Convert Figma logo to code with AI

netbirdio logonetbird

Connect your devices into a secure WireGuard®-based overlay network with SSO, MFA and granular access controls.

29,062
1,668
29,062
1,606

Top Related Projects

36,302

The easiest, most secure way to use WireGuard and 2FA.

11,778

Netmaker makes networks with WireGuard. Netmaker automates fast, secure, and distributed virtual networks.

18,325

A scalable overlay networking tool with a focus on performance, simplicity and security

29,062

Connect your devices into a secure WireGuard®-based overlay network with SSO, MFA and granular access controls.

A private network system that uses WireGuard under the hood.

Enterprise-ready zero-trust access platform built on WireGuard®.

Quick Overview

NetBird is an open-source VPN management platform that simplifies the creation and management of secure, peer-to-peer networks. It uses WireGuard® protocol for fast and secure connections, and provides a user-friendly interface for easy network administration and monitoring.

Pros

  • Easy setup and management of secure networks
  • Cross-platform support (Windows, macOS, Linux, iOS, Android)
  • Automatic key rotation and peer discovery
  • Integration with identity providers (e.g., Google Workspace, Azure AD)

Cons

  • Relatively new project, may have undiscovered issues
  • Limited documentation compared to more established VPN solutions
  • Requires self-hosting for full control and privacy
  • May not be suitable for very large enterprise networks

Getting Started

To get started with NetBird, follow these steps:

  1. Install NetBird on your device:

    curl -fsSL https://pkgs.netbird.io/install.sh | sh
    
  2. Sign up for a NetBird account or set up a self-hosted management service.

  3. Run NetBird and connect to your account:

    sudo netbird up
    
  4. Access the NetBird UI to manage your network, add peers, and configure access controls.

For more detailed instructions and advanced configuration options, refer to the official NetBird documentation at https://netbird.io/docs/.

Competitor Comparisons

36,302

The easiest, most secure way to use WireGuard and 2FA.

Pros of Tailscale

  • More mature and widely adopted project with a larger user base
  • Offers a managed service option for easier deployment and maintenance
  • Provides advanced features like access controls and single sign-on integration

Cons of Tailscale

  • Closed-source control server, limiting self-hosting options
  • Requires a central coordination server, which may introduce latency
  • Less flexible in terms of customization compared to fully open-source alternatives

Code Comparison

Tailscale (Go):

func (c *Conn) Close() error {
    c.mu.Lock()
    defer c.mu.Unlock()
    if c.closed {
        return nil
    }
    c.closed = true
    return c.pconn.Close()
}

NetBird (Go):

func (c *Conn) Close() error {
    c.Lock()
    defer c.Unlock()
    if c.isClosed {
        return nil
    }
    c.isClosed = true
    return c.conn.Close()
}

Both projects use similar patterns for connection closing, with mutex locks and checks for already closed connections. The main difference lies in variable naming conventions and specific implementation details.

11,778

Netmaker makes networks with WireGuard. Netmaker automates fast, secure, and distributed virtual networks.

Pros of Netmaker

  • More flexible networking options, including support for multiple network topologies
  • Advanced features like access control lists (ACLs) and network segmentation
  • Better suited for complex enterprise environments

Cons of Netmaker

  • Steeper learning curve and more complex setup process
  • Less user-friendly interface compared to Netbird
  • May require more resources to run and manage

Code Comparison

Netmaker (Go):

func (server *Server) CreateNetwork(network *models.Network) error {
    network.SetDefaults()
    if err := server.DB.Create(network).Error; err != nil {
        return err
    }
    return nil
}

Netbird (Go):

func (s *Server) CreateNetwork(ctx context.Context, network *Network) error {
    if err := s.store.CreateNetwork(ctx, network); err != nil {
        return err
    }
    return nil
}

Both projects use Go and have similar network creation functions, but Netmaker's implementation includes default value setting and uses GORM for database operations, while Netbird's approach is more straightforward and uses a custom store interface.

