11 ms·

Netbird – Open Source Zero Trust Networking

741 points by l1am0 8mo ago

oaiey 8mo ago
Sweet. Alternatives are always something good.
lwde 8mo ago
But it's missing a tailscale funnel like feature, right? That's one of the main features that I use for some home assistant instances.
- ethangk 8mo ago
  Out of curiosity, why? I use TS for all my homelab bits (including my HA instance), but connect to TS before opening the HA app. Is it just a case of making it easier/ possible to connect if you’re on another VPN? Are you not concerned with having something from your local network open to the internet?
  - Galanwe 8mo ago
    I use funnels for things like Vaultwarden, that are secure enough to be exposed on internet, and would be cumbersome if behind the tailnet. I use serve for everything else, just for the clean SSL termination for things that should stay within the telnet, like *arr stacks, immich, etc.
    - ethangk 8mo ago
      Ah neat, that makes sense. Thanks. Do you have anything that’ll trigger a notification if there’s suspicious traffic on your local network? I may be overly paranoid about exposing things on my local network to the internet.
      - Galanwe 8mo ago
        Not really, but these stuff are in an isolated DMZ vlan, so theres not much to escalate to. I fancy a bit upgrading to a smarter router like unify's with integrated firewall and stuff like like though.
    - edentrey 8mo ago
      After a decade with KeePass, I’ve finally moved to Vaultwarden. I’ll admit, self-hosting such a critical service still feels a bit scary, but the seamless syncing across all my devices is a huge upgrade. To balance the risk, I keep it tucked safely behind Tailscale for that extra peace of mind.
  - deleted 8mo ago
    [deleted]
  - m_santos 8mo ago
    Besides the use cases listed, we see this as an opportunity for homelabers and organizations to add authentication with access control to already exposed services.
- Galanwe 8mo ago
  Agree, I use funnels and serves a lot as well. Very useful for homelabers.
- m_santos 8mo ago
  We are developing a similar feature and is scheduled to be available really soon. We've discussed some details in our public slack. Any feedback there will be helpful.
- gnyman 8mo ago
  Please be aware that when you use tailscale funnel you announce to the whole world that your service exists (through certificate transparency), and you will get scanned immediately. If you don't believe me just put up a simple http server and watch the scanning request come in within seconds of running `tailscale funnel`. Do not expose anything without authentication. And absolutely do not expose a folder with something like `python -m http.server -b 0.0.0.0 8080` if you have .git in it, someone will help themselves to it immediately. If you are aware of this, funnel works fine and is not insecure. Tailscale IMHO failing in educating people about this danger. They do mention in on the docs, but I think it should be a big red warning when you start it, because people clearly does not realise this. I took a quick look a while ago and watching just part of the CT firehose, I found 35 .git folders in 30 minutes. No idea if there was anything sensitive I just did a HEAD check against `.git/index` if I recall. https://infosec.exchange/@gnyman/115571998182819369 https://infosec.exchange/@gnyman/115571998182819369
thenaturalist 8mo ago
Besides the solid product, Misha & Maycon are just great and friendly people to work with.
- braginini 8mo ago
  love it! :)
estsauver 8mo ago
There's also https://pangolin.net/ https://pangolin.net/ which is kind of similar, and I believe a YC company.
- OtomotO 8mo ago
  Does that have ties to the US? If so it's not playing in the same ballpark. US citizens may not be aware, but due to POTUS "made and maintained in Europe" is becoming more and more important to EU.
  - edentrey 8mo ago
    I see Pangolin has a Self-Host Community Edition, doesn't that already give something over digital sovereignity for EU users? I am considering both for a migration from Tailscale, any suggestion on their differences?
    - moonlightbandit 8mo ago
      They solve different problems. For a Tailscale migration, NetBird is the direct swap. Pangolin won't give you device-to-device connectivity. On EU sovereignty: NetBird is Germany-based and explicitly positions itself as a European alternative. Self-hosted gives full control with no callbacks to their servers. Pangolin is US/YC-backed, so while self-hosting gives you control of the data plane, the project itself is American. Also, NetBird has a reverse proxy feature coming this quarter, which would cover the Pangolin use case within the same platform.
      - gnufx 8mo ago
        With regard to European sovereignty, I note that Netbird uses AWS.
- braginini 8mo ago
  Not quite similar tho. Pangolin is a reverse proxy, NetBird is p2p mesh for internal resources remote access
Benedicht 8mo ago
Using it self hosted for almost a year now, no issues, just works for me.
- braginini 8mo ago
  That is awesome!
FloatArtifact 8mo ago
If the VPN connection would stay connected despite having it set up that way in the web UI.. It would be a good product. Still haven't figured out how to do Termux on Android with netbird ssh yet.
- edentrey 8mo ago
  can you please elaborate on this? I use termux on android with tailscale and it works flawless, is it not possible on Netbird?
  - FloatArtifact 8mo ago
    The following documentation doesn't work obviously because it's not on path. I need to do further reading of the docs, but I haven't had time yet. netbird ssh user@100.119.230.104 https://docs.netbird.io/manage/peers/ssh https://docs.netbird.io/manage/peers/ssh
  - FloatArtifact 8mo ago
    If I simply try... ssh user@100.119.230.104 it asked for a password, but there is no password.
edentrey 8mo ago
Tailscale is the only non-self-hosted part of my setup now and this has bugged me since. I use a custom Nameserver rule to point all my subdomains to a Caddy container sitting on my Tailnet. Caddy handles the SSL and routes everything to the right containers. I skipped Tailscale Funnel on purpose; since these are just family services, I’d rather keep them locked behind the VPN than open them up to the web. This project looks promising as a replacement for my current setup and for its digital sovereignity of self hosting the server. I'm looking to manage several embedded devices remotely via Tailscale, but I've hit a major roadblock: the 90-day maximum expiration for Auth Keys. Constantly renewing these tokens is a significant maintenance burden, so I'm searching for a more permanent, 'set-and-forget' solution for my remote hardware.
- tass 8mo ago
  Tailscale allows you to disable the expiration time - I do this for my gateways. My other simplifier is having everything at home get a .home dns name, and telling Tailscale to route all these via tailnet.
  - edentrey 8mo ago
    can you please tell me how to disable expiration time? I see auth keys have an Expiration which says it "Must be between 1 and 90 days." I do use a custom domain name as well with a Nameservers rule to have all my services reachable as subdomains of my custom domain.
    - deleted 8mo ago
      [deleted]
    - aidos 8mo ago
      You can create an oauth client that can generate keys as you need them. https://tailscale.com/kb/1215/oauth-clients#generating-long-lived-auth-keys https://tailscale.com/kb/1215/oauth-clients#generating-long-...
    - matthewmacleod 8mo ago
hollow-moe 8mo ago
I'm currently comparing it with pangolin and headscale for my small scale company infrastructure access. Been running headscale for my own setup for a while but maybe netbird or pangolin might be better for real production.
- edentrey 8mo ago
  I am in the same position but currently using Tailscale and realize how important and critical it has become for my whole family infrastructure. A self-hosted solution which allowed me to use Nameservers and TLS termination as I currently do would be awesome.
- usagisushi 8mo ago
  Pangolin recently added desktop clients for win/mac/linux[0] and the Private Resource feature (similar to Netbird's Network Routes/DNS), so it's starting to overlap with Netbird more and more. That said, it seems focused on client-to-site (newt) connections, and I don't see support for client-to-client connections like Netbird’s SSH access. Also, their Private Resources don't seem to support TLS termination yet. (Correct me if I’m wrong!) In my case, I have a k3s cluster running on Netbird with a Traefik ingress for TLS termination inside my home network. Thanks to netbird's P2P nature, traffic stays entirely local as long as I'm on my home WiFi. (I suppose one could achieve the same with a Netbird + Caddy + DNS-01 setup, too.) [0] https://docs.pangolin.net/manage/clients/understanding-clients https://docs.pangolin.net/manage/clients/understanding-clien...
vlovich123 8mo ago
How does this compare with Defguard? Also European but seems more featureful maybe?
- braginini 8mo ago
  Defguard as of my knowledge is a traditional VPN with a central gateway. NetBird is an overlay network with a full mesh capabilities. Though you can set it up in a gateway-like style with NetBird Networks but without opening ports and with HA out of the box: https://docs.netbird.io/manage/networks https://docs.netbird.io/manage/networks
- teon 8mo ago
  Hi, Robert from Defguard here. Defguard is a *Secure by Design* solution, which means security is important (if not more) then functionality. Lower latency or peer-to-peer communication does not automatically mean better security often it means a larger attack surface. Defguard is also *the only solution that enforces MFA on every connection*, aligning with true Zero Trust principles never trust a user or device by default. Why Peer-to-Peer Is Not Safer? Peer-to-peer and mesh solutions can be faster because traffic flows directly between peers, but they almost always expose all components publicly and make it easier to hijack the network or inject unauthorized peers. So what does Defguard’s Secure-by-Design Architecture mean? 1. Minimal gateway exposure The Defguard gateway exposes only a WireGuard port. Compromising it would require a Linux kernel or WireGuard zero-day at that point, no solution is safe. 2. Isolated, stateless proxy The only Internet-facing "application" component is a stateless proxy, deployed in a separate network segment. It has no access to the gateway, core, or internal resources. 3. Protected control plane The core (control plane) runs strictly inside the intranet (local network that should not be exposed anywhere). No user data are exposed to the Internet or DMZ/other network segments. Also the MFA validation process is done in secure network segments (for example when doing MFA with Desktop + Mobile client biometry/faceID combined). Why This Is Different from Mesh Solutions? Most mesh VPN solutions expose their control and peer-discovery components publicly by design. This significantly increases the risk of compromise and peer injection. So that's about it.
  - 8mo ago
BoredPositron 8mo ago
Missing some technical bits to be a true contender for me but I bet they are getting there. That said I've seen so many shadcn based scam sites that my brain starts associating shadcn with scams.
- braginini 8mo ago
  For example? Curious what is missing
  - BoredPositron 8mo ago
    It funnels and lets encrypt certs for me and I am really not a fan of the android client.
    - braginini 8mo ago
      Got you. We are on it. One feature that is coming very soon is a reverse proxy .Similar to cloudflare tunnels. With auth, TLs, etc. Would it suffice?
      - oriettaxx 8mo ago
        +1 from me. In general I would keep an eye on the path CF is following with warp: which is great, but since they are so big and in fast evolution, it is a bit of a mess (their doc is outdated and changes too frequently) not to count (literally) their support (free version, and our company's opinion only, of course) since on warp it is totally useless.
        braginini 8mo ago
        Roger that!
    - m_santos 8mo ago
      Would love to learn more around your android experience
RedShift1 8mo ago
I'm really missing something like Cisco DMVPN. A VPN mesh between different routers where all routers have a connection to each other, so that all traffic doesn't have to pass through the hub. And that runs on a router, because all these solutions only run on a regular computer with a complete OS.
- rwky 8mo ago
  Check https://tinc-vpn.org/ https://tinc-vpn.org/ it may run on your router if you're running openwrt or similar
- PLG88 8mo ago
  Out of curiosity, why? Because you dont want to run software on users devices?
genie3io 8mo ago
[dead]
aaronds 8mo ago
A bit lower level than most things discussed here but on the topic of overlay networks, I’ve used nebula for years and can recommend it https://github.com/slackhq/nebula https://github.com/slackhq/nebula
- sreekanth850 8mo ago
  it his much complex to setup then wireguard based?
  - prmoustache 8mo ago
    It is the easiest to setup and understand really. There are no users, just hosts and their keys. What it doesn't offer is a gui or tool to handle copying/installing/revocating keys so you trade super easy setup for a handful of nodes to management overhead if you are scaling up and down regularly.
- ysleepy 8mo ago
