NetBird

Open source alternative to Tailscale, ZeroTier and Twingate

30.6K stars
Active this week
Last commit 1 day ago

Last verified Nov 3, 2026

Connect remote users, hybrid-cloud, and edge infrastructure with WireGuard-based peer-to-peer tunnels and identity-aware Zero Trust access policies.

Visit website GitHub30.6K Deploy on Hostinger

Read the full breakdownWho it is for, how it works, trade-offs, the quick start and the FAQ

who it's for

Who NetBird is for#

IT teams securing remote workforces

Teams that need to give remote employees access to internal resources (databases, monitoring dashboards, internal apps) without exposing those services to the internet. NetBird ties access to the employee's SSO identity and device posture, so off-boarding a user through the identity provider revokes their network access automatically.

Skip if:

If your workforce is entirely office-based and remote access is handled by an existing enterprise VPN you have no plans to replace, the migration overhead will outweigh the benefit for a small team.

DevOps engineers connecting multi-cloud and on-premises infrastructure

Engineers managing services across AWS, GCP, Azure, and on-premises hardware can join every node to a NetBird network and define access rules that mirror their infrastructure topology. The Terraform provider and public API let that configuration live alongside the infrastructure it protects in the same code review and deployment pipeline.

Skip if:

If your infrastructure is entirely within a single cloud VPC and cross-cloud connectivity is not a requirement, cloud-native private networking such as VPC peering may be simpler than operating an overlay network.

Security teams enforcing Zero Trust access with audit trails

Security teams that need to record exactly which user connected to which internal resource, from which device, and at what time. NetBird's activity logs stream to SIEM platforms in real time, and device posture checks enforce baseline security requirements before any access is granted. Group-based rules implement least-privilege access across the entire private network.

Skip if:

If your compliance framework requires a certified SIEM connector with an SLA, evaluate whether NetBird's logging export meets the specific evidence standard before committing to it as the sole access layer.

Homelab and small-team self-hosters replacing Tailscale

Individuals and small teams who want a self-hosted alternative to Tailscale's cloud, with no per-seat fees and full control over the management plane. A single VM with 2 GB RAM handles dozens of peers. The BSD-3-Clause client and AGPL-3.0 server are both OSI-approved, and the cloud-free setup costs nothing beyond the VM.

Skip if:

If you want zero infrastructure management and are comfortable with a managed control plane, NetBird Cloud or Tailscale's free tier are simpler to operate than a self-hosted NetBird server.

the problem

The problem it solves#

Traditional VPNs route all traffic through a central gateway, creating three distinct pains for growing teams. The gateway becomes a performance bottleneck under load, a single point of failure when it goes down, and a configuration burden as the number of nodes and access rules grows. Setting up split tunnels, managing firewall rules, and onboarding new machines requires significant network expertise, and mistakes open attack surface.

Access control is a separate problem. Most VPN tools grant a user full network access once they authenticate, leaving every internal service exposed to anyone on the VPN. Layering a Zero Trust policy on top typically requires additional NAC tooling, complex identity provider integrations, and a web of firewall rules that drift over time and are difficult to audit at scale.

how NetBird solves it

How it solves it#

Peer-to-peer WireGuard tunnels with relay fallback

NetBird forms direct encrypted tunnels between peers using kernel WireGuard, bypassing any gateway in the data path. When a direct connection is not possible due to carrier-grade NAT or restrictive firewalls, the network automatically falls back to a relay service and maintains the encrypted WireGuard tunnel through it. No firewall port changes are required on the endpoint side.

Identity-aware access control with SSO and MFA

Network access in NetBird is tied to user identity through your existing identity provider. Okta, Microsoft Entra, Google Workspace, and other OpenID-compatible providers gate each connection. Group-based rules define which users and devices can reach which internal resources, and periodic re-authentication keeps sessions short-lived. MFA settings from your identity provider apply automatically.

Device posture checks before network access

Before granting any connection, NetBird can verify that the connecting device meets your security baseline: firewall active, antivirus running, OS version at or above a threshold, or geographic location within an allowed range. Integrations with popular MDM and EDR platforms extend those checks further. Devices that fail posture are blocked at the network layer.

Infrastructure-as-code via Terraform, API, and Ansible

NetBird exposes a full REST API and an official Terraform provider, so network topology, access rules, and peer groups can be managed as code alongside the infrastructure they protect. An Ansible collection and setup-key-based bulk provisioning let you automate agent enrollment at scale without manual web UI steps.

Cross-platform agents across 15+ operating systems

NetBird agents run on Linux, Windows, macOS, Android, iOS, FreeBSD, pfSense, OPNsense, MikroTik RouterOS, OpenWRT, Synology, TrueNAS, Proxmox, Raspberry Pi, Docker containers, and serverless functions. The same agent joins any NetBird network regardless of platform, so a container in AWS and an on-premises server behind NAT can share a private network with no special treatment.

