NetBird is an open-source Zero Trust network access platform that builds a WireGuard-based overlay network connecting your machines, servers and cloud VPCs directly to one another while centralising the question of who is allowed to reach what. It is developed by NetBird GmbH, written in Go, and composed of two parts: a lightweight agent that runs on every device, and the control plane (management, signal and relay services) that coordinates them.

Where a classic VPN funnels all traffic through a central gateway and a firewall full of port rules, NetBird establishes peer-to-peer encrypted tunnels. The management server only exchanges keys and policy; the traffic itself flows device to device, and a relay is used purely as a fallback when NAT traversal fails. Because identity — not IP address — drives access, permissions follow the users and groups in your identity provider, and MFA or device posture can be required before a connection is granted. You can use the vendor’s hosted cloud service or self-host the entire control plane.

Key Features

• Peer-to-peer WireGuard overlay — machines connect directly through kernel WireGuard where the platform supports it, so there are no open inbound ports, no VPN gateway to size and no per-subnet firewall rules to maintain.
• Relay fallback — when a direct NAT traversal cannot be established, traffic is relayed through the NetBird relay service instead of failing, which keeps restrictive networks usable.
• Zero-configuration enrolment — install the agent, authenticate, and the peer registers itself. Setup keys allow headless and bulk provisioning for servers, containers and CI jobs.
• SSO and MFA through your identity provider — sign-in uses OIDC against providers such as Okta, Microsoft Entra ID, Google, Keycloak, Authentik or Zitadel, so your existing MFA settings and group membership are reused, and IdP groups can be synchronised over JWT.
• Access control groups and policies — segment people and resources into groups, then declare exactly which source may talk to which destination on which ports. Policies are evaluated per peer, independent of the underlying network topology.
• Device posture checks — gate access on device state: whether a firewall or antivirus is running, whether the device is managed by an MDM/EDR, its geographic or network location, or an explicit administrator approval.
• Networks, routes and exit nodes — advertise an entire LAN or cloud VPC through a routing peer, reach non-NetBird hosts by address, or send all of a device’s traffic out through an exit node in another location.
• Private DNS — peers get short, stable names on the overlay, and you can register custom DNS zones, nameservers and domain-based routes so internal hostnames resolve without touching public DNS.
• Activity and traffic logging — configuration changes and connection events are recorded and can be streamed to a SIEM for auditing who did what, and when.
• Automation and API — a public REST API, a Terraform provider and an Ansible collection for provisioning peers and policies from code, plus a self-hosting quickstart that brings up the whole control plane.
• IPv6 dual-stack and multiuser tenants — the overlay carries IPv4 and IPv6, and the control plane supports multiple tenants for teams that manage more than one isolated network.

Why Use NetBird

• Least privilege by default — access is an explicit allow between named groups rather than an implicit “inside the VPN is trusted” rule, which is what makes Zero Trust practical on networks too large to inspect by hand.
• Fewer moving parts than a VPN concentrator — no inbound firewall openings and no gateway bandwidth bottleneck, because the data path is peer to peer.
• Your identity provider remains the source of truth — offboarding a person in your IdP removes their network access, without a second set of accounts to maintain.
• Self-hostable without feature loss — the management, signal and relay services are open source, so a team that cannot send network metadata to a third party can run the whole control plane in-house.
• Works across clouds and on-premises — the same overlay spans AWS, other clouds, data centres and a home lab, which removes the need to route site-to-site traffic through a single vendor’s backbone.

Use Cases

• Giving a distributed or remote workforce access to internal applications without exposing them publicly.
• Connecting cloud VPCs and on-premises networks to each other across providers.
• Reaching a home lab, NAS or private server from anywhere, with access limited to specific people and ports.
• Ephemeral and CI/automation nodes joining a network with setup keys and leaving again cleanly.
• Managed service providers or platform teams isolating several customer networks with tenants and separate groups.

Platforms

Agents are available for Linux (packages and containers), macOS, Windows, Android, Android TV and iOS, with a command-line client for headless systems. The server-side components run on Linux, typically as containers or systemd services.

Licence

Open source, split licence: the repository is BSD-3-Clause for the agent, desktop UI and tooling, while the management, signal and relay services (and the combined bundles) are AGPL-3.0. The vendor also offers a hosted cloud service alongside the self-hosted option.

Website

https://netbird.io/ — documentation at docs.netbird.io.

Related

• Headscale — self-hosted control server for the Tailscale-style mesh, a lighter-weight alternative if you already use Tailscale clients.
• Browse all tools in the directory.