Self-hosted secure remote access platform combining WireGuard VPN, identity management, MFA and network access control.
netbirdio/netbird
Open-source WireGuard-based mesh VPN that connects machines, people and AI agents over peer-to-peer encrypted tunnels with identity-based access control.
Open-source alternative to:Tailscale
ZeroTier
Cloudflare Access
- Stars
- 30,186
- Forks
- 1,778
- Open issues
- 792
- Last commit
- 11 hours ago
What is it?
NetBird combines a configuration-free peer-to-peer private network with a centralized access control system. Each machine runs a NetBird agent that manages a WireGuard tunnel, so devices can reach each other without opening inbound ports, writing complex firewall rules, or setting up a VPN gateway.
Access is governed by groups and rules managed from a single admin UI, with SSO and MFA support, IdP integrations, private DNS, routes to external networks and exit nodes. When direct NAT traversal fails, traffic falls back to a relay service. The project can be used through the hosted NetBird Cloud or self-hosted with Docker, and it ships clients for Linux, macOS, Windows, Android, iOS, FreeBSD and several router and NAS platforms.
The repository includes a Management Service, a Signal Service, a Relay Service and client components written in Go. It also provides a public API, a Terraform provider and an Ansible collection for automation.
Key features
- 01Peer-to-peer WireGuard tunnels with automatic peer discovery and relay fallback.
- 02Granular access control using groups and rules, managed from one admin UI.
- 03SSO and MFA support with IdP integrations and IdP group sync.
- 04Routes to external networks, exit nodes, and private DNS with custom zones.
- 05SSH and browser-based SSH and RDP with central access policies.
- 06Public API, Terraform provider, and Ansible collection for automation.
Use cases
- Connecting office laptops, servers and home lab devices into one private network without a traditional VPN gateway.
- Giving remote staff controlled access to internal services with SSO and per-group policies.
- Routing traffic to a private subnet or using an exit node from a remote device.
- Running a self-hosted zero-trust overlay on a small VM with Docker Compose.
Quick start
- 1
Download and install the NetBird client from app.netbird.io/install
- 2
Sign up with Google, Microsoft, GitHub or your email address, then check the admin UI
- 3
Or self-host: run the official install script from the README (requires a Linux VM, a public domain and Docker Compose)
Things to know
- The license is mixed: BSD-3-Clause for most code, but the management, signal and relay directories are AGPLv3.
- Self-hosting needs a public domain, a Linux VM with open ports 80, 443 and UDP 3478, and Docker Compose.
- The main branch may be unstable or broken, so use tagged releases for stable use.
- The Agent Network feature is in beta.
In collections
Topics
FAQ
- What is netbird?
- Open-source WireGuard-based mesh VPN that connects machines, people and AI agents over peer-to-peer encrypted tunnels with identity-based access control. NetBird combines a configuration-free peer-to-peer private network with a centralized access control system. Each machine runs a NetBird agent that manages a WireGuard tunnel, so devices can reach each other without opening inbound ports, writing complex firewall rules, or setting up a VPN gateway.
- Is netbird free to use? What license does it have?
- netbird is open source under the Other license. Check the license terms before using it in commercial products.
- Is netbird still maintained?
- Actively maintained. The last commit to netbird was on Oct 24, 2026.
- What can I use netbird for?
- Connecting office laptops, servers and home lab devices into one private network without a traditional VPN gateway. Giving remote staff controlled access to internal services with SSO and per-group policies. Routing traffic to a private subnet or using an exit node from a remote device. Running a self-hosted zero-trust overlay on a small VM with Docker Compose.
- How do I install netbird?
- Download and install the NetBird client from app.netbird.io/install Sign up with Google, Microsoft, GitHub or your email address, then check the admin UI Or self-host: run the official install script from the README (requires a Linux VM, a public domain and Docker Compose)
- Where can I get netbird?
- The source code and installation instructions are on GitHub: https://github.com/netbirdio/netbird
Summary generated by AI from the project's README. GitHub stats refresh daily.
Related projects
A decentralized mesh VPN written in Rust that connects devices into a virtual LAN with NAT traversal and WireGuard support.
Open-source, self-hostable SASE platform built on WireGuard that combines zero-trust VPN, reverse proxy, privileged access and an AI gateway.
Self-hosted zero trust secure access platform combining remote access VPN, ZTNA, API/AI gateway, PaaS and ngrok-style tunnels on Kubernetes.
Self-hostable-by-design secure remote access platform built on WireGuard, with identity-based policies, device trust and audit logs.
Tailscale builds private WireGuard-based networks between your devices; this repo holds its tailscaled daemon and tailscale CLI.