18,325

A scalable overlay networking tool with a focus on performance, simplicity and security

Pros of Nebula

  • More mature project with a longer history and larger community
  • Offers advanced networking features like IP address management and certificate-based authentication
  • Provides better performance for high-throughput applications

Cons of Nebula

  • More complex setup and configuration process
  • Lacks built-in NAT traversal capabilities
  • Limited platform support compared to NetBird

Code Comparison

NetBird configuration example:

peers:
  - public_key: ABC123...
    allowed_ips:
      - 10.0.0.1/32

Nebula configuration example:

static_host_map:
  "10.0.0.1": ["public_ip:4242"]
lighthouse:
  am_lighthouse: false
  interval: 60

Both projects aim to create secure overlay networks, but NetBird focuses on simplicity and ease of use, while Nebula offers more advanced networking features at the cost of increased complexity. NetBird provides a more user-friendly experience with its web UI and automatic NAT traversal, making it suitable for less technical users. Nebula, on the other hand, offers greater flexibility and control over network configurations, making it a better choice for advanced users and complex network setups.

29,062

Connect your devices into a secure WireGuard®-based overlay network with SSO, MFA and granular access controls.

Pros of NetBird

  • More comprehensive documentation and user guides
  • Larger community and more active development
  • Better integration with cloud platforms and services

Cons of NetBird

  • Higher resource consumption
  • Steeper learning curve for new users
  • More complex configuration process

Code Comparison

NetBird:

func (s *Server) Run() error {
    s.wg.Add(1)
    go s.runGRPCServer()
    s.wg.Add(1)
    go s.runHTTPServer()
    s.wg.Wait()
    return nil
}

NetBird>:

func (s *Server) Start() error {
    err := s.startGRPCServer()
    if err != nil {
        return err
    }
    return s.startHTTPServer()
}

The code comparison shows that NetBird uses goroutines for concurrent server execution, while NetBird> opts for a sequential approach. This difference reflects the overall design philosophy of each project, with NetBird focusing on performance and scalability, and NetBird> prioritizing simplicity and ease of use.

Both projects aim to provide secure and efficient networking solutions, but they cater to slightly different use cases and user preferences. NetBird is better suited for larger, more complex deployments, while NetBird> may be more appropriate for smaller projects or users who prefer a simpler setup process.

A private network system that uses WireGuard under the hood.

Pros of innernet

  • Written in Rust, potentially offering better performance and memory safety
  • Designed for internal networks, with a focus on simplicity and ease of use
  • Supports automatic IP address assignment and management

Cons of innernet

  • Limited to internal networks, not suitable for public-facing VPNs
  • Fewer features compared to NetBird, such as lack of built-in DNS management
  • Smaller community and less frequent updates

Code Comparison

innernet (Rust):

let server = Server::new(config)?;
server.run().await?;

NetBird (Go):

server, err := server.New(config)
if err != nil {
    return err
}
err = server.Run()

Both projects use similar high-level structures for server initialization and running, but innernet's Rust implementation may offer better performance and safety guarantees. NetBird's Go code is more verbose due to explicit error handling.

innernet is focused on internal networks, making it simpler to set up and manage for specific use cases. NetBird offers a more comprehensive solution with additional features like DNS management and public VPN support.

While innernet benefits from Rust's performance and safety, NetBird has a larger community and more frequent updates, potentially leading to better long-term support and feature development.

Enterprise-ready zero-trust access platform built on WireGuard®.

Pros of Firezone

  • Built with Elixir, offering robust concurrency and fault tolerance
  • Provides a user-friendly web UI for easier management
  • Supports single sign-on (SSO) integration with various identity providers

Cons of Firezone

  • Less mature project compared to Netbird
  • Smaller community and fewer contributors
  • Limited multi-platform support (primarily focused on Linux)

Code Comparison

Netbird (Go):

func (s *Server) Run() error {
    s.wg.Add(1)
    go s.runTURNServer()
    return s.runSignalServer()
}

Firezone (Elixir):

defmodule Firezone.Server do
  use GenServer

  def start_link(_) do
    GenServer.start_link(__MODULE__, [], name: __MODULE__)
  end

  def init(_) do
    {:ok, %{}}
  end
end

Both projects use different programming languages, which impacts their architecture and performance characteristics. Netbird's Go implementation may offer better raw performance, while Firezone's Elixir codebase provides better concurrency handling and fault tolerance. The code snippets demonstrate the different approaches to server implementation in each project.

Convert Figma logo designs to code with AI

Visual Copilot

Introducing Visual Copilot: A new AI model to turn Figma designs to high quality code using your components.

Try Visual Copilot

README

Start using NetBird at netbird.io
See Documentation
Join our Slack channel or our Community forum


🚀 We are hiring! Join us at https://netbird.io/careers

🤖 NetBird Agent Network (Beta)

Identity-aware access control for AI agents — keyless access to LLM APIs and private resources over the encrypted NetBird tunnel. See agent-network/ or read the docs at netbird.ai.

