LAN discovery uses multicast (UDP group 224.0.0.167, port 26999). Networks with client isolation, which includes most guest, hotel, and office-guest WiFi, block it.
If you control the router, disable client isolation (sometimes called AP isolation).
Otherwise, skip discovery: exchange fingerprints and connect over the internet path (how). It works on the same network too.
Internet connect fails
Both sides registered the other's full 86-character fingerprint, and both pressed Connect. The connection needs both.
A fingerprint from before the peer's last disconnect is stale: disconnecting rotates the code. Exchange fresh codes, or use saved contacts, which survive rotation.
Check IPv6 on both ends at test-ipv6.com (9/10 needed for the direct path). Without it, the bridge path is used; that is normal, not a failure.
Give the attempt its full time: the direct window is 15 seconds before the bridge takes over.
The first connect is slow, later ones are fast
About 17 seconds on a network that blocks direct connections is expected once: the direct attempt times out, the bridge takes over, and the result is remembered. Subsequent connects on the same network skip the wait.
Relay rate limit errors
The free relay allows about 3 connection attempts per 5 minutes. If you hit the limit, wait 5 minutes. Scripts must not retry in a tight loop.
A third computer cannot join
By design. A session is exactly two peers; a third machine fails its handshake or gets connection refused, with no "room full" message. See What KeibiDrop is not.
You enabled strict_mode
strict_mode = true turns bridge fallbacks into failures. If connections stopped working after enabling it, that is the setting doing its job on a network where direct is impossible. Remove it or fix the network path.
Still stuck? Collect a log and report; connection problems are diagnosed well from the sanitized log.