WireGuard

NetBird is an open-source, WireGuard-based overlay networking and Zero Trust Network Access platform for connecting remote users, cloud and on-premises resources, edge devices, containers, and agents through peer-to-peer encrypted tunnels. Its agents manage WireGuard connections, obtain peer candidates through ICE and STUN, exchange connection information through a signaling service, and use a relay when direct connections fail. A centralized management service maintains network state, peer addresses, access policies, and configuration updates, while the admin interface supports identity-based access control, network segmentation, SSO, MFA, device posture checks, private DNS, routes, exit nodes, SSH, reverse proxying, activity logging, and integrations such as Terraform and Ansible. NetBird can run as a hosted cloud service or be self-hosted; its repository includes the client, management, signal, and relay components, with most code licensed under BSD-3-Clause and the management, signal, and relay directories under AGPLv3.

NetBird Cloud is the hosted version of NetBird, a WireGuard-based overlay network and Zero Trust Network Access platform for connecting remote users, cloud infrastructure, on-premises resources, edge devices, and private services without self-hosting the control plane. It provides centralized network management with identity-based access policies, user and group provisioning, network segmentation, DNS configuration, SSO and MFA, device-posture checks, activity logging, and API-based automation. NetBird uses peer-to-peer WireGuard connectivity and is designed to avoid traditional VPN gateways, firewall configuration, and exposed ports. NetBird Cloud is available alongside the open-source, BSD-3-licensed self-hosted edition and offers a free plan.

NetBird Self-Hosted is an open-source deployment of NetBird, a zero-trust networking platform for creating private networks that connect directly to servers and other peers through WireGuard. Its self-hosting setup uses an installation script and can deploy Traefik with automatic TLS, built-in local-user authentication through an embedded Dex server, and an optional reverse-proxy service for exposing resources on the NetBird network. A NetBird client can also operate as a routing peer for services on a Docker subnet, while access policies, remote DNS, NetBird SSH, identity authentication, and service exposure are managed through the platform.

Warpgate is a self-hosted, transparent bastion and privileged-access-management system for SSH, HTTPS, Kubernetes, MySQL, PostgreSQL, RDP, and VNC. Deployed on a bastion or DMZ host, it assigns users to specific hosts and URLs and forwards connections directly to their targets without requiring client-side software, SSH wrappers, or custom clients. Native clients remain compatible, while browser-based SSH, RDP, and VNC access is also provided. Warpgate records sessions for live viewing and later replay through an administrative web UI, with command-level auditing. It includes TOTP two-factor authentication, OpenID Connect single sign-on, temporary access tickets, brute-force protection with IP blocking and user lockout, and is distributed as a dependency-free single binary written in Rust.