NetBird — Open Source WireGuard Mesh VPN with Zero Trust

What it is

NetBird is an open-source, WireGuard-based mesh VPN and zero-trust networking platform. It connects devices (laptops, servers, mobile phones) into a secure overlay network with end-to-end encryption, SSO authentication, multi-factor authentication, and fine-grained access controls, all managed through a web dashboard.

NetBird targets teams and organizations that need secure peer-to-peer connectivity without the complexity of traditional VPN infrastructure. It is a modern alternative to Tailscale and ZeroTier, offering a fully open-source stack with enterprise features like posture checks and network routing.

How it saves time or tokens

NetBird eliminates the need to manually configure WireGuard tunnels between each pair of devices. Traditional WireGuard setup requires generating keys, exchanging public keys, and maintaining configuration files on every node. NetBird automates all of this through its management plane. SSO integration means no separate VPN credentials to manage. Setup keys enable headless device registration for servers and CI runners, removing manual approval bottlenecks.

How to use

1. Install the NetBird client on any device:

curl -fsSL https://pkgs.netbird.io/install.sh | sh

1. Connect to your network using a setup key:

netbird up --setup-key your-setup-key

1. For self-hosted deployments, run the full stack with the provided bootstrap script:

curl -fsSL https://github.com/netbirdio/netbird/releases/latest/download/getting-started-with-zitadel.sh | bash

Example

A typical NetBird network configuration with access groups:

# NetBird network topology example
peers:
  - name: dev-laptop
    groups: [developers]
    os: macOS

  - name: staging-server
    groups: [servers, staging]
    os: Linux

  - name: prod-db
    groups: [servers, production, database]
    os: Linux

access_policies:
  - name: dev-to-staging
    sources: [developers]
    destinations: [staging]
    ports: [22, 443, 5432]

  - name: no-direct-prod
    sources: [developers]
    destinations: [production]
    action: deny

Related on TokRepo

• Self-hosted tools — Browse more self-hostable infrastructure tools on TokRepo.
• DevOps tools — Networking, deployment, and infrastructure automation resources.

Common pitfalls

• Forgetting to configure DNS resolution for NetBird peers causes hostname-based connections to fail. Use the built-in DNS feature or configure your resolver to forward the NetBird domain.
• Running NetBird alongside another WireGuard instance on the same machine creates interface conflicts. Disable the standalone WireGuard interface before starting NetBird.
• Posture checks that require specific OS versions will block legitimate devices from connecting if not updated. Test posture policies in audit mode before enforcing them.