NetBird Cloud

NetBird is an open-source, WireGuard-based overlay networking and Zero Trust Network Access platform for connecting remote users, cloud and on-premises resources, edge devices, containers, and agents through peer-to-peer encrypted tunnels. Its agents manage WireGuard connections, obtain peer candidates through ICE and STUN, exchange connection information through a signaling service, and use a relay when direct connections fail. A centralized management service maintains network state, peer addresses, access policies, and configuration updates, while the admin interface supports identity-based access control, network segmentation, SSO, MFA, device posture checks, private DNS, routes, exit nodes, SSH, reverse proxying, activity logging, and integrations such as Terraform and Ansible. NetBird can run as a hosted cloud service or be self-hosted; its repository includes the client, management, signal, and relay components, with most code licensed under BSD-3-Clause and the management, signal, and relay directories under AGPLv3.

NetBird Self-Hosted is an open-source deployment of NetBird, a zero-trust networking platform for creating private networks that connect directly to servers and other peers through WireGuard. Its self-hosting setup uses an installation script and can deploy Traefik with automatic TLS, built-in local-user authentication through an embedded Dex server, and an optional reverse-proxy service for exposing resources on the NetBird network. A NetBird client can also operate as a routing peer for services on a Docker subnet, while access policies, remote DNS, NetBird SSH, identity authentication, and service exposure are managed through the platform.

WireGuard is a cross-platform VPN tunnel and network interface for securely encapsulating IP packets over UDP. It uses a private key for each interface and public keys for peers; its Cryptokey Routing mechanism associates peers with allowed tunnel IP addresses, which select encrypted destinations when sending and act as an access-control check when receiving. The project uses cryptographic components including the Noise protocol framework, Curve25519, ChaCha20, Poly1305, BLAKE2, SipHash24, and HKDF. It is configured through the wg tool and ordinary system networking utilities, supports roaming between IP addresses, and is designed for use from embedded devices to backbone routers.

This is a self-hosting setup guide for configuring Nginx Proxy Manager and NetBird to access a self-hosted application through a reverse proxy and network connection. It is provided in the NetBird section of TechHutTV's public homelab repository, which contains homelab stacks, templates, and related resources.