netbirdio/netbird

NetBird provides a private network overlay for organizations and homelabs: every machine runs an agent that manages WireGuard, and a central Management Service holds network state and pushes access policies. It replaces opening ports, hand-written firewall rules and VPN gateways with an identity-based model where access is granted to groups and rules from one place NetBird repository.

How it works

Each agent registers with the Management Service, discovers connection candidates via ICE and STUN, and negotiates a connection through the Signal Service. If NAT traversal fails — for example on carrier-grade NAT — traffic falls back to a Relay Service, still inside a WireGuard tunnel how NetBird works. The practical consequence is that direct peer-to-peer connections avoid routing normal traffic through a central gateway, while the relay keeps the network usable when no direct path exists.

Around that core, the README lists access groups and rules, device posture checks, activity and traffic logging, private DNS and DNS routes, exit nodes for routing traffic to external networks, and SSH with central access policies access management, posture checks, SSH. A beta agent-network path extends identity-aware access to LLM APIs and private resources for AI agents, but it is explicitly marked beta agent network.

Two ways to run it

Cloud: install a client from the website, sign up with Google, Microsoft, GitHub or email, and manage peers in the admin UI install page. Self-hosted: the quickstart needs a publicly reachable Linux VM with at least 1 CPU and 2 GB of memory, TCP ports 80 and 443 plus UDP 3478 open, a public domain pointing at the VM, and Docker with Compose v2. The documented route runs a quickstart script against the latest release self-hosted quickstart. Self-hosting is the more involved path; the cloud path avoids that infrastructure setup entirely.

Clients exist for Linux, macOS, Windows, iOS, Android, Android TV, Apple TV, FreeBSD, and router or NAS platforms such as pfSense, OPNsense, MikroTik, OpenWRT, Synology, TrueNAS, Proxmox and Raspberry Pi, plus containers and serverless install docs, Linux.

Conditions worth knowing

The main branch can be unstable or broken during development; stable builds come from releases repository. Licensing is split: the repository is BSD-3-Clause except for management/, signal/ and relay/, which are AGPLv3 license — relevant if you plan to modify or redistribute those services. Bug reports go through Discussions for triage rather than straight into issues, and support asks for version, OS, deployment type and a debug bundle; the default anonymization masks public IPs, MAC addresses and non-NetBird domains but is not full redaction, and a strict level adds private and CGNAT ranges repository.

NetBird is primarily deployment and networking infrastructure, so the right fit depends on whether you want to operate or adopt an overlay rather than on client features alone.