  I've used it for some time, it feels very much like it is in maintenance mode. You manage a PKI and have to distribute the keys yourself, no auth/login etc. it's much better than wireguard, not requiring O(N) config changes to add a node, and allowing peoxy nodes etc. iirc key revocation and so on are not easy.
  - c0balt 8mo ago
    Nebula does not require O(n) config changes for adding a node. O(n) is only required for: - active revocation of a certificate (requires adding the CA fingerprint to the config file) - adding/removing a lighthouses (hub for publishing IPs for p2p) or relay (for going over p2p) - CA rotation
    - cpach 8mo ago
      AFAICT you and 'ysleepy are in agreement.
braginini 8mo ago
https://github.com/netbirdio/netbird https://github.com/netbirdio/netbird
no_time 8mo ago
F-droid inclusion seems to be stalled https://gitlab.com/fdroid/rfp/-/issues/2688 https://gitlab.com/fdroid/rfp/-/issues/2688 Having it in F-droid, vetted by their policies is kind of my benchmark for "software that is guaranteed to be not crapware." That being said I'm rooting for the devs, having an alternative for tailscale+headscale would be nice, because as it stands it's kind of dependant on the goodwill of a for profit company (finite).
- Borealid 8mo ago
  https://codeberg.org/bg443/JetBird https://codeberg.org/bg443/JetBird appears to use the same core library (and is just a different Android frontend wrapper).
- micw 8mo ago
  I recently brought my first app to F-Droid. It was not friction free, but I was able to do it within a few weeks. Seems they put not much effort into this, e.g. the basic check marks are not even checked...
speedgoose 8mo ago
I replaced Teleport by a bunch of various tools, and I had to chose between tailscale/headscale and netbird for the network connectivity. I’m pleased with netbird so far. I had some weird bugs on a few old servers during the transition, and the support was helpful even though I am a small customer. We eventually switched to user space wireguard on those servers.
mittermayr 8mo ago
I can only recommend giving headscale a try. It's free, works extremely well, and can be used with the official Tailscale clients. Was super easy to set up. https://headscale.net/stable/ https://headscale.net/stable/
- rpastuszak 8mo ago
  Any luck using with with a VPN like Mullvad as an exit node?
  - SparkyMcUnicorn 8mo ago
    I've done this a few different ways. I started with a docker container that connected to both the VPN provider and tailscale. Now OPNSense is handing a few connections to the VPN provider at a couple locations around the world, and enforcing external traffic to be routed to the VPN connections via VLAN tags (untagged has direct internet access). Using the VPN provider can either be adding a VLAN tag to a machine/container or connecting to a "vpn-{location}" tailscale exit node.
- db04 8mo ago
  Is Headscale suitable for production use?
  - tucnak 8mo ago
    No, it's only viable if your whole network is, like, five devices.
    - protimewaster 8mo ago
      I assume this is an exaggeration? Another poster says they have good luck with headscale on two networks of 400 devices.
      - mittermayr 8mo ago
        yeah looks like someone is either a hyper tailscale fan or had extremely bad experience with it, I also run several dozens of machines (and tablets and phones) on it. never had a single moment of downtime since I started.
usagisushi 8mo ago
Netbird's flexibility with IdPs is really nice. I recently switched mine to Pocket ID. Overall, it's perfectly sufficient and lightweight for homelab use.
- m_santos 8mo ago
  Thanks for your feedback. I have a question: What do you think about the number of containers in our quick start deployment? Was that a concern?
  - usagisushi 8mo ago
    You’re from the dev team, right? Thanks for the amazing OSS! Regarding the containers, AFAIK it's 5 for the core setup (dashboard/signal/management/relay/coturn) plus Traefik in my case. It feels like a bit much, but the services are almost stateless and not resource intensive even on my little VPS. The setup script (bash + envsubst) is so straightforward and thanks to good documentation, I’ve never found the setup confusing. (I use Renovate to keep things updated, but I’d love to know if there's a recommended update path.) A couple of minor things I noticed: 1. the dashboard image isn't on ghcr.io. 2. the generated compose.yaml contains hardcoded values. It could be even better if it referenced values from a .env file instead. By the way, are there any ways to support NetBird other than GitHub Sponsors?
    - braginini 8mo ago
      Your usage is the best form of sponsorship haha
    - braginini 8mo ago
      Coturn is not needed in the new versions as STUN is embedded in the relay service now
shtrophic 8mo ago
Last time I checked it couldn't do ipv6... in 2026?
- niemandhier 8mo ago
  Could be intentional: German privacy advocates really like that the limited ipv4 pool forces reusing IPs and prevents accidental imprinting a practically static address on a device.
  - sunshine-o 8mo ago
    Makes a lot of sense. But self-hosting still require at least a public domain name [0], so here goes your privacy right? - [0] https://docs.netbird.io/selfhosted/selfhosted-quickstart#infrastructure-requirements https://docs.netbird.io/selfhosted/selfhosted-quickstart#inf...
    - fc417fc802 8mo ago
      > The VM must be publicly accessible on TCP ports 80 and 443, and UDP port 3478. > A public domain name that resolves to the VM’s public IP address. Since it already uses DNS it's disappointing that it hardcodes ports instead of using SRV records. IMO anything that can use SRV records should. It makes for a more robust internet.
      - sigio 8mo ago
        The number of products that actually use SRV records is surprisingly low (besides some mailservers and kerberos)
  - fc417fc802 8mo ago
    Can't do IPv6 internally or externally? Internally there should be zero need for ~infinite addresses. Externally though I certainly hope all software is capable of operating via IPv6 at this point because otherwise it will only be increasingly broken.
sunshine-o 8mo ago
For someone who want to setup a private network between host/devices, I feel the dilemma is always: 1. Trust a third party like Tailscale by giving them the key to your kingdom, but everything is incredibly easy and secure. 2. Self-host but need at least one host with a fixed IP address and an open port on the Internet. What requires a set of security skills and constant monitoring. That includes headscale, selhosted netbird, zerotier or a private yggdrasil mesh.
- abcd_f 8mo ago
  You can conceal that open port with some form of port knocking. Though this does reinforce your "easy" point. Also, if it's an UDP port, then using a protocol that expects first client packet to be pre-authenticated and not emitting any response otherwise gets you pretty damn close to having this port closed.
  - sunshine-o 8mo ago
    Thanks for the suggestion ! I looked into it but it seems that port knocking and Single Packet AuthZ literally open the firewall and expose the port when used. Meaning it is great to reveal the SSH port when needed, do your business quickly and close it back when you are done. But my guess is those overlay networks need to port available all the time, so...
    - abcd_f 8mo ago
      Port knocking should open up the port for the IP that sent the knock. Not for everyone.
- CommanderData 8mo ago
  When I look at these zero trust solutions need 80/443 for what seems some type of bootstrapping Better it happens using the same approach wireguard takes (udp/stateless). Though I'm not sure if there's more than just bootstrap taking place, maybe constant routing updates etc
junon 8mo ago
We just evaluated this the other day and we were pretty impressed by it. We were looking for something we could self host for wireguard config but tbh we might just pay for the managed solution.
regisso 8mo ago
I recommend it the NetBird team is transparent and easy to reach. I switched from Tailscale a while ago (2y), went fully self-hosted, and upgrades across versions have been smooth, which tells me they care about the self-hosted, not just their cloud offering.
- smashed 8mo ago
  We tried netbird but could not get the client to register to a self hosted server. It ignored the setting or failed. Good chance it was user error on our part. Most of their documentation is very unclear about what is a cloud offering feature and what is possible using self-hosting. There are features not available on the community edition and you have to be very careful reading their doc. Just putting it out there so people do not think it's an easy solution. It will require appropriate planning. I do think its a more promising solution than headscale if you want to self host as it is a complete package, unlike tailscale where you need to modify registry keys to change the cloud URL and headscale is a simplified, non-multi-tenant signaler.
  - SebastianKra 8mo ago
    We also had a bunch of problems. The DNS resolution didn't work, and support was unable to figure out the reason. A coworker reported domain access breaking when he went to office 1, but fixed itself when he went to office 2. For a while, when you logged in with the wrong account, it was near impossible to replace it. This on is fixed now, but the entire thing still feels very much like paying for beta software.
    - teruakohatu 8mo ago
      I have endless DNS problems with Tailscale. So I am guessing it’s a hard problem.
      - jasona123 8mo ago
        It's like the haiku says: It’s not DNS There’s no way it’s DNS It was DNS
pranaysy 8mo ago
Long-time ZeroTier user here. Recently switched to NetBird (self-hosted on a Hetzner VPS) and it’s been seamless so far. DNS functionality is excellent (something ZeroTier lacked), and the access-control model is very well designed. It’s easy to understand what’s going on and to grant one-off access when needed. Only real and very minor gripe is the Android app: I wish it were on F-Droid and a bit more robust, as it sometimes drops when roaming. Nevertheless, congratulations on a fabulous piece of software! I hope it keeps improving :)
- benoliver999 8mo ago
  Also long time zerotier user here, I run a controller for our company. I'm starting to experience infrequent but annoying drops in connection, and DNS is a headache. How is netbird on iOS?
  - greenavocado 8mo ago
    I switched from Zerotier to Tailscale last year and Tailscale is far more performant and stable but Zerotier works better with multicast, specifically multicast video. I even ran a Zerotier moon to help but it was still worse than Tailscale.
- mac-attack 8mo ago
  I've been using jetbird from fdroid. I have never tried the official app, but I have good experiences with Jet Bird.
  - pranaysy 8mo ago
    Thanks! Will try asap
- chillfox 8mo ago
  Does Tailscale/ZeroTier/Netbird provide anything beyond a GUI wrapper for Wireguard? How easy is it to make it manage an already configured Wireguard mesh network?
ZoomZoomZoom 8mo ago
Tailscale is great and headscale is an important step to gain trust. However, headscale is useless without the clients, and Tailscale geoblock installing clients where they can. If the platform requires jailbreak for installing user-chosen software, as is the case with iOS, then it all becomes useless. Open (preferably free software) clients without idiotic restrictions could be one of the main advantages for any competing solution. Does Netbird provide them?
- nixosbestos 8mo ago
  Why would Tailscale seek to limit access to their clients, other than where required by law? The Android client, at least is FOSS. It's hardly Tailscale's fault that people buy iOS devices.
  - ZoomZoomZoom 8mo ago
    I don't care why. They do nothing to circumvent this so they are not a reliable solution for those who have network participants using the restricted platforms. There could be a million reasons, but not a technical one — "headscale client", for example, could exist in current hostile app stores, but there isn't one.
    - nixosbestos 8mo ago
      Your arbitrary, loosely-detailed complaints would apply to literally everyone, every app. It's on f-droid, it's open source, you're being ridiculous. I'm not even sure you understand what you're asking for. The official, open source Tailscale client explicitly supports headscale servers.
      - ZoomZoomZoom 8mo ago
        It's the only app from the ones I use that my friends and relatives who already use iOS can't even install due to geoblocking. If you don't see it as a problem means you're not affected and perhaps lack some empathy. Yes, I understand the Apple ecosystem is a problem. But it's not an insurmountable one. Builds of Free Software exist on Apple Appstore and none of them exhibit this problem, unless they are tied to a commercial entity in the corresponding jurisdiction. The issue with Tailscale is that they use their open-source clients and headscale as means to gain user trust, but their solution is deficient due to everything mentioned above. > I'm not even sure you understand what you're asking for. I'm asking for a free software client to go with the headscale server that can be installed everywhere technically viable, without idiotic additional restrictions. It's clear that it's you who don't really understand the crux of the issue (which you partially admitted by you "not even sure", but still), but it's somehow I who's ridiculous.
geoctl 8mo ago
