docs: note Windows WinNAT port reservations breaking SSH tunnels

[yacinenet]

Added troubleshooting steps for SSH port forwarding issues on Windows, including commands to check and release reserved ports.

• I have read and reviewed the documentation changes to the best of my ability.
• If the change is significant, I have run the documentation site locally and confirmed it renders as expected.

Summary of changes

[enyst]

I'm an AI agent based on Opus 5.5, helping Engel Nyst (@enyst) with project work.

Thanks for writing this up; the WinNAT workaround is a useful tip. It needs a different home, though:

• This page covers OpenHands Enterprise, where the browser reaches sandboxes through ingress hostnames (<id>-runtime.<domain>, dns-and-tls.mdx#L22), not random host ports. The random-port behavior belongs to the Docker sandbox in self-hosted OpenHands (sandboxes/docker.mdx#L50-L55).
• The new section lands under Related Guides, after the cards.
• There's already a WinNAT entry in troubleshooting.mdx#L58-L71. Could you move this next to it as the SSH-tunnel variant?
• 3100 isn't a documented OpenHands port; a placeholder like <app-port> would avoid confusion.

[yacinenet]

I'm an AI agent based on Opus 5.5, helping Engel Nyst (@enyst) with project work.

Thanks for writing this up; the WinNAT workaround is a useful tip. It needs a different home, though:

* This page covers OpenHands Enterprise, where the browser reaches sandboxes through ingress hostnames (`<id>-runtime.<domain>`, [dns-and-tls.mdx#L22](https://github.com/OpenHands/docs/blob/1e8a204a8560df23240240ec028ae96ac2193c9d/enterprise/k8s-install/dns-and-tls.mdx#L22)), not random host ports. The random-port behavior belongs to the Docker sandbox in self-hosted OpenHands ([sandboxes/docker.mdx#L50-L55](https://github.com/OpenHands/docs/blob/1e8a204a8560df23240240ec028ae96ac2193c9d/openhands/usage/sandboxes/docker.mdx#L50-L55)).

* The new section lands under **Related Guides**, after the cards.

* There's already a WinNAT entry in [troubleshooting.mdx#L58-L71](https://github.com/OpenHands/docs/blob/1e8a204a8560df23240240ec028ae96ac2193c9d/openhands/usage/troubleshooting/troubleshooting.mdx#L58-L71). Could you move this next to it as the SSH-tunnel variant?

* `3100` isn't a documented OpenHands port; a placeholder like `<app-port>` would avoid confusion.

Thanks, that's much clearer. Updated:

• Removed it from the Enterprise page — agreed, ingress hostnames there, not random host ports.
• Moved it into openhands/usage/troubleshooting/troubleshooting.mdx, directly after "Internal Server Error. Ports are not available", as the SSH-tunnel sibling of that entry, matching the Description/Resolution structure.
• Replaced 3100 with .

One detail worth keeping: the dynamic reservations don't reliably show up in netsh interface ipv4 show excludedportrange. In my case the table listed only 8884 and 50000-50059, yet 50575 was unbindable — which is what made it hard to diagnose, since the port looks completely free from the Linux side. That's also why Restart-Service winnat alone wasn't enough for me; the tunnel has to bind while WinNAT is stopped.

Sorry for the slow reply.

[yacinenet]

Correction on my last comment — the edit had landed on my fork's main instead of the PR branch, so the diff showed empty. Pushed to patch-1 now; the section is in troubleshooting.mdx as described.