Netbird

Open-source Zero Trust networking, honestly reviewed. No marketing fluff, just what you get when you self-host it.

TL;DR

• What it is: Open-source (BSD-3) WireGuard-based overlay network with built-in Zero Trust access control — connect your devices, VPCs, and remote workers through an encrypted mesh without touching a firewall or opening ports [README][1].
• Who it’s for: Self-hosters, homelab users, small engineering teams, and non-technical founders who want to replace a legacy VPN or escape Tailscale’s closed control plane [1][2].
• Cost savings: A $4–5/mo VPS covers the entire coordination stack. Traditional VPN services like NordVPN run $6–12/mo per user and you own nothing. Tailscale’s Business tier scales past $100/mo for growing teams [2][5].
• Key strength: Full self-hosting — the management server, signal server, and STUN/TURN relay all run on your infrastructure. No third-party sees your metadata [2]. Plus, peer-to-peer connections mean your traffic doesn’t route through anyone’s cloud.
• Key weakness: The self-hosted coordination server is a public-facing attack surface without a Tailscale-equivalent “Tail Lock” verification mechanism. And getting it running with an existing identity provider like Keycloak requires real effort [3][5].

---

What is Netbird

Netbird is a WireGuard-based overlay network that handles all the complexity you’d normally deal with manually — key exchange, NAT traversal, firewall rules, peer discovery — through a coordination server that you can run yourself [README]. Install the agent on each device, authenticate, and the mesh builds itself. Devices get encrypted peer-to-peer tunnels without you touching a router.

What separates it from raw WireGuard is the management layer. Netbird adds SSO, MFA, group-based access policies, device posture checks, private DNS, and activity logging on top of the WireGuard transport. You define groups (say, “infrastructure” and “laptops”), write rules that say which groups can talk to each other, and Netbird enforces it across your entire mesh. This is what Zero Trust actually means in practice: no device trusts another by default, access is earned by policy [homepage][1].

The project has 23,601 GitHub stars and is licensed BSD-3, which is one of the most permissive open-source licenses available — you can self-host, fork, modify, and embed it commercially without any licensing conversation [README]. It runs on Linux, Mac, Windows, Android, iOS, OpenWRT, serverless environments, and Docker [README].

The company behind it is real (Netbird GmbH) and actively maintained, with a new Reverse Proxy feature shipping as recently as v0.65.0 [4]. The coordination server code, the agent code, and the admin dashboard are all public on GitHub.

---

Why people choose it

The practical case for Netbird collapses into two arguments: self-hosting and structure from day one. Both come up consistently across every third-party write-up.

The Tailscale comparison. This is the fight Netbird gets pulled into most often, and it’s where the review community is most opinionated. Tailscale’s coordination server — the piece that manages peer discovery and key distribution — is closed source. You can audit the client, but not the brain. Tailscale is also US-hosted by default, which means CLOUD Act jurisdiction applies [2]. One developer who switched to Netbird after a careful evaluation put it directly: “Tailscale’s coordination server — the core of its infrastructure — is not open-source. This means users can’t audit it for security vulnerabilities or backdoors” [2].

You can self-host Tailscale’s control plane via Headscale, but it’s not the default, it’s a community project, and beginners typically discover it only after they’ve already built their network around Tailscale’s cloud [1]. Netbird is self-hosted in its normal configuration. The quickstart script deploys the full stack — management server, signal server, STUN/TURN — on a VPS. Cloud dependency is opt-in, not opt-out [1][2].

Structure, not just simplicity. The XDA Developers review makes an argument that surprised me: Netbird is actually the better tool for beginners, not despite its complexity but because of it [1]. Tailscale’s abstraction is so complete that new users don’t learn how network segmentation works. Devices join, they can see each other, and you’re done — until you realize a flat permissive network isn’t what you wanted. Netbird forces you to think in groups and policies from the first peer you add, which trains better habits: “From the beginning, NetBird has you working with groups and access policies in a way that feels closer to real network segmentation” [1]. If you’re a non-technical founder learning as you go, that structure is a feature.

Real-world use cases from the forum. The Cloudron community thread [5] gives a grounded picture of what people actually use it for: SNMP monitoring with port-level access restrictions, SMB/NFS backups between a homelab and offsite VPS, mobile access to private apps, and network routing to reach devices that can’t run the Netbird client (a Raspberry Pi energy monitor, a legacy VM that refused agent installation). The network routes feature — which lets you access non-Netbird devices through a Netbird peer acting as an egress gateway — comes up repeatedly as a differentiator versus simpler tools [5].