(Shamless plug) I am also working on a similar FOSS, self-hosted project called Octelium https://github.com/octelium/octelium https://github.com/octelium/octelium that you might find interesting if you are interested in this space. Octelium is, however, more of a generic/unified zero trust secure access platform that can operate as a remote access VPN, a ZTNA platform, API/AI/MCP gateway, a PaaS, an ngrok-alternative and a homelab infrastructure. It provides unified client-based as well as clientless access for both humans and workloads; dynamic identity-based secretless access (e.g. access to HTTP/gRPC/k8s upstreams without sharing API keys and access tokens, SSH without distributing passwords/private keys, postgres/MySQL databases without sharing passwords, etc.); dynamic L7-aware, identity-based access control ABAC via CEL and OPA as well as dynamic routing to upstreams via policy-as-code; native Passkey login/WebAuthn/TOTP MFA and support for OIDC/SAML IdPs, OpenTelemetry-native L7-aware visibility and auditing; clientless access via OAuth2 for workloads, WireGuard and QUIC tunneling with dual-stack and automatic private DNS, including in rootless mode; passwordless SSH'ing into containers and IoT without SSH servers; deploying and securing access to containers; declarative k8s-like management with horizontal scalability among other features. You can read more in the README if you're interested.
- nszceta 8mo ago
  It took me too long to understand the difference between the two so I'll leave it here for others. Octelium operates on OSI Layer 7 and Tailscale operates on OSI Layer 3 and 4.
  - geoctl 8mo ago
    Well, yes, Octelium is technically a VPN from a layer-3 perspective since it uses WireGuard/QUIC tunneling, but the tunnel doesn't directly terminate to the destination like in VPNs but instead to an identity-aware proxy that does authentication and L7-aware authorization on a per-request basis with policy-as-code via CEL/OPA. From an architecture perspective, I assume it's closer to ZTNAs such as Cloudflare Access and Teleport than to traditional VPNs, even though it operates as one for the clien-based access mode. However, unlike VPNs, it does provide clientless/BeyondCorp access too as it's intended to operate as a more generic/unified access platform (e.g. API/AI/MCP gateway, ngrok-alternative, PaaS-like platform, etc.) rather than just a VPN.
alturp 8mo ago
Always my problem with Tailscale and similar solutions is that I already run VPNs in my personal devices and especially with android devices, I need to switch between two VPNs, which I find a friction that I do not want. Does anybody know a solution to this?
- ksynwa 8mo ago
  Tailscale has some integration with Mullvad. If you have a Mullvad subscription you can use their servers as exit nodes without dropping your Tailscale connection: https://tailscale.com/kb/1258/mullvad-exit-nodes https://tailscale.com/kb/1258/mullvad-exit-nodes Outside of the particular combination of Mullvad and Tailscale I don't think there is any other way apart from switching between the two.
- mlrtime 8mo ago
  Not elegant or performant but: You could have a exit node that is setup only for that vpn that advertises it's routes. So connecting to tailscale gives you access to that network.
- xrd 8mo ago
  Maybe I don't understand, but the tailscale Linux clients definitely supports multiple accounts. I use that to reach multiple headscale networks and a tailscale one. No issues for me using it this way.
CommanderData 8mo ago
Most of the self-hosted zero trust solutions require opening 80/443. It would be nice if they could adopt Wireguards approach of using UDP only, and only responding if the request is valid. Maybe it's possible without modification to Netbird to setup a staging network.
gnufx 8mo ago
I've looked without success for external audit reports of either Tailscale and Netbird, like Mullvad gets. While I don't approve of the sort of auditor box-ticking we get at work, it would be reassuring to see a report from a proper security consultancy.
- somepleb 8mo ago
  Netbird has supposedly done a penetration test, but it is only supplied upon request [0]. I haven't bothered trying to get my hands on it since I don't use their product. I don't agree with gatekeeping the results instead of making them public. NetBird should also consider publishing an SBOM, similar to what Defguard does.[1]. [0] https://trust.netbird.io/ https://trust.netbird.io/ [1] https://defguard.net/sbom/ https://defguard.net/sbom/
  - gnufx 8mo ago
    Oh, I hadn't found that. Yes, it seems strange not to publicize something like that to give users confidence (assuming the audit/pentest isn't damning). It doesn't have to have been perfect initially, as long as appropriate fixes were made.
sigio 8mo ago
I've head Netbird running for the last few months... In general it works quite well, but it would keep messing with my dns-resolving, and I couldn't find the setting to stop it inserting itself into my resolv.conf. During the last few weeks I've removed netbird from all my systems (about 12), mostly because of issues on laptops where resolving or networking would break after they moved to a different network/location.
- usagisushi 8mo ago
  Just for future reference, you can disable DNS management for specific groups [0]. You can find the option under "DNS > DNS Settings > Disable DNS management for these groups". Netbird will stop modifying the resolv.conf on those groups. [0] https://docs.netbird.io/manage/dns#4-dns-management-modes https://docs.netbird.io/manage/dns#4-dns-management-modes
  - Borealid 8mo ago
    Can Netbird run the DNS resolver (so it can be used for the internal domain ONLY by systemd-resolved) but not alter the host's DNS settings? It looks to me like the setting that tells Netbird to leave the system DNS alone is arbitrarily tied to the setting that causes it to run a resolver at all.
gonzalohm 8mo ago
What's the advantage over running plain wireguard?
- Tajnymag 8mo ago
  Much easier setup, management, permissions, meshing etc.
cedws 8mo ago
Has anybody looked at whether Tailscale is subject to the US CLOUD Act? If so I can imagine we might be moving towards an open source solution like this in future.
- nebezb 8mo ago
  Tailscales founders are Canadian, principled, and are very sensitive to Canadian needs. I very much trust Avery and team to do what’s necessary to keep US hands off the data. edit: someone pointed out they’ve signed new users on to a US co. 15 months ago. I made the statement without knowing this. they aren’t as capable as I originally claimed.
  - jorams 8mo ago
    According to their ToS all customer accounts registered on or after September 3, 2024 are signed on to a US company, so no they're not doing what's necessary to keep US hands off the data.
    - nebezb 8mo ago
      Very good discovery. My prior perspectives need updating.
    - cedws 8mo ago
      Thanks, good spot indeed. Just emailed our AM to find out what the situation is.
    - brnt 8mo ago
      So.... Any account from before then is always good? Or is it about the tailnet creation date?
binnacle 8mo ago
I tried migrating our organization from Twingate to self-hosted Netbird for cost savings but couldn't get it working reliably for 10-15% of users. The client failed intermittently with no clear pattern to troubleshoot. It became very frustrating for our end users. My advice: if you're considering self-hosted Netbird, set clear expectations that it's best-effort QoS, not enterprise-grade reliability. There's no such thing as a cheap VPN.
- PLG88 8mo ago
  Check out OpenZiti. Its open source, runs at prodution scale, and recently someone who used to work at Twingate said OpenZiti is many times more powerful than TG.
  - smashed 8mo ago
    OpenZiti is promising but their desktop and mobile clients are very incomplete. The feature set varies greatly between platforms. If you are supporting a single platform (example desktop windows) it could work. Even better if you have the resources to write your own clients using the SDK, like it's meant to be.
    - PLG88 8mo ago
      How are the mobile and desktop clients incomplete?? Tunnelers exist for Windows, Android, iOS, Linux, MacOS, and more - https://netfoundry.io/docs/openziti/reference/tunnelers/ https://netfoundry.io/docs/openziti/reference/tunnelers/....
      - smashed 8mo ago
        We evaluated it last August/Sept. From memory: oAuth login flow (browser based) was only supported on the windows client. For a Zero trust solution, having the only auth truly supported be a permanent JWT/Cert on the machine is doing device authentication, not user authentication, thus completely failing your primary objective. UX was overall atrocious. Our users could not comprehend it at all. It was deemed that a custom client was required to be made. The SDK first approach was an overall major plus point, allowing for a full customization to a specific use case. Don't get me wrong we were overall impressed with the technology and the architecture choices. It's not a finished product, but something that does all the infra and you just need to apply the final veneer on top.
colesantiago 8mo ago
Unfortunately Netbird is VC backed. :( So the service will enshittify very soon. Glad it is open source so we can have "zero trust" in VC backed dev tools services.
sigmonsays 8mo ago
what is the difference between netbird and tailscale?
user3939382 8mo ago
All these higher level VPN/tunnel solutions are so popular but functionally I’ve only ever wanted layer 2 VPN. Inside the tunnel, I want the ability to reason about a remote network as if it’s local, not on a per-host basis.
Ingon 8mo ago
I've been working for a while on https://github.com/connet-dev/connet https://github.com/connet-dev/connet. It gives a different twist at the same problem - instead of an overlay network at L4 (wireguard, etc) or publicly accessible endpoint at L7 (like ngrok) it "projects" a remote endpoint locally (e.g. as if you are running the service on your computer). Of course "locally" can always be a VPS that has caddy in front to give you ngrok-like experience. The reason connet exists is that nothing (at the time I started, including netbird, tailscale/headscale, frp, rathole, etc) gave the same easy to understand, FOSS, self-hosted, direct peer-to-peer way of remote access to your resources. I believe it does accomplish this and it is self-hosted. And while a cloud deployment at https://connet.dev https://connet.dev exists, it is nothing more then repackaging the FOSS project with user/token management.
- j1elo 8mo ago
  This is meant just for computers, right? A quick check of the readme showed that devices must run this or that commands, which seems difficult to do on an smartphone. I guess the ngrok-like setup would be the way to go for that case, given the increasing prevalence of phones and tablets as the single form of computing for lots of people
  - Ingon 8mo ago
    I've been thinking a lot about this case specifically. And you are right, phones are largely not supported right now - I've been researching how to make that happen. One case I've found that works for me currently is running connet via Termux - and I've made the necessary changes to support that. Native iOS/Android clients, if possible, will probably be the next things I'll work on. At minimum they should enable you to run a "source" (e.g. a consumer of an exposed service), but ideally it will be the whole deal.
- mirashii 8mo ago
  A neat idea, but projecting all of these services onto localhost is a bit of a security nightmare. Have you considered looking at what something like Twingate does? Using the CGNAT IP space for the projection allows you to give every individual service its own IP address, which helps quite a bit in terms of allowing you to isolate the services from e.g. malicious web pages.
gz5 8mo ago
Looks good, congrats on progress. are OpenZiti, Headscale, Nebula the 3 closest? great resource here (no affiliation) for HN community: https://github.com/anderspitman/awesome-tunneling https://github.com/anderspitman/awesome-tunneling
neofrommatrix 8mo ago
What is the industry opinion on ngrok? They seem to be in a market where their product is considered a commodity and there are many alternatives.
- PLG88 8mo ago
  Its more a sharing (outbound proxy) solution than a VPN like Netbird is.
ErneX 8mo ago
I use Headscale with Tailscale clients, and the Apple TV is very nice to have. Netbird seems to be working on one but it’s not out yet?
analog8374 8mo ago
In the old days we'd just trade a few family members to keep as hostages.
PLG88 8mo ago
I like Netbird, its a better VPN, but its not zero trust networking. Zero Trust requires identity to create connectivity itself—per service, per session—rather than granting network reachability and constraining it with routes and rules. I have had this conversation on Reddit many times... curious if anyone agrees/disagrees.
- smashed 8mo ago
  I think the desktop client can authenticate to an IdP by opening a browser window and doing a login flow. If the user is forced to authenticate to start the VPN session, would that make it zero trust? I think once the VPN is on, it's on, and the remote service cannot get identity info from the network layer. Seems like what you want to achieve can only be built on the application layer?
  - PLG88 8mo ago