NetBird combines a configuration-free peer-to-peer private network and a centralized access control system in a single platform, making it easy to create secure private networks for your organization or home.

Connect. NetBird creates a WireGuard-based overlay network that automatically connects your machines over an encrypted tunnel, leaving behind the hassle of opening ports, complex firewall rules, VPN gateways, and so forth.

Secure. NetBird enables secure remote access by applying granular access policies while allowing you to manage them intuitively from a single place. Works universally on any infrastructure.

https://github.com/user-attachments/assets/10cec749-bb56-4ab3-97af-4e38850108d2

Self-host NetBird (video)

Watch the video

Key features

ConnectivityManagementSecurityAutomationPlatforms
✓ Kernel WireGuard✓ Admin Web UI✓ SSO & MFA support✓ Public API✓ Linux
✓ Peer-to-peer connections✓ Auto peer discovery and configuration✓ Access control: groups & rules✓ Setup keys for bulk provisioning✓ macOS
✓ Connection relay fallback✓ IdP integrations✓ Activity logging✓ Self-hosting quickstart script✓ Windows
✓ Routes to external networks✓ Private DNS✓ Traffic events✓ IdP groups sync with JWT✓ Android
✓ Domain-based DNS routes✓ Custom DNS zones✓ Device posture checks✓ Terraform provider✓ Android TV
✓ Exit nodes✓ Multiuser support✓ Peer-to-peer encryption✓ Ansible collection✓ iOS
✓ IPv6 dual-stack overlay✓ Multi-account profile switching✓ SSH with central access policies✓ Apple TV
✓ Browser SSH & RDP✓ Quantum-resistance with Rosenpass✓ FreeBSD
✓ Reverse proxy with auto-TLS✓ Periodic re-authentication✓ pfSense
✓ OPNsense
✓ MikroTik RouterOS
✓ OpenWRT
✓ Synology
✓ TrueNAS
✓ Proxmox
✓ Raspberry Pi
✓ Serverless
✓ Container

Quickstart with NetBird Cloud

Quickstart with self-hosted NetBird

This is the quickest way to try self-hosted NetBird. It should take around 5 minutes to get started if you already have a public domain and a VM. Follow the Advanced guide with a custom identity provider for installations with different IdPs.

Infrastructure requirements:

  • A Linux VM with at least 1 CPU and 2 GB of memory.
  • The VM should be publicly accessible on TCP ports 80 and 443 and UDP port 3478.
  • A public domain name pointing to the VM.

Software requirements:

Steps

  • Download and run the installation script:
export NETBIRD_DOMAIN=netbird.example.com; curl -fsSL https://github.com/netbirdio/netbird/releases/latest/download/getting-started.sh | bash

A bit on NetBird internals

  • Every machine in the network runs the NetBird agent, which manages WireGuard.
  • Every agent connects to the Management Service, which holds network state, manages peer IPs, and distributes updates to agents.
  • Agents use ICE (via pion/ice) to discover connection candidates for peer-to-peer connections.
  • Candidates are discovered with the help of STUN servers.
  • Agents negotiate a connection through the Signal Service, exchanging end-to-end encrypted messages with candidates.
  • When NAT traversal fails (e.g. mobile carrier-grade NAT) and a direct p2p connection isn't possible, the system falls back to a Relay Service and a secure WireGuard tunnel is established through it.

NetBird high-level architecture diagram

See a complete architecture overview for details.

Community projects

Note: The main branch may be in an unstable or even broken state during development. For stable versions, see releases.

Support acknowledgement

In November 2022, NetBird joined the StartUpSecure program sponsored by the Federal Ministry of Education and Research of the Federal Republic of Germany. Together with the CISPA Helmholtz Center for Information Security, NetBird brings security best practices and simplicity to private networking.

CISPA_Logo_BLACK_EN_RZ_RGB (1)

Acknowledgements

We build on open source technologies like WireGuard®, Pion ICE, and Rosenpass. We greatly appreciate the work these projects are doing, and we'd love it if you could support them too (e.g., by starring or contributing).

Legal

This repository is licensed under the BSD-3-Clause license, which applies to all parts of the repository except for the directories management/, signal/ and relay/. Those directories are licensed under the GNU Affero General Public License version 3.0 (AGPLv3). See the respective LICENSE files inside each directory.

WireGuard and the WireGuard logo are registered trademarks of Jason A. Donenfeld.