NetBird Self-Hosted

NetBird is an open-source, WireGuard-based overlay networking and Zero Trust Network Access platform for connecting remote users, cloud and on-premises resources, edge devices, containers, and agents through peer-to-peer encrypted tunnels. Its agents manage WireGuard connections, obtain peer candidates through ICE and STUN, exchange connection information through a signaling service, and use a relay when direct connections fail. A centralized management service maintains network state, peer addresses, access policies, and configuration updates, while the admin interface supports identity-based access control, network segmentation, SSO, MFA, device posture checks, private DNS, routes, exit nodes, SSH, reverse proxying, activity logging, and integrations such as Terraform and Ansible. NetBird can run as a hosted cloud service or be self-hosted; its repository includes the client, management, signal, and relay components, with most code licensed under BSD-3-Clause and the management, signal, and relay directories under AGPLv3.

NetBird Cloud is the hosted version of NetBird, a WireGuard-based overlay network and Zero Trust Network Access platform for connecting remote users, cloud infrastructure, on-premises resources, edge devices, and private services without self-hosting the control plane. It provides centralized network management with identity-based access policies, user and group provisioning, network segmentation, DNS configuration, SSO and MFA, device-posture checks, activity logging, and API-based automation. NetBird uses peer-to-peer WireGuard connectivity and is designed to avoid traditional VPN gateways, firewall configuration, and exposed ports. NetBird Cloud is available alongside the open-source, BSD-3-licensed self-hosted edition and offers a free plan.

This is a self-hosting setup guide for configuring Nginx Proxy Manager and NetBird to access a self-hosted application through a reverse proxy and network connection. It is provided in the NetBird section of TechHutTV's public homelab repository, which contains homelab stacks, templates, and related resources.

WireGuard is a cross-platform VPN tunnel and network interface for securely encapsulating IP packets over UDP. It uses a private key for each interface and public keys for peers; its Cryptokey Routing mechanism associates peers with allowed tunnel IP addresses, which select encrypted destinations when sending and act as an access-control check when receiving. The project uses cryptographic components including the Noise protocol framework, Curve25519, ChaCha20, Poly1305, BLAKE2, SipHash24, and HKDF. It is configured through the wg tool and ordinary system networking utilities, supports roaming between IP addresses, and is designed for use from embedded devices to backbone routers.