    Short answer: no, authenticating to start a VPN doesn’t make it Zero Trust. Once you authenticate to a VPN, you’re granted network attachment. From that point on, the network is effectively saying “I trust you enough to route packets,” and enforcement shifts to IPs, subnets, and firewall rules. That’s still network-level trust, even if the login was strong. Zero Trust (architecturally; check out NIST 800-207) changes what identity does: - Identity doesn’t just gate entry - Identity + policy decide whether a path exists at all, per service, per session - If you’re not authorized for a service, there is literally no route, IP, or port to talk to On your last point: it’s not “only application-layer,” but it’s also not traditional L3/4 networking. It’s an overlay where identity is bound into connection establishment itself (mTLS/E2EE, service addressing, no inbound listeners), so the network never becomes a trust plane in the first place. That’s the difference between “authenticate, then connect to a network” and “authenticate to create connectivity.” For a reference, check out OpenZiti, thats a project I work on - https://openziti.io/ https://openziti.io/
  - redeeman 8mo ago
    it should have support for signing of the configuration that is sent out to all nodes by a key the administrator controls, and which is then whitelisted on all nodes by oneself. That way the central node is just a simple data provider/helper. right now you are screwed if someone compromises your coordinator
winrid 8mo ago
My favorite feature of netbird might be no search in the client or network names literally overlapping in the "overlapping networks" tab or maybe it's the need to toggle the network on and off a few times to get it to work One of the few pieces of software I actually despise but have to use, and I use win11.
newzino 8mo ago
[flagged]
- systemf_omega 8mo ago
  This is a bot account spamming LLM-generated comments. Probably to advertise their website.
  - jrm4 8mo ago
    Thats kind of wild, mostly because -- presuming it's correct, what bot is saying is actually valuable here?
    - NewJazz 8mo ago
      Honestly no it is kind of nonsense. Nothing requires you to microsegment with wireguard meshes, for example.
      - newzino 8mo ago
        [flagged]
        PLG88 8mo ago
        That’s a fair framing, with one important distinction. Overlay ACLs give you network-scoped microsegmentation, not service-scoped Zero Trust (as intended in NIST 800-207). You’re limiting which IPs/ports can talk after a node is attached, not deciding whether a service path exists at all per identity and per session. The crypto isn’t the issue - WireGuard keys are strong. The issue is scope. A node identity that grants network reachability is different from a capability-scoped identity that creates only explicit service connectivity. NIST also warns that IP-based enforcement tends to reintroduce ambient trust once a device is attached. In that model, lateral movement is reduced, not eliminated. A simple litmus test: - If authenticating gives you an IP and routes, you’ve built network trust with segmentation. - If authenticating only creates explicit service paths, you’ve built Zero Trust. Mapping this to Wireguard and overlays, I’d say: - WireGuard + identity + ACLs = good overlay microsegmentation - Identity-first connectivity (no IP reachability, no inbound listeners) = Zero Trust by construction If you adopt the latter, the former becomes unnecessary for Zero Trust — because identity creates connectivity directly instead of attaching nodes to a network. Bringing it back to the topic, microsegmentation manages risk inside a network. Identity-first connectivity removes the network from the trust model altogether.
aborsy 8mo ago
What is the issue with one Wireguard port open? You vpn to home LAN and everything is there. The issue with these VPN companies is that they log data, you have to run an agent running as root, reliance on several other companies too like IdP, etc. Very large attack surface.
- k8sToGo 8mo ago
  First of all, if you have a mesh you don't have to connect to home server to talk to other devices in the same network. They connect to each other. Second it's super easy to add a new device. Managing wireguard keys is annoying. Third I don't have to open the port, worry about ddns etc. Finally, for me it allows me to manage my DNS easily and I can leave tailscale running at all times. Also good luck implementing ACL on your own. I don't see an issue with them logging when I connect to my stuff. The convenience for me is worth it more than the risk.
  - aborsy 8mo ago
    If your devices are in one network like at home, you have all those things with Wireguard too. Devices in home LAN all talk to each other, so you have a mesh network. You need keys for your laptop, phone and remote devices only. Most nodes are in LAN and don’t need to even run VPN. With plain Wireguard, you open a single port in a single device. With mesh VPNs you open tons of ports: several ports in coordination, STUN and relay servers, also every device runs a vpn server listening to a port. You VPN to home and use your home DNS. Your enter ACL rules and DNS server in your router. I use a mesh VPN but I’m thinking of switching back to Wireguard, my older setup.
OsamaJaber 8mo ago
Finally Debugging slow queries without seeing what's happening inside the plan is just guessing
xyst 8mo ago
I immediately looked at this and thought it was a tailscale clone. I looked further into it and it’s essentially the same. Implementation over ease of use of wireguard setup. Peer to peer modeling. Mesh networking. "Zero trust". However, what I find interesting is netbird has open sourced their _coordinator server_. This allows for self hosting to be end to end. yes with tailscale there exists "headscale", but it’s clearly a side project that few people within the tailscale company maintain on spare time. One of the fears i have with headscale is a sudden change in leadership at tailscale, then the support from tailscale dies. Significant divergence occurs between headscale coordinator server and clients. Enshittification occurs and now forcing those smaller use cases onto their SaaS. I love tailscale/headscale but will definitely give this a try.
sunshine-o 8mo ago
For those interested, I just found out that mycelium can, like yggdrasil [0], be used to create private overlay networks [1]. What could be used as an alternative to Tailscale, netbird, etc. - [0] https://changelog.complete.org/archives/10478-easily-accessing-all-your-stuff-with-a-zero-trust-mesh-vpn https://changelog.complete.org/archives/10478-easily-accessi... - [1] https://github.com/threefoldtech/mycelium/blob/master/docs/private_network.md https://github.com/threefoldtech/mycelium/blob/master/docs/p...
nsadeghi97 8mo ago
If you are reading this thread and think that’s an interesting project to work on, shoot us a message. We are always looking for talented engineers that are passionate about open source :)
- cpach 8mo ago
  Are you on the Netbird dev team? :)
augunrik 8mo ago
I tried installing it and it was a pain, if you don’t use the very very default scripts. Also their scripts regenerate secrets and the setup is weird in general (you need a complicated rp configuration and scripts to generate the config files)
maximgeorge 8mo ago
[dead]
flashu 8mo ago
I have tried multiple different solutions of so called "zero trust networking". My personal favourite one is Netbird but.. it lacks one feature: switching between multiple setups (networks). I am helping to maintain some startups and it would be just nice to quickly change (or even better: have access to multiple at once!) networks.
- bc569a80a344f9c 8mo ago
  > it would be just nice to quickly change (or even better: have access to multiple at once!) networks. Accessing multiple corporate networks simultaneously from the same endpoint violates all sorts of access policies. If it doesn’t, the access policy is lacking. Even for startups. And no, unless you build it and enforce it from the start, no one ever succeeds in bolting on a reasonably security posture after implementing all their other processes no one will dare touch.
jrm4 8mo ago
How does this compare to Tinc? I'm aware of how old Tinc is, but I've yet to find anything compelling enough to get me to switch. Tinc is a little annoying to set up, but once it's going I literally forget about it.
woile 8mo ago
For the guys at Netbird, please create an entry in the https://wiki.nixos.org https://wiki.nixos.org explaining how to use it with nixos. - Tailscale has one entry - Pangolin is getting one I would like to see, even if brief: 1. Getting started 2. Hardware requirements 3. Security considerations 4. Recommended architecture, like running in a VPS if it makes sense 5. Configuring a server 6. Configuring devices 7. Resources (links to read more on netbird) Thank you from the home lab community
- __float 8mo ago
  This is kind of a weird request, IMO. If you're a homelab NixOS user, isn't it on you to try to answer these questions? A home lab is for learning, and if you don't want to do that, what's the point?
- patmorgan23 8mo ago
  Anyone can contribute to the nixos wiki, why don't you get the page started?
  - woile 8mo ago
    Because I don't feel confident. I'm super green at VPN's and this kind of networks. I don't want to give the wrong advice. I'm editing what I can, but you don't want to take my advice, it would be better if someone who knows does it. The fact that I'm into home lab, doesn't mean I know specifically how to do this. And I'm just saying, when I go to the wiki, to pick up on one of the options, they are missing. I don't know why the hostility for asking to add some docs
Factor1177 8mo ago
I was previously using headscale and was finding it a bit finicky. Recently switched to self hosted netbird and its been great so far. However, if the Netbird teams sees this, please implement a built-in updater for the client apps! needing to download and install the package again is a bit annoying
- preisschild 8mo ago
  Why not use a package manager? It seems way better than letting every app auto-update itself
joecool1029 8mo ago
I wish they'd chill on the release schedule and keep it to once a week or less. I keep it maintained in my Gentoo overlay but oftentimes when I go to bump it, they push another release. Since this submission was posted they've had yet another new release.
nicolashenneaux 8mo ago
Working with it in a 1k active users setup, super efficient and stable! Clearly a revolution comparing to historical vpn solutions!
jsattler 8mo ago
Sounds interesting. How is it different to tailscale (or headscale)? I was planning to setup tailscale to replace my custom wireguard setup.
sieabahlpark 8mo ago
[dead]
Uptrenda 8mo ago
Going to mention my own project which aims to be 100% open source, free, and relies almost only on public infrastructure: https://github.com/robertsdotpm/p2pd https://github.com/robertsdotpm/p2pd Basically, I'm building a framework for building NAT traversal plugins. Software like ngrok and P2P VPNs can then be built on top of it. Examples of plugins for the library include direct connect, reverse connect (connect back to you), TCP hole punching, and UPnP-based port forwarding. The underlying network stack for the project was also built from scratch to better support IPv6 and multiple interfaces. This allows plugins to fully utilise the underlying network paths and interfaces on the machine. This took considerable time because most software simply uses the default interface. I'm still in the middle of building the software so its not yet functional. But if anyone is interested throw me a star or an email at matthew@roberts.pm.
- Uptrenda 8mo ago
  By the way I forgot to add: if anyone needs a list of public STUN, TURN, MQTT, or NTP servers I wrote a monitor for them last year and added a bunch of servers. This is basically the infrastructure I use for my P2P library. The public API is here: http://ovh1.p2pd.net:8000/servers http://ovh1.p2pd.net:8000/servers or if you want to host it: https://github.com/robertsdotpm/dogdorm https://github.com/robertsdotpm/dogdorm
catlifeonmars 8mo ago
Anyone know who the board members are and/or major stakeholders?
glub103011 8mo ago
[dead]
commandersaki 8mo ago
I can't tell if Netbird provides this feature but looking at their access control feature it doesn't seem to. I just want a roaming access Wireguard terminating endpoint to restrict access to a user to initial subnets, and open / allow routing to further subnets based on multi factor authentication. That way a user can connect and only have access to say a wiki and internal chat, but then escalate access by MFA to access resources on other subnets that have stuff like internal gitlab and whatever other critical resources exist.
littlecranky67 8mo ago
Marginally relevant as I am looking into Netbird and Headscale: Anybody can recommand a europe-based VPS hosting provider that gives you an IPv4 range (4-5 IPs) that I can route over headscale?
ktaf 8mo ago
We've deployed self-hosted NetBird on AWS ECS and we're quite happy with the setup and the outcome.
RiceNBananas 8mo ago
[dead]
mduett 8mo ago
Met the founders in Berlin and was quite convinced of technical depth and vision. Great to have a European alternative to tailscale.
jonas_scholz 8mo ago
we love and support netbird at sliplane <3 https://docs.sliplane.io/private-networking/netbird https://docs.sliplane.io/private-networking/netbird
throw20251220 8mo ago
The cofounder is a Russian national, studied in Moscow. Possibly worth massaging that into your threat model.
the_real_cher 7mo ago
How is this different from Tailscale?