Activity logging and real-time SIEM streaming

NetBird logs all connection events, configuration changes, and access decisions with timestamps and user attribution. Logs stream to external SIEM platforms in real time, providing the audit trail required for compliance in environments that need to record who connected to what and when. All traffic events are also captured for forensic review.

strengths · trade-offs

Strengths and trade-offs#

Strengths

Fully self-hostable management planeUnlike Tailscale or Twingate, NetBird lets you operate your own management, signal, and relay servers on your infrastructure. The quickstart script deploys the full server stack via Docker Compose on a 2 GB Linux VM and handles TLS certificate provisioning automatically. Your network state never leaves your infrastructure unless you choose the managed cloud option.
30,680 GitHub stars with active daily developmentThe netbirdio/netbird repository has over 30,000 stars and received its most recent commit on 2026-11-04. The team maintains active Slack and community forum channels for self-hosters. Bug reports go through a discussion-first workflow that keeps the issue tracker focused on confirmed, in-progress work rather than unvalidated reports.
Zero Trust access control without additional toolingNetBird bundles identity provider integration, device posture checks, group-based access rules, and audit logging into one agent and management plane. Teams running legacy VPNs typically need separate NAC products, firewall policy layers, and SIEM connectors to get equivalent enforcement. NetBird covers all of that in a single deployment.
Connects anything that can run an agentA container in AWS, an on-premises server behind carrier-grade NAT, a laptop on a mobile network, and a router running OpenWRT can all join the same private NetBird network. The platform-agnostic agent list covers NAS devices, routers, single-board computers, and serverless runtimes, so the tool fits infrastructure that VPN clients typically cannot reach.

Trade-offs

-Self-hosting requires a publicly accessible VMThe management and signal servers need TCP ports 80 and 443 and UDP port 3478 reachable from the internet, plus a public domain name with DNS pointing at the host. This rules out purely internal or air-gapped deployments for the management plane and adds a dependency on DNS and TLS certificate management. The quickstart script automates certificate provisioning, but the VM must remain reachable.
-Split license: BSD-3-Clause clients, AGPL-3.0 serversThe client code and most of the codebase are BSD-3-Clause. The server components (management, signal, relay, and combined directories) are AGPL-3.0 and carry their own LICENSE files. Both are OSI-approved licenses and the full stack is self-hostable. If you modify the server-side code and distribute it as a managed service to others, AGPL requires publishing those changes. Internal use, including commercial team deployments, carries no such obligation.
-468 open issues reflect a broad, evolving feature setThe project tracks 468 open issues (pull requests excluded, as of 2026-11-05). That is a reasonable count for a project with over 30,000 stars, but it reflects ongoing work across a broad feature set. Users in highly specific environments, such as unusual NAT configurations or niche router platforms, may encounter rough edges that are known but not yet resolved.

versus alternatives

NetBird vs alternatives#

NetBird vs Tailscale

Both tools build peer-to-peer WireGuard networks with centralized access management, SSO support, and device posture checks. The deciding factor is control-plane ownership.

Feature	NetBird	Tailscale
License	BSD-3-Clause (clients) / AGPL-3.0 (servers)	Proprietary
Self-hostable control plane	Yes	No
SSO / MFA	Yes	Yes
Device posture checks	Yes	Yes (Business plans)
Pricing	Free self-hosted / paid cloud	Free tier / paid plans

NetBird is the stronger choice when your control plane must stay on your own infrastructure: air-gapped networks, regulated environments, or organizations with policies that prohibit third-party cloud control planes. Tailscale is worth considering when you want zero infrastructure management and are comfortable with Tailscale's cloud, particularly for small teams already on its free tier.

NetBird vs ZeroTier

ZeroTier and NetBird both create overlay networks, but they differ in their access-control model. ZeroTier focuses on creating virtual Layer 2 and Layer 3 networks and lets you bridge machines into a virtual LAN. NetBird layers a full Zero Trust access control system on top of the network connection, with identity provider integration, device posture checks, and per-connection logging built in.

Feature	NetBird	ZeroTier
Self-hostable	Yes	Yes
Zero Trust / identity-aware access	Yes	Limited (manual firewall rules)
SSO integration	Yes	Via third-party tooling
Device posture enforcement	Yes	No
Activity logging	Yes	Limited

NetBird is the better fit when you need identity-aware access control and audit logging out of the box. ZeroTier suits teams that need a simple virtual LAN model and are comfortable managing access control separately.

NetBird vs Twingate

Twingate is a commercial ZTNA product with no self-hosting option. It offers a polished managed experience, but all control-plane state lives in Twingate's infrastructure.

Feature	NetBird	Twingate
License	BSD-3-Clause / AGPL-3.0	Proprietary
Self-hostable	Yes	No
Peer-to-peer connections	Yes	No (relay-based)
Pricing	Free self-hosted / paid cloud	Per-user paid plans

NetBird is the right choice when self-hosting, cost control, or peer-to-peer performance are requirements. Twingate suits organizations that prefer a fully managed service with vendor support and have no need to control the underlying infrastructure.

install · quick start

Quick start#

bash

Deploy the NetBird server stack on a Linux VM with Docker and a public domain.

```bash
export NETBIRD_DOMAIN=netbird.example.com
curl -fsSL https://github.com/netbirdio/netbird/releases/latest/download/getting-started.sh | bash
```

tech stack · detected from GitHub

What it's built on#

Languages: GoTypeScript
Frameworks: React

frequently asked

FAQ#

Is NetBird free to use?