Data sovereignty. One developer in Germany explicitly chose Netbird because the coordination server runs in Germany under GDPR, with sub-20ms latency to their homelab [2]. That’s a meaningful argument for EU-based teams, and it’s only possible because Netbird’s coordination server is open source and self-hostable.

---

Features

Based on the README, the website, and firsthand reports:

Network connectivity:

• Kernel WireGuard — the fast, audited implementation, not userspace [README]
• Peer-to-peer connections with automatic relay fallback for strict NATs [README]
• NAT traversal with BPF [README]
• Routes to external networks — reach non-Netbird devices through an egress peer [README][5]
• Private DNS with custom nameservers [README]

Access control and security:

• SSO with Okta, Microsoft, Google, and any OIDC-compatible IdP [homepage][README]
• MFA enforcement via your identity provider’s settings [homepage]
• Group-based access policies — define which groups can reach which resources [README][1]
• Device posture checks: firewall, antivirus, geo/network location, MDM/EDR integration [homepage]
• Periodic re-authentication to force session expiry for remote workers [README]
• Activity logging and audit events, with SIEM streaming [homepage]
• Quantum-resistance via Rosenpass integration [README]
• Peer-to-peer encryption — traffic doesn’t traverse a central relay unless NAT forces it [README]

Management:

• Admin web UI with intuitive group and policy management [README]
• Auto peer discovery and configuration — no manual key exchange [README]
• IdP group sync with JWT, so your org’s groups propagate automatically [README]
• Setup keys for bulk provisioning — useful for deploying agents to many machines [README]
• Public REST API for automating network configuration [README]
• Multiuser support [README]
• Reverse Proxy (v0.65.0+) — expose internal services over HTTPS without opening ports, with TLS and auth, as an alternative to Cloudflare Tunnels [4]

Platforms: Linux, Mac, Windows, Android, iOS, OpenWRT, Docker, serverless [README]

---

Pricing: SaaS vs self-hosted math

Netbird Cloud (their managed offering): The website lists Free, Team, Business, and Enterprise tiers. The Free tier covers basic connectivity for individuals. Paid tiers add features like SSO enforcement, posture checks, and support contracts. Specific per-seat pricing isn’t published in the materials reviewed here — check https://netbird.io/pricing for current numbers.

Self-hosted:

• Software license: $0 (BSD-3) [README]
• VPS to run it on: €3.98–5/mo on Hetzner CX11 (1 vCPU, 2GB RAM, 20GB disk) [5][2]
• Domain + HTTPS: minimal if you use Let’s Encrypt via the quickstart script

Traditional VPN comparison (e.g., NordVPN):

• Consumer VPN products typically run $6–12/mo per user subscription
• You’re paying for access to their infrastructure, not building your own
• No network segmentation, no access policies, no SSO — just a tunnel through their servers
• Data exits through their infrastructure; you have no visibility into their logging

Self-hosted savings math: If you’re running Netbird for a 5-person team that would otherwise use a commercial VPN at $8/user/month: $40/mo vs €4/mo for a VPS. Over a year, that’s ~$480 saved on just the infrastructure, plus you retain full control, full auditability, and no vendor dependency. Scale that to 20 people and the math gets more dramatic — $192/mo vs the same €4 VPS.

The comparison with Tailscale’s paid tiers is also relevant: Tailscale Business runs $6/user/month. For a 10-person team, that’s $60/mo. A Netbird self-hosted deployment covering the same team costs €4/mo of VPS. The $672/year difference funds a lot of maintenance time.

---

Deployment reality check

The self-hosted path involves more moving parts than most tools in this category, but the Netbird team has worked to reduce friction.

What the quickstart script actually does: A single bash script deploys the full stack via Docker Compose: management server, signal server, STUN/TURN relay, and optionally Zitadel as the identity provider. The Cloudron forum user spun this up on a Hetzner CX11 in a single session [5]. Ports required: TCP 80, 443, 33073, 10000; UDP 3478, 49152–65535 [5].