741 points by l1am0 8mo ago

oaiey 8mo ago

Sweet. Alternatives are always something good.

lwde 8mo ago

But it's missing a tailscale funnel like feature, right? That's one of the main features that I use for some home assistant instances.

ethangk 8mo ago
Out of curiosity, why? I use TS for all my homelab bits (including my HA instance), but connect to TS before opening the HA app. Is it just a case of making it easier/ possible to connect if you’re on another VPN? Are you not concerned with having something from your local network open to the internet?
- Galanwe 8mo ago
  I use funnels for things like Vaultwarden, that are secure enough to be exposed on internet, and would be cumbersome if behind the tailnet. I use serve for everything else, just for the clean SSL termination for things that should stay within the telnet, like *arr stacks, immich, etc.
  - ethangk 8mo ago
    Ah neat, that makes sense. Thanks. Do you have anything that’ll trigger a notification if there’s suspicious traffic on your local network? I may be overly paranoid about exposing things on my local network to the internet.
    - Galanwe 8mo ago
      Not really, but these stuff are in an isolated DMZ vlan, so theres not much to escalate to. I fancy a bit upgrading to a smarter router like unify's with integrated firewall and stuff like like though.
  - edentrey 8mo ago
    After a decade with KeePass, I’ve finally moved to Vaultwarden. I’ll admit, self-hosting such a critical service still feels a bit scary, but the seamless syncing across all my devices is a huge upgrade. To balance the risk, I keep it tucked safely behind Tailscale for that extra peace of mind.
- deleted 8mo ago
  [deleted]
- m_santos 8mo ago
  Besides the use cases listed, we see this as an opportunity for homelabers and organizations to add authentication with access control to already exposed services.
Galanwe 8mo ago
Agree, I use funnels and serves a lot as well. Very useful for homelabers.
m_santos 8mo ago
We are developing a similar feature and is scheduled to be available really soon. We've discussed some details in our public slack. Any feedback there will be helpful.
gnyman 8mo ago
Please be aware that when you use tailscale funnel you announce to the whole world that your service exists (through certificate transparency), and you will get scanned immediately. If you don't believe me just put up a simple http server and watch the scanning request come in within seconds of running `tailscale funnel`. Do not expose anything without authentication. And absolutely do not expose a folder with something like `python -m http.server -b 0.0.0.0 8080` if you have .git in it, someone will help themselves to it immediately. If you are aware of this, funnel works fine and is not insecure. Tailscale IMHO failing in educating people about this danger. They do mention in on the docs, but I think it should be a big red warning when you start it, because people clearly does not realise this. I took a quick look a while ago and watching just part of the CT firehose, I found 35 .git folders in 30 minutes. No idea if there was anything sensitive I just did a HEAD check against `.git/index` if I recall. https://infosec.exchange/@gnyman/115571998182819369 https://infosec.exchange/@gnyman/115571998182819369

thenaturalist 8mo ago

Besides the solid product, Misha & Maycon are just great and friendly people to work with.

braginini 8mo ago
love it! :)

estsauver 8mo ago

There's also https://pangolin.net/ https://pangolin.net/ which is kind of similar, and I believe a YC company.

OtomotO 8mo ago
Does that have ties to the US? If so it's not playing in the same ballpark. US citizens may not be aware, but due to POTUS "made and maintained in Europe" is becoming more and more important to EU.
- edentrey 8mo ago
  I see Pangolin has a Self-Host Community Edition, doesn't that already give something over digital sovereignity for EU users? I am considering both for a migration from Tailscale, any suggestion on their differences?
  - moonlightbandit 8mo ago
    They solve different problems. For a Tailscale migration, NetBird is the direct swap. Pangolin won't give you device-to-device connectivity. On EU sovereignty: NetBird is Germany-based and explicitly positions itself as a European alternative. Self-hosted gives full control with no callbacks to their servers. Pangolin is US/YC-backed, so while self-hosting gives you control of the data plane, the project itself is American. Also, NetBird has a reverse proxy feature coming this quarter, which would cover the Pangolin use case within the same platform.
    - gnufx 8mo ago
      With regard to European sovereignty, I note that Netbird uses AWS.
braginini 8mo ago
Not quite similar tho. Pangolin is a reverse proxy, NetBird is p2p mesh for internal resources remote access

Benedicht 8mo ago

Using it self hosted for almost a year now, no issues, just works for me.

braginini 8mo ago
That is awesome!

FloatArtifact 8mo ago

If the VPN connection would stay connected despite having it set up that way in the web UI.. It would be a good product. Still haven't figured out how to do Termux on Android with netbird ssh yet.

edentrey 8mo ago
can you please elaborate on this? I use termux on android with tailscale and it works flawless, is it not possible on Netbird?
- FloatArtifact 8mo ago
  The following documentation doesn't work obviously because it's not on path. I need to do further reading of the docs, but I haven't had time yet. netbird ssh user@100.119.230.104 https://docs.netbird.io/manage/peers/ssh https://docs.netbird.io/manage/peers/ssh
- FloatArtifact 8mo ago
  If I simply try... ssh user@100.119.230.104 it asked for a password, but there is no password.

edentrey 8mo ago

Tailscale is the only non-self-hosted part of my setup now and this has bugged me since. I use a custom Nameserver rule to point all my subdomains to a Caddy container sitting on my Tailnet. Caddy handles the SSL and routes everything to the right containers. I skipped Tailscale Funnel on purpose; since these are just family services, I’d rather keep them locked behind the VPN than open them up to the web. This project looks promising as a replacement for my current setup and for its digital sovereignity of self hosting the server. I'm looking to manage several embedded devices remotely via Tailscale, but I've hit a major roadblock: the 90-day maximum expiration for Auth Keys. Constantly renewing these tokens is a significant maintenance burden, so I'm searching for a more permanent, 'set-and-forget' solution for my remote hardware.

tass 8mo ago
Tailscale allows you to disable the expiration time - I do this for my gateways. My other simplifier is having everything at home get a .home dns name, and telling Tailscale to route all these via tailnet.
- edentrey 8mo ago
  can you please tell me how to disable expiration time? I see auth keys have an Expiration which says it "Must be between 1 and 90 days." I do use a custom domain name as well with a Nameservers rule to have all my services reachable as subdomains of my custom domain.
  - deleted 8mo ago
    [deleted]
  - aidos 8mo ago
    You can create an oauth client that can generate keys as you need them. https://tailscale.com/kb/1215/oauth-clients#generating-long-lived-auth-keys https://tailscale.com/kb/1215/oauth-clients#generating-long-...
  - matthewmacleod 8mo ago

hollow-moe 8mo ago

I'm currently comparing it with pangolin and headscale for my small scale company infrastructure access. Been running headscale for my own setup for a while but maybe netbird or pangolin might be better for real production.

edentrey 8mo ago
I am in the same position but currently using Tailscale and realize how important and critical it has become for my whole family infrastructure. A self-hosted solution which allowed me to use Nameservers and TLS termination as I currently do would be awesome.
usagisushi 8mo ago
Pangolin recently added desktop clients for win/mac/linux[0] and the Private Resource feature (similar to Netbird's Network Routes/DNS), so it's starting to overlap with Netbird more and more. That said, it seems focused on client-to-site (newt) connections, and I don't see support for client-to-client connections like Netbird’s SSH access. Also, their Private Resources don't seem to support TLS termination yet. (Correct me if I’m wrong!) In my case, I have a k3s cluster running on Netbird with a Traefik ingress for TLS termination inside my home network. Thanks to netbird's P2P nature, traffic stays entirely local as long as I'm on my home WiFi. (I suppose one could achieve the same with a Netbird + Caddy + DNS-01 setup, too.) [0] https://docs.pangolin.net/manage/clients/understanding-clients https://docs.pangolin.net/manage/clients/understanding-clien...

vlovich123 8mo ago

How does this compare with Defguard? Also European but seems more featureful maybe?

braginini 8mo ago
Defguard as of my knowledge is a traditional VPN with a central gateway. NetBird is an overlay network with a full mesh capabilities. Though you can set it up in a gateway-like style with NetBird Networks but without opening ports and with HA out of the box: https://docs.netbird.io/manage/networks https://docs.netbird.io/manage/networks
teon 8mo ago
Hi, Robert from Defguard here. Defguard is a *Secure by Design* solution, which means security is important (if not more) then functionality. Lower latency or peer-to-peer communication does not automatically mean better security often it means a larger attack surface. Defguard is also *the only solution that enforces MFA on every connection*, aligning with true Zero Trust principles never trust a user or device by default. Why Peer-to-Peer Is Not Safer? Peer-to-peer and mesh solutions can be faster because traffic flows directly between peers, but they almost always expose all components publicly and make it easier to hijack the network or inject unauthorized peers. So what does Defguard’s Secure-by-Design Architecture mean? 1. Minimal gateway exposure The Defguard gateway exposes only a WireGuard port. Compromising it would require a Linux kernel or WireGuard zero-day at that point, no solution is safe. 2. Isolated, stateless proxy The only Internet-facing "application" component is a stateless proxy, deployed in a separate network segment. It has no access to the gateway, core, or internal resources. 3. Protected control plane The core (control plane) runs strictly inside the intranet (local network that should not be exposed anywhere). No user data are exposed to the Internet or DMZ/other network segments. Also the MFA validation process is done in secure network segments (for example when doing MFA with Desktop + Mobile client biometry/faceID combined). Why This Is Different from Mesh Solutions? Most mesh VPN solutions expose their control and peer-discovery components publicly by design. This significantly increases the risk of compromise and peer injection. So that's about it.
- 8mo ago

BoredPositron 8mo ago

Missing some technical bits to be a true contender for me but I bet they are getting there. That said I've seen so many shadcn based scam sites that my brain starts associating shadcn with scams.

braginini 8mo ago
For example? Curious what is missing
- BoredPositron 8mo ago
  It funnels and lets encrypt certs for me and I am really not a fan of the android client.
  - braginini 8mo ago
    Got you. We are on it. One feature that is coming very soon is a reverse proxy .Similar to cloudflare tunnels. With auth, TLs, etc. Would it suffice?
    - oriettaxx 8mo ago
      +1 from me. In general I would keep an eye on the path CF is following with warp: which is great, but since they are so big and in fast evolution, it is a bit of a mess (their doc is outdated and changes too frequently) not to count (literally) their support (free version, and our company's opinion only, of course) since on warp it is totally useless.
      - braginini 8mo ago
        Roger that!
  - m_santos 8mo ago
    Would love to learn more around your android experience

RedShift1 8mo ago

I'm really missing something like Cisco DMVPN. A VPN mesh between different routers where all routers have a connection to each other, so that all traffic doesn't have to pass through the hub. And that runs on a router, because all these solutions only run on a regular computer with a complete OS.

rwky 8mo ago
Check https://tinc-vpn.org/ https://tinc-vpn.org/ it may run on your router if you're running openwrt or similar
PLG88 8mo ago
Out of curiosity, why? Because you dont want to run software on users devices?

genie3io 8mo ago

[dead]

aaronds 8mo ago

A bit lower level than most things discussed here but on the topic of overlay networks, I’ve used nebula for years and can recommend it https://github.com/slackhq/nebula https://github.com/slackhq/nebula

sreekanth850 8mo ago
it his much complex to setup then wireguard based?
- prmoustache 8mo ago
  It is the easiest to setup and understand really. There are no users, just hosts and their keys. What it doesn't offer is a gui or tool to handle copying/installing/revocating keys so you trade super easy setup for a handful of nodes to management overhead if you are scaling up and down regularly.
ysleepy 8mo ago
I've used it for some time, it feels very much like it is in maintenance mode. You manage a PKI and have to distribute the keys yourself, no auth/login etc. it's much better than wireguard, not requiring O(N) config changes to add a node, and allowing peoxy nodes etc. iirc key revocation and so on are not easy.
- c0balt 8mo ago
  Nebula does not require O(n) config changes for adding a node. O(n) is only required for: - active revocation of a certificate (requires adding the CA fingerprint to the config file) - adding/removing a lighthouses (hub for publishing IPs for p2p) or relay (for going over p2p) - CA rotation
  - cpach 8mo ago
    AFAICT you and 'ysleepy are in agreement.

braginini 8mo ago

https://github.com/netbirdio/netbird https://github.com/netbirdio/netbird

no_time 8mo ago

F-droid inclusion seems to be stalled https://gitlab.com/fdroid/rfp/-/issues/2688 https://gitlab.com/fdroid/rfp/-/issues/2688 Having it in F-droid, vetted by their policies is kind of my benchmark for "software that is guaranteed to be not crapware." That being said I'm rooting for the devs, having an alternative for tailscale+headscale would be nice, because as it stands it's kind of dependant on the goodwill of a for profit company (finite).

