NetBird

What is NetBird?

NetBird is an open-source Zero Trust Networking platform written in Go that connects servers, containers, developer machines, and mobile devices into a private, encrypted WireGuard overlay network. It acts as an open-source alternative to commercial enterprise VPNs and Zero Trust Network Access (ZTNA) solutions like Tailscale, Perimeter 81, and Cloudflare One.

NetBird combines high-speed WireGuard kernel encryption with automated peer-to-peer NAT traversal (ICE, STUN, TURN), centralized web management dashboard, granular peer access policies, network routing, and native Single Sign-On (SSO) authentication.

Who Is It For?

• Enterprise Network & Security Engineers: Enforcing Zero Trust network policies where devices only communicate with authorized peers based on user identity and device posture.
• DevOps Teams: Securely accessing private Kubernetes API endpoints, database clusters, and internal staging environments from remote laptops.
• Distributed Remote Workforces: Providing employees with fast, zero-configuration remote access to internal private LAN resources.

Key Features

• Direct peer-to-peer encrypted WireGuard mesh with automated NAT traversal (Interactive Connectivity Establishment / ICE).
• Centralized web management dashboard with visual network topology and real-time connection telemetry.
• Zero Trust Access Control Rules: Define granular peer-to-peer communication policies by user groups and device tags.
• Network Routing and Gateway peers: Route entire private subnets (e.g. 192.168.10.0/24) through a single NetBird gateway node.
• Native identity provider integration supporting OpenID Connect (Authentik, Keycloak, Okta, Azure AD).

Deploying NetBird Management Server with Docker

Clone the official NetBird self-hosting repository:

Run the interactive self-hosting configuration script:

Start the management stack (Management server, Signal server, Relay server, and Web UI):

Access the web dashboard at https://netbird.example.com to log in and generate setup keys for your devices.

Connecting Client Nodes

Install the NetBird client on Linux, macOS, or Windows:

Practical Use Cases

1. Zero-Trust Access to Internal Databases

A security team configures NetBird so that only members of the "Backend Engineers" group can establish TCP connections on port 5432 to the production PostgreSQL cluster.

2. Multi-Site Network Subnet Routing

A company deploys a NetBird routing peer in an on-premises datacenter, granting remote developers access to the internal 10.0.0.0/16 network without reconfiguring corporate firewalls.

3. Remote Server SSH Access Without Public IPs

A DevOps engineer connects directly to remote staging servers over private 100.64.0.0/16 NetBird IP addresses with zero public SSH port exposure.

Troubleshooting and Limitations

• UDP Port 3478 for STUN: Ensure UDP port 3478 is open on the NetBird server firewall to allow clients to discover public endpoints and establish direct P2P connections.
• Kernel WireGuard Support: NetBird uses kernel WireGuard module when available for maximum throughput, falling back automatically to userspace WireGuard-Go if not supported.

Official Resources

• Official Website: https://netbird.io
• GitHub Repository: https://github.com/netbirdio/netbird
• Documentation: https://docs.netbird.io