at all. Its absence is a healthy result, not a missing field.

Stock Windows Defender is filtered out of security_products deliberately — this is a report of deviations from a normal machine, not an inventory of everything installed.

If the node shows online but a peer is unreachable, run nobgp status on both ends — the interference is usually on exactly one of them.