Borealid 8mo ago
https://codeberg.org/bg443/JetBird https://codeberg.org/bg443/JetBird appears to use the same core library (and is just a different Android frontend wrapper).
micw 8mo ago
I recently brought my first app to F-Droid. It was not friction free, but I was able to do it within a few weeks. Seems they put not much effort into this, e.g. the basic check marks are not even checked...

speedgoose 8mo ago

I replaced Teleport by a bunch of various tools, and I had to chose between tailscale/headscale and netbird for the network connectivity. I’m pleased with netbird so far. I had some weird bugs on a few old servers during the transition, and the support was helpful even though I am a small customer. We eventually switched to user space wireguard on those servers.

mittermayr 8mo ago

I can only recommend giving headscale a try. It's free, works extremely well, and can be used with the official Tailscale clients. Was super easy to set up. https://headscale.net/stable/ https://headscale.net/stable/

rpastuszak 8mo ago
Any luck using with with a VPN like Mullvad as an exit node?
- SparkyMcUnicorn 8mo ago
  I've done this a few different ways. I started with a docker container that connected to both the VPN provider and tailscale. Now OPNSense is handing a few connections to the VPN provider at a couple locations around the world, and enforcing external traffic to be routed to the VPN connections via VLAN tags (untagged has direct internet access). Using the VPN provider can either be adding a VLAN tag to a machine/container or connecting to a "vpn-{location}" tailscale exit node.
db04 8mo ago
Is Headscale suitable for production use?
- tucnak 8mo ago
  No, it's only viable if your whole network is, like, five devices.
  - protimewaster 8mo ago
    I assume this is an exaggeration? Another poster says they have good luck with headscale on two networks of 400 devices.
    - mittermayr 8mo ago
      yeah looks like someone is either a hyper tailscale fan or had extremely bad experience with it, I also run several dozens of machines (and tablets and phones) on it. never had a single moment of downtime since I started.

usagisushi 8mo ago

Netbird's flexibility with IdPs is really nice. I recently switched mine to Pocket ID. Overall, it's perfectly sufficient and lightweight for homelab use.

m_santos 8mo ago
Thanks for your feedback. I have a question: What do you think about the number of containers in our quick start deployment? Was that a concern?
- usagisushi 8mo ago
  You’re from the dev team, right? Thanks for the amazing OSS! Regarding the containers, AFAIK it's 5 for the core setup (dashboard/signal/management/relay/coturn) plus Traefik in my case. It feels like a bit much, but the services are almost stateless and not resource intensive even on my little VPS. The setup script (bash + envsubst) is so straightforward and thanks to good documentation, I’ve never found the setup confusing. (I use Renovate to keep things updated, but I’d love to know if there's a recommended update path.) A couple of minor things I noticed: 1. the dashboard image isn't on ghcr.io. 2. the generated compose.yaml contains hardcoded values. It could be even better if it referenced values from a .env file instead. By the way, are there any ways to support NetBird other than GitHub Sponsors?
  - braginini 8mo ago
    Your usage is the best form of sponsorship haha
  - braginini 8mo ago
    Coturn is not needed in the new versions as STUN is embedded in the relay service now

shtrophic 8mo ago

Last time I checked it couldn't do ipv6... in 2026?

niemandhier 8mo ago
Could be intentional: German privacy advocates really like that the limited ipv4 pool forces reusing IPs and prevents accidental imprinting a practically static address on a device.
- sunshine-o 8mo ago
  Makes a lot of sense. But self-hosting still require at least a public domain name [0], so here goes your privacy right? - [0] https://docs.netbird.io/selfhosted/selfhosted-quickstart#infrastructure-requirements https://docs.netbird.io/selfhosted/selfhosted-quickstart#inf...
  - fc417fc802 8mo ago
    > The VM must be publicly accessible on TCP ports 80 and 443, and UDP port 3478. > A public domain name that resolves to the VM’s public IP address. Since it already uses DNS it's disappointing that it hardcodes ports instead of using SRV records. IMO anything that can use SRV records should. It makes for a more robust internet.
    - sigio 8mo ago
      The number of products that actually use SRV records is surprisingly low (besides some mailservers and kerberos)
- fc417fc802 8mo ago
  Can't do IPv6 internally or externally? Internally there should be zero need for ~infinite addresses. Externally though I certainly hope all software is capable of operating via IPv6 at this point because otherwise it will only be increasingly broken.

sunshine-o 8mo ago

For someone who want to setup a private network between host/devices, I feel the dilemma is always: 1. Trust a third party like Tailscale by giving them the key to your kingdom, but everything is incredibly easy and secure. 2. Self-host but need at least one host with a fixed IP address and an open port on the Internet. What requires a set of security skills and constant monitoring. That includes headscale, selhosted netbird, zerotier or a private yggdrasil mesh.

abcd_f 8mo ago
You can conceal that open port with some form of port knocking. Though this does reinforce your "easy" point. Also, if it's an UDP port, then using a protocol that expects first client packet to be pre-authenticated and not emitting any response otherwise gets you pretty damn close to having this port closed.
- sunshine-o 8mo ago
  Thanks for the suggestion ! I looked into it but it seems that port knocking and Single Packet AuthZ literally open the firewall and expose the port when used. Meaning it is great to reveal the SSH port when needed, do your business quickly and close it back when you are done. But my guess is those overlay networks need to port available all the time, so...
  - abcd_f 8mo ago
    Port knocking should open up the port for the IP that sent the knock. Not for everyone.
CommanderData 8mo ago
When I look at these zero trust solutions need 80/443 for what seems some type of bootstrapping Better it happens using the same approach wireguard takes (udp/stateless). Though I'm not sure if there's more than just bootstrap taking place, maybe constant routing updates etc

junon 8mo ago

We just evaluated this the other day and we were pretty impressed by it. We were looking for something we could self host for wireguard config but tbh we might just pay for the managed solution.

regisso 8mo ago

I recommend it the NetBird team is transparent and easy to reach. I switched from Tailscale a while ago (2y), went fully self-hosted, and upgrades across versions have been smooth, which tells me they care about the self-hosted, not just their cloud offering.

smashed 8mo ago
We tried netbird but could not get the client to register to a self hosted server. It ignored the setting or failed. Good chance it was user error on our part. Most of their documentation is very unclear about what is a cloud offering feature and what is possible using self-hosting. There are features not available on the community edition and you have to be very careful reading their doc. Just putting it out there so people do not think it's an easy solution. It will require appropriate planning. I do think its a more promising solution than headscale if you want to self host as it is a complete package, unlike tailscale where you need to modify registry keys to change the cloud URL and headscale is a simplified, non-multi-tenant signaler.
- SebastianKra 8mo ago
  We also had a bunch of problems. The DNS resolution didn't work, and support was unable to figure out the reason. A coworker reported domain access breaking when he went to office 1, but fixed itself when he went to office 2. For a while, when you logged in with the wrong account, it was near impossible to replace it. This on is fixed now, but the entire thing still feels very much like paying for beta software.
  - teruakohatu 8mo ago
    I have endless DNS problems with Tailscale. So I am guessing it’s a hard problem.
    - jasona123 8mo ago
      It's like the haiku says: It’s not DNS There’s no way it’s DNS It was DNS

pranaysy 8mo ago

Long-time ZeroTier user here. Recently switched to NetBird (self-hosted on a Hetzner VPS) and it’s been seamless so far. DNS functionality is excellent (something ZeroTier lacked), and the access-control model is very well designed. It’s easy to understand what’s going on and to grant one-off access when needed. Only real and very minor gripe is the Android app: I wish it were on F-Droid and a bit more robust, as it sometimes drops when roaming. Nevertheless, congratulations on a fabulous piece of software! I hope it keeps improving :)

benoliver999 8mo ago
Also long time zerotier user here, I run a controller for our company. I'm starting to experience infrequent but annoying drops in connection, and DNS is a headache. How is netbird on iOS?
- greenavocado 8mo ago
  I switched from Zerotier to Tailscale last year and Tailscale is far more performant and stable but Zerotier works better with multicast, specifically multicast video. I even ran a Zerotier moon to help but it was still worse than Tailscale.
mac-attack 8mo ago
I've been using jetbird from fdroid. I have never tried the official app, but I have good experiences with Jet Bird.
- pranaysy 8mo ago
  Thanks! Will try asap
chillfox 8mo ago
Does Tailscale/ZeroTier/Netbird provide anything beyond a GUI wrapper for Wireguard? How easy is it to make it manage an already configured Wireguard mesh network?

ZoomZoomZoom 8mo ago

Tailscale is great and headscale is an important step to gain trust. However, headscale is useless without the clients, and Tailscale geoblock installing clients where they can. If the platform requires jailbreak for installing user-chosen software, as is the case with iOS, then it all becomes useless. Open (preferably free software) clients without idiotic restrictions could be one of the main advantages for any competing solution. Does Netbird provide them?

nixosbestos 8mo ago
Why would Tailscale seek to limit access to their clients, other than where required by law? The Android client, at least is FOSS. It's hardly Tailscale's fault that people buy iOS devices.
- ZoomZoomZoom 8mo ago
  I don't care why. They do nothing to circumvent this so they are not a reliable solution for those who have network participants using the restricted platforms. There could be a million reasons, but not a technical one — "headscale client", for example, could exist in current hostile app stores, but there isn't one.
  - nixosbestos 8mo ago
    Your arbitrary, loosely-detailed complaints would apply to literally everyone, every app. It's on f-droid, it's open source, you're being ridiculous. I'm not even sure you understand what you're asking for. The official, open source Tailscale client explicitly supports headscale servers.
    - ZoomZoomZoom 8mo ago
      It's the only app from the ones I use that my friends and relatives who already use iOS can't even install due to geoblocking. If you don't see it as a problem means you're not affected and perhaps lack some empathy. Yes, I understand the Apple ecosystem is a problem. But it's not an insurmountable one. Builds of Free Software exist on Apple Appstore and none of them exhibit this problem, unless they are tied to a commercial entity in the corresponding jurisdiction. The issue with Tailscale is that they use their open-source clients and headscale as means to gain user trust, but their solution is deficient due to everything mentioned above. > I'm not even sure you understand what you're asking for. I'm asking for a free software client to go with the headscale server that can be installed everywhere technically viable, without idiotic additional restrictions. It's clear that it's you who don't really understand the crux of the issue (which you partially admitted by you "not even sure", but still), but it's somehow I who's ridiculous.