Bring-your-own IdP: If you already have an identity provider — Keycloak, Okta, Google Workspace — the quickstart script won’t help you. You’re following the advanced setup guide, which means configuring OAuth clients, callback URLs, and JWT mappings by hand. The Cloudron forum user who integrated Keycloak explicitly noted the complexity: it works, but it’s a real setup [5]. The good news is the docs cover the major providers.

What can go sideways:

• iOS DNS. Apple’s “privacy features” can override the VPN’s DNS settings, breaking private name resolution. One developer’s workaround was a DNS Override app forcing queries through AdGuard Home — a functional fix, not an elegant one [2].

• Coordination server as attack surface. The Lawrence Systems forum raised a legitimate concern: unlike Nebula (certificate-based, where compromising the lighthouse doesn’t give you network access), Netbird’s coordination server is a public-facing service with a FQDN that stores routing config and user data [3]. A compromise of the coordinator could let an attacker add nodes to your network. Tailscale has “Tail Lock” to mitigate this; as of the time of the forum discussion, Netbird had a feature request open but no equivalent [3]. Mitigation: run the coordination server on an isolated VPS, segment it from your other services.

• Reverse Proxy uses Traefik only. The new reverse proxy feature for exposing internal services requires Traefik as the frontend. Nginx and Caddy aren’t supported. If you’re running Nginx, you can’t use this feature without swapping your proxy [4].

Realistic time estimates:

• Technical user following the quickstart with Zitadel: 30–60 minutes
• Technical user with existing Keycloak: 2–4 hours
• Non-technical user with no Linux server experience: this is the wrong tool unless someone sets it up for you

---

Pros and cons

Pros

• Fully open source (BSD-3). Management server, signal server, and client are all on GitHub and auditable. No black boxes [README][2]. This is the core differentiator from Tailscale.
• Default self-hosted. The standard deployment runs on your infrastructure. No third party sees your metadata or connection events [1][2].
• True peer-to-peer WireGuard. Traffic flows directly between peers whenever NAT allows; relay is fallback only. Latency and throughput match raw WireGuard [3][README].
• Zero Trust model from the start. Groups and policies are first-class, not an afterthought. New users build segmented networks from day one [1].
• Cross-platform breadth. Linux, Mac, Windows, Android, iOS, OpenWRT, Docker, serverless — the client runs essentially everywhere [README].
• Network routes to non-Netbird devices. Reach devices that can’t run the agent by routing through a peer [README][5]. This solves a real problem.
• Quantum-resistance with Rosenpass. If this matters to you, it’s built in [README].
• Active development. New features like the reverse proxy (v0.65.0) show ongoing investment [4].
• GDPR-compatible self-hosting. Deploy the coordinator in your jurisdiction; no US CLOUD Act exposure [2].

Cons

• No coordination server “Tail Lock” equivalent. A compromised coordinator could let an attacker add peers to your network. The risk is manageable with isolation but isn’t fully solved [3].
• Complex setup with existing IdP. Bring-your-own Keycloak/Okta is significantly harder than the quickstart suggests. Not plug-and-play [5].
• iOS DNS integration is fragile. Apple’s privacy features fight with the VPN’s DNS settings; workarounds exist but aren’t seamless [2].
• Reverse Proxy is Traefik-only. Can’t use the new proxy feature with Nginx or Caddy [4].
• Reverse Proxy doesn’t support Rosenpass. Quantum-resistance and the reverse proxy are mutually exclusive for now [4].
• Less polished than Tailscale. The client UI and onboarding experience are functional but not Tailscale-level polished. If you’re handing this to a non-technical person, budget for setup support [1].
• Small coordination server attack surface. Public-facing VPS with FQDN holding network config — requires deliberate isolation [3].

---

Who should use this / who shouldn’t

Use Netbird if:

• You’re a self-hoster or homelab user who wants to actually own the networking stack and learn how it works.
• You’re in the EU or another jurisdiction with strong data protection requirements and need the coordination server on your own servers.
• You’ve evaluated Tailscale and specifically object to the closed-source control plane or US-hosted metadata.
• You need to reach devices that can’t run a VPN agent — the network routes feature handles this cleanly.
• You’re an engineering team that wants Zero Trust access policies from the start, not bolted on later.
• You’re willing to spend 30–90 minutes on initial setup for a free, self-owned network.