Yes. The self-hosted option is free: the client code is BSD-3-Clause and the server components are AGPL-3.0, both OSI-approved. You run everything on your own VM at no license cost. NetBird also offers a cloud-managed option (NetBird Cloud) with a free tier for small teams and paid plans for larger organizations. For most self-hosters, the open source path costs nothing beyond the VM and domain.

How is NetBird different from Tailscale?

The key difference is where the control plane lives. Tailscale's coordination server runs in Tailscale's cloud and cannot be moved. NetBird lets you self-host the management, signal, and relay servers on your own infrastructure, so your network state stays on your systems unless you choose the managed option. For air-gapped networks, regulated environments, or organizations with policies against third-party cloud control planes, that distinction matters.

What are the requirements for self-hosting NetBird?

A Linux VM with at least 1 CPU and 2 GB of RAM, publicly accessible on TCP ports 80 and 443 and UDP port 3478, with a public domain name pointing at it, and Docker with the Compose v2 plugin. The quickstart script automates the rest of the setup including TLS certificate provisioning. If the domain and VM are already in place, setup takes about five minutes.

What license governs NetBird?

The repository uses two OSI-approved licenses. Client code and most of the codebase are BSD-3-Clause. The server directories (management, signal, relay, and combined) each carry their own LICENSE file under AGPL-3.0. Self-hosters running the full stack internally for their own use, including commercial team deployments, can do so freely under both licenses. AGPL's distribution requirement applies only if you modify the server code and offer it as a hosted service to others.

Does NetBird support AI agent connectivity?

Yes, in beta. The project includes a NetBird Agent Network feature that provides identity-aware access control for AI agents, with keyless access to LLM APIs and private resources over the encrypted NetBird tunnel. The beta is documented at netbird.ai and in the agent-network/ directory of the repository. It follows the same identity and policy model as human user access.

also worth a look

Similar open-source tools#

tailcat

Alternative toTailscale

Encrypted tunnels between machines, no account or IP needed

8,707 GitHub stars
Licence BSD-3-Clause

WGDashboard

Alternative toTailscale

WireGuard VPN dashboard with peer management, MFA, and Docker support.

3,767 GitHub stars
Licence Apache-2.0

iroh

Alternative toTailscale

Connect devices seamlessly without relying on the cloud.

12,927 GitHub stars
Licence Apache-2.0

Beszel

Alternative toDatadog

Self-hosted server monitoring with Docker stats and disk health.

26,836 GitHub stars
Licence MIT

Homeio

Alternative toUnraid

Browser desktop for your self-hosted home server

102 GitHub stars
Licence AGPL-3.0

OpenSRE

Alternative toIncident.io

Accelerate incident resolution with intelligent alert investigation

12,708 GitHub stars
Licence Apache-2.0

by category

Open source tools in these categories#

157

Self-host NetBird on a Hostinger VPS

Keep it running 24/7, even when your laptop is off. A Hostinger VPS gives it a server of its own.

01
Choose a plan
Starts from $6.49/mo
02
Apply
Extra 10% off yearly plans
03
Install NetBird
On a server that stays on
04
Start building
Focus on the app, not the server

Deploy on Hostinger

Inbox Zero

Alternative toSuperhuman

AI email assistant that drafts replies and clears your inbox

12,889 GitHub stars
Licence AGPL-3.0
#Email

rakazo

Alternative toGrok Bot

AI teammates you own: your keys, your model, your machine.

6,568 GitHub stars
Licence Apache-2.0
#AI Agents

SnitchFeed

Live monitoring on LinkedIn, X, Reddit & more. Agentic social listening for startups.

Marketing & Growth

Advertise your product

The projects we add and every new guide. Free, unsubscribe any time.

Find open source alternatives to paid software

NetBird vs Tailscale

Both tools build peer-to-peer WireGuard networks with centralized access management, SSO support, and device posture checks. The deciding factor is control-plane ownership.

Feature	NetBird	Tailscale
License	BSD-3-Clause (clients) / AGPL-3.0 (servers)	Proprietary
Self-hostable control plane	Yes	No
SSO / MFA	Yes	Yes
Device posture checks	Yes	Yes (Business plans)
Pricing	Free self-hosted / paid cloud	Free tier / paid plans

NetBird vs ZeroTier

Feature	NetBird	ZeroTier
Self-hostable	Yes	Yes
Zero Trust / identity-aware access	Yes	Limited (manual firewall rules)
SSO integration	Yes	Via third-party tooling
Device posture enforcement	Yes	No
Activity logging	Yes	Limited

NetBird vs Twingate

Twingate is a commercial ZTNA product with no self-hosting option. It offers a polished managed experience, but all control-plane state lives in Twingate's infrastructure.

Feature	NetBird	Twingate
License	BSD-3-Clause / AGPL-3.0	Proprietary
Self-hostable	Yes	No
Peer-to-peer connections	Yes	No (relay-based)
Pricing	Free self-hosted / paid cloud	Per-user paid plans