geoctl 8mo ago

(Shamless plug) I am also working on a similar FOSS, self-hosted project called Octelium https://github.com/octelium/octelium https://github.com/octelium/octelium that you might find interesting if you are interested in this space. Octelium is, however, more of a generic/unified zero trust secure access platform that can operate as a remote access VPN, a ZTNA platform, API/AI/MCP gateway, a PaaS, an ngrok-alternative and a homelab infrastructure. It provides unified client-based as well as clientless access for both humans and workloads; dynamic identity-based secretless access (e.g. access to HTTP/gRPC/k8s upstreams without sharing API keys and access tokens, SSH without distributing passwords/private keys, postgres/MySQL databases without sharing passwords, etc.); dynamic L7-aware, identity-based access control ABAC via CEL and OPA as well as dynamic routing to upstreams via policy-as-code; native Passkey login/WebAuthn/TOTP MFA and support for OIDC/SAML IdPs, OpenTelemetry-native L7-aware visibility and auditing; clientless access via OAuth2 for workloads, WireGuard and QUIC tunneling with dual-stack and automatic private DNS, including in rootless mode; passwordless SSH'ing into containers and IoT without SSH servers; deploying and securing access to containers; declarative k8s-like management with horizontal scalability among other features. You can read more in the README if you're interested.

nszceta 8mo ago
It took me too long to understand the difference between the two so I'll leave it here for others. Octelium operates on OSI Layer 7 and Tailscale operates on OSI Layer 3 and 4.
- geoctl 8mo ago
  Well, yes, Octelium is technically a VPN from a layer-3 perspective since it uses WireGuard/QUIC tunneling, but the tunnel doesn't directly terminate to the destination like in VPNs but instead to an identity-aware proxy that does authentication and L7-aware authorization on a per-request basis with policy-as-code via CEL/OPA. From an architecture perspective, I assume it's closer to ZTNAs such as Cloudflare Access and Teleport than to traditional VPNs, even though it operates as one for the clien-based access mode. However, unlike VPNs, it does provide clientless/BeyondCorp access too as it's intended to operate as a more generic/unified access platform (e.g. API/AI/MCP gateway, ngrok-alternative, PaaS-like platform, etc.) rather than just a VPN.

alturp 8mo ago

Always my problem with Tailscale and similar solutions is that I already run VPNs in my personal devices and especially with android devices, I need to switch between two VPNs, which I find a friction that I do not want. Does anybody know a solution to this?

ksynwa 8mo ago
Tailscale has some integration with Mullvad. If you have a Mullvad subscription you can use their servers as exit nodes without dropping your Tailscale connection: https://tailscale.com/kb/1258/mullvad-exit-nodes https://tailscale.com/kb/1258/mullvad-exit-nodes Outside of the particular combination of Mullvad and Tailscale I don't think there is any other way apart from switching between the two.
mlrtime 8mo ago
Not elegant or performant but: You could have a exit node that is setup only for that vpn that advertises it's routes. So connecting to tailscale gives you access to that network.
xrd 8mo ago
Maybe I don't understand, but the tailscale Linux clients definitely supports multiple accounts. I use that to reach multiple headscale networks and a tailscale one. No issues for me using it this way.

CommanderData 8mo ago

Most of the self-hosted zero trust solutions require opening 80/443. It would be nice if they could adopt Wireguards approach of using UDP only, and only responding if the request is valid. Maybe it's possible without modification to Netbird to setup a staging network.

gnufx 8mo ago

I've looked without success for external audit reports of either Tailscale and Netbird, like Mullvad gets. While I don't approve of the sort of auditor box-ticking we get at work, it would be reassuring to see a report from a proper security consultancy.

somepleb 8mo ago
Netbird has supposedly done a penetration test, but it is only supplied upon request [0]. I haven't bothered trying to get my hands on it since I don't use their product. I don't agree with gatekeeping the results instead of making them public. NetBird should also consider publishing an SBOM, similar to what Defguard does.[1]. [0] https://trust.netbird.io/ https://trust.netbird.io/ [1] https://defguard.net/sbom/ https://defguard.net/sbom/
- gnufx 8mo ago
  Oh, I hadn't found that. Yes, it seems strange not to publicize something like that to give users confidence (assuming the audit/pentest isn't damning). It doesn't have to have been perfect initially, as long as appropriate fixes were made.

sigio 8mo ago

I've head Netbird running for the last few months... In general it works quite well, but it would keep messing with my dns-resolving, and I couldn't find the setting to stop it inserting itself into my resolv.conf. During the last few weeks I've removed netbird from all my systems (about 12), mostly because of issues on laptops where resolving or networking would break after they moved to a different network/location.

usagisushi 8mo ago
Just for future reference, you can disable DNS management for specific groups [0]. You can find the option under "DNS > DNS Settings > Disable DNS management for these groups". Netbird will stop modifying the resolv.conf on those groups. [0] https://docs.netbird.io/manage/dns#4-dns-management-modes https://docs.netbird.io/manage/dns#4-dns-management-modes
- Borealid 8mo ago
  Can Netbird run the DNS resolver (so it can be used for the internal domain ONLY by systemd-resolved) but not alter the host's DNS settings? It looks to me like the setting that tells Netbird to leave the system DNS alone is arbitrarily tied to the setting that causes it to run a resolver at all.

gonzalohm 8mo ago

What's the advantage over running plain wireguard?

Tajnymag 8mo ago
Much easier setup, management, permissions, meshing etc.

cedws 8mo ago

Has anybody looked at whether Tailscale is subject to the US CLOUD Act? If so I can imagine we might be moving towards an open source solution like this in future.

nebezb 8mo ago
Tailscales founders are Canadian, principled, and are very sensitive to Canadian needs. I very much trust Avery and team to do what’s necessary to keep US hands off the data. edit: someone pointed out they’ve signed new users on to a US co. 15 months ago. I made the statement without knowing this. they aren’t as capable as I originally claimed.
- jorams 8mo ago
  According to their ToS all customer accounts registered on or after September 3, 2024 are signed on to a US company, so no they're not doing what's necessary to keep US hands off the data.
  - nebezb 8mo ago
    Very good discovery. My prior perspectives need updating.
  - cedws 8mo ago
    Thanks, good spot indeed. Just emailed our AM to find out what the situation is.
  - brnt 8mo ago
    So.... Any account from before then is always good? Or is it about the tailnet creation date?

binnacle 8mo ago

I tried migrating our organization from Twingate to self-hosted Netbird for cost savings but couldn't get it working reliably for 10-15% of users. The client failed intermittently with no clear pattern to troubleshoot. It became very frustrating for our end users. My advice: if you're considering self-hosted Netbird, set clear expectations that it's best-effort QoS, not enterprise-grade reliability. There's no such thing as a cheap VPN.

PLG88 8mo ago
Check out OpenZiti. Its open source, runs at prodution scale, and recently someone who used to work at Twingate said OpenZiti is many times more powerful than TG.
- smashed 8mo ago
  OpenZiti is promising but their desktop and mobile clients are very incomplete. The feature set varies greatly between platforms. If you are supporting a single platform (example desktop windows) it could work. Even better if you have the resources to write your own clients using the SDK, like it's meant to be.
  - PLG88 8mo ago
    How are the mobile and desktop clients incomplete?? Tunnelers exist for Windows, Android, iOS, Linux, MacOS, and more - https://netfoundry.io/docs/openziti/reference/tunnelers/ https://netfoundry.io/docs/openziti/reference/tunnelers/....
    - smashed 8mo ago
      We evaluated it last August/Sept. From memory: oAuth login flow (browser based) was only supported on the windows client. For a Zero trust solution, having the only auth truly supported be a permanent JWT/Cert on the machine is doing device authentication, not user authentication, thus completely failing your primary objective. UX was overall atrocious. Our users could not comprehend it at all. It was deemed that a custom client was required to be made. The SDK first approach was an overall major plus point, allowing for a full customization to a specific use case. Don't get me wrong we were overall impressed with the technology and the architecture choices. It's not a finished product, but something that does all the infra and you just need to apply the final veneer on top.

colesantiago 8mo ago

Unfortunately Netbird is VC backed. :( So the service will enshittify very soon. Glad it is open source so we can have "zero trust" in VC backed dev tools services.

sigmonsays 8mo ago

what is the difference between netbird and tailscale?

user3939382 8mo ago

All these higher level VPN/tunnel solutions are so popular but functionally I’ve only ever wanted layer 2 VPN. Inside the tunnel, I want the ability to reason about a remote network as if it’s local, not on a per-host basis.

Ingon 8mo ago

I've been working for a while on https://github.com/connet-dev/connet https://github.com/connet-dev/connet. It gives a different twist at the same problem - instead of an overlay network at L4 (wireguard, etc) or publicly accessible endpoint at L7 (like ngrok) it "projects" a remote endpoint locally (e.g. as if you are running the service on your computer). Of course "locally" can always be a VPS that has caddy in front to give you ngrok-like experience. The reason connet exists is that nothing (at the time I started, including netbird, tailscale/headscale, frp, rathole, etc) gave the same easy to understand, FOSS, self-hosted, direct peer-to-peer way of remote access to your resources. I believe it does accomplish this and it is self-hosted. And while a cloud deployment at https://connet.dev https://connet.dev exists, it is nothing more then repackaging the FOSS project with user/token management.

j1elo 8mo ago
This is meant just for computers, right? A quick check of the readme showed that devices must run this or that commands, which seems difficult to do on an smartphone. I guess the ngrok-like setup would be the way to go for that case, given the increasing prevalence of phones and tablets as the single form of computing for lots of people
- Ingon 8mo ago
  I've been thinking a lot about this case specifically. And you are right, phones are largely not supported right now - I've been researching how to make that happen. One case I've found that works for me currently is running connet via Termux - and I've made the necessary changes to support that. Native iOS/Android clients, if possible, will probably be the next things I'll work on. At minimum they should enable you to run a "source" (e.g. a consumer of an exposed service), but ideally it will be the whole deal.
mirashii 8mo ago
A neat idea, but projecting all of these services onto localhost is a bit of a security nightmare. Have you considered looking at what something like Twingate does? Using the CGNAT IP space for the projection allows you to give every individual service its own IP address, which helps quite a bit in terms of allowing you to isolate the services from e.g. malicious web pages.

gz5 8mo ago

Looks good, congrats on progress. are OpenZiti, Headscale, Nebula the 3 closest? great resource here (no affiliation) for HN community: https://github.com/anderspitman/awesome-tunneling https://github.com/anderspitman/awesome-tunneling

neofrommatrix 8mo ago

What is the industry opinion on ngrok? They seem to be in a market where their product is considered a commodity and there are many alternatives.

PLG88 8mo ago
Its more a sharing (outbound proxy) solution than a VPN like Netbird is.

ErneX 8mo ago

I use Headscale with Tailscale clients, and the Apple TV is very nice to have. Netbird seems to be working on one but it’s not out yet?

analog8374 8mo ago

In the old days we'd just trade a few family members to keep as hostages.

