nym/documentation/docs/components/operators/snippets/quic-bridge-deployment-script-setup.mdx

import { Steps } from 'nextra/components';
import { Callout } from 'nextra/components';
import { AccordionTemplate } from 'components/accordion-template.tsx';

<Callout type="info" emoji="ℹ️">
**QUIC bridge is a requirement for all nodes which enable Wireguard functionality. Note that it this feature is compatible with nodes from `v1.19.0` (platform release [`v2025.18-jarlsberg`](https://github.com/nymtech/nym/releases/tag/nym-binaries-v2025.17-isabirra)) and newer!**
</ Callout>

Nym Network uses various [transport bridges](https://github.com/nymtech/nym-bridges/blob/main/README.md) for routing the packets. Right now operators need to configure [our implementation](https://github.com/nymtech/nym-bridges/tree/main/nym-bridge) of general-purpose transport layer network protocol called [QUIC](https://en.wikipedia.org/wiki/QUIC).

Operators can use [Nym Bridge Configuration Tool](https://github.com/nymtech/nym-bridges/tree/main/bridge-cfg) and compile the [Bridge Runner binary](https://github.com/nymtech/nym-bridges/tree/main/nym-bridge) themselves.

**We recommend a more convenient QUIC bridge deployment using a script [`quic_bridge_deployment.sh`](https://github.com/nymtech/nym/blob/develop/scripts/nym-node-setup/quic_bridge_deployment.sh), following the steps below.**

<Callout type="warning" emoji="⚠️">
This script assumes that you follow the convention of running a `nym-node` as `root`. In case you run as a [non-root user](/operators/nodes/nym-node/configuration#running-nym-node-as-a-non-root), please follow [manual QUIC bridge setup](https://github.com/nymtech/nym-bridges/blob/main/README.md) and ask for support in the [Matrix channel](https://matrix.to/#/#operators:nymtech.chat).
</Callout>

<Steps>
###### 1. Download [`quic_bridge_deployment.sh`](https://github.com/nymtech/nym/blob/develop/scripts/nym-node-setup/quic_bridge_deployment.sh) script
- SSH to your server
- **Run as root**
- Download the script and make executable
```sh
curl -L https://raw.githubusercontent.com/nymtech/nym/refs/heads/develop/scripts/nym-node-setup/quic_bridge_deployment.sh -o quic_bridge_deployment.sh && \
chmod +x quic_bridge_deployment.sh
```

###### 2. Run the script with `full_bridge_setup` command
- Optional: open `tmux` in case you will need to run another commands on the VPS
- Run the script with a command `full_bridge_setup`
```sh
./quic_bridge_deployment.sh full_bridge_setup
```
- If you prefer a non-interactive mode, run the command with this variable (and skip next step):
```sh
NONINTERACTIVE=1 quick_bridge_deployment.sh full_bridge_setup
```

###### 3. Follow the interactive prompts
- Make sure you don't just press enter to insert default values if your setup is different, for example in case of path to the config file

###### 4. Validate

- After running the script, ensure that the bridges are running correctly:
```sh
systemctl status nym-bridge.service
```

###### 5. Restart `nym-node` service
- When done with the deployment, please restart your node systemd service
```sh
service nym-node restart && journalctl -u nym-node.service -f --all
```

</Steps>

Congratulation, you deployed QUIC transport bridge! The script offers a standalone tweaks and checks, you can always run it without any argument to see all the options:
```sh
./quic_bridge_deployment.sh
```
<br/>
<AccordionTemplate name="Command output">
```shell
root@localhost:~# ./quic_bridge_deployment.sh
Logs are being saved locally to: /var/log/nym-bridge-helper.log
These logs never leave your machine.


Usage: ./quic_bridge_deployment.sh [command]

Commands:
  full_bridge_setup            - Run full setup
  install_bridge_binary        - Install nym-bridge (.deb; falls back to source build if libc too old)
  install_bridge_cfg_tool      - Install bridge-cfg (prebuilt; falls back to source build if libc too old)
  run_bridge_cfg_generate      - Generate bridges.toml
  create_bridge_service        - Setup systemd service (respects .deb-provided service)
  adjust_ip_forwarding         - Enable forwarding
  apply_bridge_iptables_rules  - NAT rules
  configure_dns_and_icmp       - Allow ICMP/DNS


------------------------------------------
Script exited with errors (code: 1).
Check the log at: /var/log/nym-bridge-helper.log
------------------------------------------
```
</AccordionTemplate>

### Fixing Metadata Port Showing Not Open in Probe Results
If you have followed the steps outlined above, but the metadata port is not shown as open in either the Node Status API's probe results or an explorer that gets its data from the API, see below:

<Steps>
**Run as root**

###### 1. Confirm correct `config.toml` private IPv4 address
Ensure that in your `config.toml` file, this value is set to the default one - any other value here will cause the metadata endpoint to fail:

```
# Private IP address of the wireguard gateway.
# default: '10.1.0.1'
private_ipv4 = '10.1.0.1'
```

Then restart your node.

###### 2. Open the needed port
Run this command if not already done:
```
ufw allow in on nymwg to any port 51830 proto tcp
```

Check if the port is open with:
```
iptables -S | grep 51830
```

Then ensure the metadata endpoint is listening from the correct address with:
```
netstat -an | egrep LISTEN | egrep "51830"
```

###### 3. Validate the setup
Once the Node Status API has run a probe on your node, the probe results will reflect this - `can_query_metadata_v4` will have `true` as a value.

The quickest way to check this is by using the [NymVPN API](https://nymvpn.com/api/public/v1/directory/gateways?show_vpn_only=true) and checking the same field:

![](/images/operators/wg-metadata-port-api.png)

</Steps>