Skip it (use Tailscale instead) if:

• You’re a non-technical user who needs something working in 5 minutes with no server to manage.
• You don’t care who hosts the coordination server and want the most polished client experience available.
• You’re deploying to non-technical end users who can’t deal with VPN setup friction.

Skip it (use Headscale) if:

• You’re already deep in the Tailscale ecosystem but want to move the control plane on-premise. Headscale gives you self-hosted Tailscale compatibility.

Skip it (use raw WireGuard) if:

• You have one server, one laptop, no team, and you’re comfortable writing config files. The coordination layer is overhead you don’t need.

Skip it (use Nebula) if:

• Your primary concern is coordination server security. Nebula’s certificate-based model means compromising the lighthouse gives attackers nothing — they can’t join your network. This is a genuine architectural advantage [3].

---

Alternatives worth considering

• Tailscale — the obvious comparison. Easier setup, more polished clients, massive user base. Closed-source control plane, US-hosted by default, paid tiers for teams. If control plane auditability doesn’t matter, Tailscale is likely the right choice for most people [1][2].
• Headscale — the open-source Tailscale control plane replacement. Gives you self-hosted Tailscale without the cloud dependency. Tailscale clients work unchanged [1].
• Nebula (by Defined Networking) — certificate-based mesh networking. The lighthouse (coordinator) can be fully compromised without giving attackers access to the network. More secure coordinator model, less convenient [3].
• ZeroTier — the predecessor in this category. Solid product, but ACL configuration is unintuitive enough that users in the Cloudron forum abandoned it for Netbird [5].
• Netmaker — another WireGuard overlay tool. Had update stability issues serious enough that at least one user lost their entire network configuration after an upgrade [5].
• WireGuard (raw) — no coordination server, no management UI, no peer discovery. Right for technically sophisticated solo setups; not a tool for teams.
• Cloudflare Tunnels — for the specific problem of exposing internal services without opening ports. Cloudflare terminates TLS at their edge (they see your traffic). Netbird’s own Reverse Proxy is the privacy-preserving alternative [4].

---

Bottom line

Netbird is the answer to one specific question: “I want a WireGuard mesh network, I want to own it entirely, and I want it to enforce real access policies — not just connectivity.” If that’s your question, Netbird is the best-structured open-source answer in this space right now. The BSD-3 license, the fully self-hostable stack, and the Zero Trust policy model from day one are real differentiators from everything else in the category.

The trade-offs are also real: Tailscale’s clients are more polished, Nebula’s coordination model is more secure against a compromised control server, and raw WireGuard is simpler if you don’t need the mesh. But for a homelab user, a small EU-based engineering team, or a non-technical founder who’s been talked into understanding their own infrastructure — a €4/mo VPS running Netbird beats paying per-seat VPN bills indefinitely, and it teaches you something about how your network actually works while doing it.

If the initial setup is the blocker, that’s exactly the kind of one-time deployment that upready.dev handles for clients.

---

Sources

1. Ty Sherback, XDA Developers — “Tailscale is great, but NetBird is better for first-time home-labbers” (Feb 12, 2026). https://www.xda-developers.com/tailscale-is-great-but-netbird-is-better-for-first-time-home-labbers/

2. Tobias Käfer (tkaefer.de) — “Open-Source vs. Convenience: Why I Chose NetBird Over Tailscale for Secure Remote Access” (Dec 20, 2025). https://tkaefer.de/blog/2025/12/20/open-source-vs-convenience-why-i-chose-netbird-over-tailscale-for-secure-remote-access/

3. Lawrence Systems Forums — “NetBird Review Questions — Networking & Firewalls” (May 2024). https://forums.lawrencesystems.com/t/netbird-review-questions/21343

4. Damaso Sanoja, netbird.io Knowledge Hub — “Cloudflare Tunnels vs. NetBird Reverse Proxy” (March 12, 2026). https://netbird.io/knowledge-hub/netbird-reverse-proxy-vs-cloudflare

5. DanTheMan, Cloudron Forum — “NetBird - installation and my experience” (2024). https://forum.cloudron.io/topic/11158/netbird-installation-and-my-experience

Primary sources:

• GitHub repository and README: https://github.com/netbirdio/netbird (23,601 stars, BSD-3 license)
• Official website: https://netbird.io
• Pricing page: https://netbird.io/pricing
• Documentation: https://docs.netbird.io