PLG88 8mo ago

I like Netbird, its a better VPN, but its not zero trust networking. Zero Trust requires identity to create connectivity itself—per service, per session—rather than granting network reachability and constraining it with routes and rules. I have had this conversation on Reddit many times... curious if anyone agrees/disagrees.

smashed 8mo ago
I think the desktop client can authenticate to an IdP by opening a browser window and doing a login flow. If the user is forced to authenticate to start the VPN session, would that make it zero trust? I think once the VPN is on, it's on, and the remote service cannot get identity info from the network layer. Seems like what you want to achieve can only be built on the application layer?
- PLG88 8mo ago
  Short answer: no, authenticating to start a VPN doesn’t make it Zero Trust. Once you authenticate to a VPN, you’re granted network attachment. From that point on, the network is effectively saying “I trust you enough to route packets,” and enforcement shifts to IPs, subnets, and firewall rules. That’s still network-level trust, even if the login was strong. Zero Trust (architecturally; check out NIST 800-207) changes what identity does: - Identity doesn’t just gate entry - Identity + policy decide whether a path exists at all, per service, per session - If you’re not authorized for a service, there is literally no route, IP, or port to talk to On your last point: it’s not “only application-layer,” but it’s also not traditional L3/4 networking. It’s an overlay where identity is bound into connection establishment itself (mTLS/E2EE, service addressing, no inbound listeners), so the network never becomes a trust plane in the first place. That’s the difference between “authenticate, then connect to a network” and “authenticate to create connectivity.” For a reference, check out OpenZiti, thats a project I work on - https://openziti.io/ https://openziti.io/
- redeeman 8mo ago
  it should have support for signing of the configuration that is sent out to all nodes by a key the administrator controls, and which is then whitelisted on all nodes by oneself. That way the central node is just a simple data provider/helper. right now you are screwed if someone compromises your coordinator

winrid 8mo ago

My favorite feature of netbird might be no search in the client or network names literally overlapping in the "overlapping networks" tab or maybe it's the need to toggle the network on and off a few times to get it to work One of the few pieces of software I actually despise but have to use, and I use win11.

newzino 8mo ago

[flagged]

systemf_omega 8mo ago
This is a bot account spamming LLM-generated comments. Probably to advertise their website.
- jrm4 8mo ago
  Thats kind of wild, mostly because -- presuming it's correct, what bot is saying is actually valuable here?
  - NewJazz 8mo ago
    Honestly no it is kind of nonsense. Nothing requires you to microsegment with wireguard meshes, for example.
    - newzino 8mo ago
      [flagged]
      - PLG88 8mo ago
        That’s a fair framing, with one important distinction. Overlay ACLs give you network-scoped microsegmentation, not service-scoped Zero Trust (as intended in NIST 800-207). You’re limiting which IPs/ports can talk after a node is attached, not deciding whether a service path exists at all per identity and per session. The crypto isn’t the issue - WireGuard keys are strong. The issue is scope. A node identity that grants network reachability is different from a capability-scoped identity that creates only explicit service connectivity. NIST also warns that IP-based enforcement tends to reintroduce ambient trust once a device is attached. In that model, lateral movement is reduced, not eliminated. A simple litmus test: - If authenticating gives you an IP and routes, you’ve built network trust with segmentation. - If authenticating only creates explicit service paths, you’ve built Zero Trust. Mapping this to Wireguard and overlays, I’d say: - WireGuard + identity + ACLs = good overlay microsegmentation - Identity-first connectivity (no IP reachability, no inbound listeners) = Zero Trust by construction If you adopt the latter, the former becomes unnecessary for Zero Trust — because identity creates connectivity directly instead of attaching nodes to a network. Bringing it back to the topic, microsegmentation manages risk inside a network. Identity-first connectivity removes the network from the trust model altogether.

aborsy 8mo ago

What is the issue with one Wireguard port open? You vpn to home LAN and everything is there. The issue with these VPN companies is that they log data, you have to run an agent running as root, reliance on several other companies too like IdP, etc. Very large attack surface.

k8sToGo 8mo ago
First of all, if you have a mesh you don't have to connect to home server to talk to other devices in the same network. They connect to each other. Second it's super easy to add a new device. Managing wireguard keys is annoying. Third I don't have to open the port, worry about ddns etc. Finally, for me it allows me to manage my DNS easily and I can leave tailscale running at all times. Also good luck implementing ACL on your own. I don't see an issue with them logging when I connect to my stuff. The convenience for me is worth it more than the risk.
- aborsy 8mo ago
  If your devices are in one network like at home, you have all those things with Wireguard too. Devices in home LAN all talk to each other, so you have a mesh network. You need keys for your laptop, phone and remote devices only. Most nodes are in LAN and don’t need to even run VPN. With plain Wireguard, you open a single port in a single device. With mesh VPNs you open tons of ports: several ports in coordination, STUN and relay servers, also every device runs a vpn server listening to a port. You VPN to home and use your home DNS. Your enter ACL rules and DNS server in your router. I use a mesh VPN but I’m thinking of switching back to Wireguard, my older setup.

OsamaJaber 8mo ago

Finally Debugging slow queries without seeing what's happening inside the plan is just guessing

xyst 8mo ago

I immediately looked at this and thought it was a tailscale clone. I looked further into it and it’s essentially the same. Implementation over ease of use of wireguard setup. Peer to peer modeling. Mesh networking. "Zero trust". However, what I find interesting is netbird has open sourced their _coordinator server_. This allows for self hosting to be end to end. yes with tailscale there exists "headscale", but it’s clearly a side project that few people within the tailscale company maintain on spare time. One of the fears i have with headscale is a sudden change in leadership at tailscale, then the support from tailscale dies. Significant divergence occurs between headscale coordinator server and clients. Enshittification occurs and now forcing those smaller use cases onto their SaaS. I love tailscale/headscale but will definitely give this a try.

sunshine-o 8mo ago

For those interested, I just found out that mycelium can, like yggdrasil [0], be used to create private overlay networks [1]. What could be used as an alternative to Tailscale, netbird, etc. - [0] https://changelog.complete.org/archives/10478-easily-accessing-all-your-stuff-with-a-zero-trust-mesh-vpn https://changelog.complete.org/archives/10478-easily-accessi... - [1] https://github.com/threefoldtech/mycelium/blob/master/docs/private_network.md https://github.com/threefoldtech/mycelium/blob/master/docs/p...

nsadeghi97 8mo ago

If you are reading this thread and think that’s an interesting project to work on, shoot us a message. We are always looking for talented engineers that are passionate about open source :)

cpach 8mo ago
Are you on the Netbird dev team? :)

augunrik 8mo ago

I tried installing it and it was a pain, if you don’t use the very very default scripts. Also their scripts regenerate secrets and the setup is weird in general (you need a complicated rp configuration and scripts to generate the config files)

maximgeorge 8mo ago

[dead]

flashu 8mo ago

I have tried multiple different solutions of so called "zero trust networking". My personal favourite one is Netbird but.. it lacks one feature: switching between multiple setups (networks). I am helping to maintain some startups and it would be just nice to quickly change (or even better: have access to multiple at once!) networks.

bc569a80a344f9c 8mo ago
> it would be just nice to quickly change (or even better: have access to multiple at once!) networks. Accessing multiple corporate networks simultaneously from the same endpoint violates all sorts of access policies. If it doesn’t, the access policy is lacking. Even for startups. And no, unless you build it and enforce it from the start, no one ever succeeds in bolting on a reasonably security posture after implementing all their other processes no one will dare touch.

jrm4 8mo ago

How does this compare to Tinc? I'm aware of how old Tinc is, but I've yet to find anything compelling enough to get me to switch. Tinc is a little annoying to set up, but once it's going I literally forget about it.

woile 8mo ago

For the guys at Netbird, please create an entry in the https://wiki.nixos.org https://wiki.nixos.org explaining how to use it with nixos. - Tailscale has one entry - Pangolin is getting one I would like to see, even if brief: 1. Getting started 2. Hardware requirements 3. Security considerations 4. Recommended architecture, like running in a VPS if it makes sense 5. Configuring a server 6. Configuring devices 7. Resources (links to read more on netbird) Thank you from the home lab community

__float 8mo ago
This is kind of a weird request, IMO. If you're a homelab NixOS user, isn't it on you to try to answer these questions? A home lab is for learning, and if you don't want to do that, what's the point?
patmorgan23 8mo ago
Anyone can contribute to the nixos wiki, why don't you get the page started?
- woile 8mo ago
  Because I don't feel confident. I'm super green at VPN's and this kind of networks. I don't want to give the wrong advice. I'm editing what I can, but you don't want to take my advice, it would be better if someone who knows does it. The fact that I'm into home lab, doesn't mean I know specifically how to do this. And I'm just saying, when I go to the wiki, to pick up on one of the options, they are missing. I don't know why the hostility for asking to add some docs

Factor1177 8mo ago

I was previously using headscale and was finding it a bit finicky. Recently switched to self hosted netbird and its been great so far. However, if the Netbird teams sees this, please implement a built-in updater for the client apps! needing to download and install the package again is a bit annoying

preisschild 8mo ago
Why not use a package manager? It seems way better than letting every app auto-update itself

joecool1029 8mo ago

I wish they'd chill on the release schedule and keep it to once a week or less. I keep it maintained in my Gentoo overlay but oftentimes when I go to bump it, they push another release. Since this submission was posted they've had yet another new release.

nicolashenneaux 8mo ago

Working with it in a 1k active users setup, super efficient and stable! Clearly a revolution comparing to historical vpn solutions!

jsattler 8mo ago

Sounds interesting. How is it different to tailscale (or headscale)? I was planning to setup tailscale to replace my custom wireguard setup.

sieabahlpark 8mo ago

[dead]

Uptrenda 8mo ago

Going to mention my own project which aims to be 100% open source, free, and relies almost only on public infrastructure: https://github.com/robertsdotpm/p2pd https://github.com/robertsdotpm/p2pd Basically, I'm building a framework for building NAT traversal plugins. Software like ngrok and P2P VPNs can then be built on top of it. Examples of plugins for the library include direct connect, reverse connect (connect back to you), TCP hole punching, and UPnP-based port forwarding. The underlying network stack for the project was also built from scratch to better support IPv6 and multiple interfaces. This allows plugins to fully utilise the underlying network paths and interfaces on the machine. This took considerable time because most software simply uses the default interface. I'm still in the middle of building the software so its not yet functional. But if anyone is interested throw me a star or an email at matthew@roberts.pm.

Uptrenda 8mo ago
By the way I forgot to add: if anyone needs a list of public STUN, TURN, MQTT, or NTP servers I wrote a monitor for them last year and added a bunch of servers. This is basically the infrastructure I use for my P2P library. The public API is here: http://ovh1.p2pd.net:8000/servers http://ovh1.p2pd.net:8000/servers or if you want to host it: https://github.com/robertsdotpm/dogdorm https://github.com/robertsdotpm/dogdorm

catlifeonmars 8mo ago

Anyone know who the board members are and/or major stakeholders?

glub103011 8mo ago

[dead]

commandersaki 8mo ago

I can't tell if Netbird provides this feature but looking at their access control feature it doesn't seem to. I just want a roaming access Wireguard terminating endpoint to restrict access to a user to initial subnets, and open / allow routing to further subnets based on multi factor authentication. That way a user can connect and only have access to say a wiki and internal chat, but then escalate access by MFA to access resources on other subnets that have stuff like internal gitlab and whatever other critical resources exist.

littlecranky67 8mo ago

Marginally relevant as I am looking into Netbird and Headscale: Anybody can recommand a europe-based VPS hosting provider that gives you an IPv4 range (4-5 IPs) that I can route over headscale?

ktaf 8mo ago

We've deployed self-hosted NetBird on AWS ECS and we're quite happy with the setup and the outcome.

RiceNBananas 8mo ago

[dead]

mduett 8mo ago

Met the founders in Berlin and was quite convinced of technical depth and vision. Great to have a European alternative to tailscale.

jonas_scholz 8mo ago

we love and support netbird at sliplane <3 https://docs.sliplane.io/private-networking/netbird https://docs.sliplane.io/private-networking/netbird

throw20251220 8mo ago

The cofounder is a Russian national, studied in Moscow. Possibly worth massaging that into your threat model.

the_real_cher 7mo ago

How is this different from Tailscale?