NetBird is an open-source, Go-based platform that combines a configuration-free peer-to-peer WireGuard overlay network with a centralized access control system, built for organizations and home users who need secure private networking without opening ports, writing complex firewall rules, or deploying VPN gateways.

What it is

NetBird creates a WireGuard-based overlay network that automatically connects machines over an encrypted tunnel. It lives in the Security and Privacy / Network Security space and is written in Go. The project pairs two things that are usually separate: the peer-to-peer connectivity layer that carries traffic, and the control plane that decides who may reach what. Peers connect directly where the network allows it, and fall back to a connection relay when it does not, so the topology adapts without per-host configuration.

The concrete problem it solves is the operational overhead of traditional remote access. Instead of provisioning VPN gateways, maintaining static firewall rules and opening inbound ports, NetBird discovers and configures peers automatically and applies granular access policies from a single place. It replaces the classic hub-and-gateway VPN arrangement with a mesh, plus a management layer that includes an admin web UI, SSO and MFA, groups and rules, activity logging, and private DNS. The project has moved through the Wiretrustee lineage and remains active, with push activity recorded in September 2026 and a large open-source following of roughly 29,000 stars and 1,600 forks.

Key capabilities

• Kernel WireGuard for the data path, with peer-to-peer connections and connection relay fallback when direct paths are unavailable.
• Access control built on groups and rules, combined with SSO and MFA support and activity logging for audit trails.
• Traffic routing beyond the overlay, including routes to external networks, exit nodes, and domain-based DNS routes.
• DNS management covering private DNS, custom DNS zones, and DNS aliases for routed networks.
• Automation surfaces including a public API, setup keys for bulk provisioning, a Terraform provider, and an Ansible collection.
• Identity integrations covering IdP integrations and IdP group sync with JWT.
• SSH with central access policies, browser SSH and RDP, device posture checks, peer-to-peer encryption, and quantum resistance with Rosenpass.

Who uses it and how

• Teams replacing a traditional VPN gateway, using SSO and MFA plus group rules to grant access instead of per-host firewall configuration.
• Operators connecting machines across mixed infrastructure, since clients exist for Linux, macOS, Windows, Android, Android TV, iOS, Apple TV, and FreeBSD.
• Administrators with multiple networks or tenants, served by multiuser support, multi-account profile switching, and IPv6 dual-stack overlay settings.
• Platform and infrastructure teams provisioning at scale through setup keys, the public API, the Terraform provider, or the Ansible collection.
• Home users and small groups wanting a private network between their own devices without exposing services to the internet.

Getting started

Start with the hosted option at netbird.io, or follow the documentation for platform-specific client installation on Linux, macOS, Windows, mobile, and TV targets. Self-hosting is supported through a self-hosting quickstart script, with documentation covering identity provider configuration.

How it compares

No paid products are named in the provided facts as targets this project replaces, and no similar tools are named either, so it stands alone in this registry. Any comparison against commercial zero-trust network access offerings should be made from the project's own documentation rather than assumed here.

When to use it — and when not to

A self-hoster takes on operating the control plane, including the management service, the admin dashboard, and integration with an external identity provider for SSO, along with the DNS and relay components implied by the feature set. The licence is recorded as NOASSERTION, so anyone with strict licence-compliance requirements should confirm terms before adopting it, and the roughly 1,500 open issues suggest a busy tracker worth reviewing against your own use case. The agent network capability is marked beta, so it is not the part to build a production dependency on yet.

export NETBIRD_DOMAIN=netbird.example.com; curl -fsSL https://github.com/netbirdio/netbird/releases/latest/download/getting-started.sh | bash