Ports, endpoints, timings, and limits.
| Port | Protocol | Direction | Purpose |
|---|---|---|---|
26431 | TCP | Inbound (listen) | Peer connections to you. Default; configurable. |
26432 | TCP | Outbound | Your connections to the peer. Default; configurable. |
26000-27000 | TCP | - | The valid range for peer ports. The handshake and the relay reject ports outside it. |
26999 | UDP | Multicast | LAN discovery, group 224.0.0.167. IPv4 only. |
26600 | TCP | Outbound only | The bridge. Both peers dial out to it. No inbound rule needed. |
443 | HTTPS | Outbound | The relay, used for pairing. |
Source: pkg/config/constants.go, pkg/discovery/discovery.go.
| Endpoint | Default | Role |
|---|---|---|
| Relay | https://keibidroprelay.keibisoft.com/ | Exchanges encrypted registration blobs during pairing. It cannot read them. See the security model. |
| Bridge | bridge.keibisoft.com:26600 | Forwards encrypted bytes when a direct connection is impossible. Both peers connect out to it. |
Both are configurable: relay and bridge_addr in the configuration reference. strict_mode = true disables the bridge fallback.
| Value | Meaning |
|---|---|
| 15 s | The direct-connection accept window, used when reachability is still unknown. If no direct path forms in this time, the connection falls back to the bridge. |
| 6 s | Inbound reachability probe. The relay dials your listener back through its /probe endpoint and answers whether anything reached it. A relay without the endpoint costs nothing: the connection proceeds as before. |
| 15 min | How long a probe verdict is cached, keyed on the local address. A router swap can change reachability while the address stays the same, and a cached "blocked" verdict cannot disprove itself, so it expires on this timer. An arriving inbound connection clears it immediately. |
| 30 s | Presence heartbeat interval. With a persistent identity and saved contacts, the app publishes a per-contact presence token so contacts see you online. Incognito mode, or having no contacts, disables it. |
| ~17 s | Typical first connect on a network that blocks direct connections, measured before the reachability hint existed. With a verdict in hand the peer skips the doomed dial and reaches the bridge sooner. |
The hint is what removes most of the waiting. Your machine cannot tell on its own whether the internet reaches its listener, so it asks the relay to dial back. The verdict travels inside the encrypted registration, which means the peer knows not to attempt a direct connection that cannot land, and neither side waits out the full accept window.
| Limit | Value |
|---|---|
| Peers per session | Exactly two. See Limits and known issues. |
| Free relay tier | About 3 connection attempts per 5 minutes. On limit, wait 5 minutes. Do not retry in a loop. |
| Direct P2P requirement | IPv6 on both ends. Test at test-ipv6.com; you need a score of at least 9/10. Without IPv6 the connection uses the bridge. |
KeibiDrop needs no inbound firewall rule to work: if inbound is blocked, both peers dial out to the bridge.
If you want direct connections through a firewall you control, allow inbound TCP on your inbound port (default 26431). For a corporate allow-list, permit outbound TCP to ports 26000-27000 and 26600, and HTTPS to the relay.
Practical steps are in How to work through firewalls and guest WiFi.