NetBird
WireGuard-based overlay network with SSO/MFA and granular access controls.
NetBird is an open-source private networking platform that creates a WireGuard-based overlay connecting devices across environments without configuring VPN gateways. It provides centralized access control and a management UI for policy enforcement across Linux, macOS, Windows, Android and iOS.
Key Features
- Kernel WireGuard integration
- Admin Web UI
- SSO & MFA support
- Public API
- Cross-platform clients (Linux, Mac, Windows, Android, iOS)
- Peer-to-peer connections with auto peer discovery
- Access control - groups & rules
- Setup keys for bulk provisioning
- NAT traversal with TURN fallback
- Identity provider integrations
- Activity logging
- Self-hosting via Docker and docker-compose
- Private DNS
- Docker-based quickstart script
Use Cases
- Secure remote access to private resources across distributed teams
- Site-to-site private networks across cloud/infrastructure
- Least-privilege access control with per-group policies via IdPs
Limitations and Considerations
- Self-hosted deployments require a publicly accessible Linux host and opening specific ports; NAT traversal can fail in strict networks, in which case a TURN relay is used
Conclusion
NetBird unifies a WireGuard-based overlay with centralized access control and identity-aware policies, enabling zero-configuration, scalable private networks across heterogeneous environments. It supports cloud-hosted or self-hosted deployments with an admin UI and REST API for managing peers and policies.
Categories:
Tags:
Tech Stack:
Go
Docker
WebRTCSimilar Services
Pi-hole
Network-wide DNS sinkhole for ad and tracker blocking
Pi-hole is a network-wide DNS sinkhole that blocks ads and trackers for all devices on your network, with a web dashboard, query logs, and optional DHCP server.
Headscale
Self-hosted control server for Tailscale-based WireGuard networks
Headscale is an open source, self-hosted implementation of the Tailscale control server for managing a private tailnet, nodes, keys, IPs, and routes.
AdGuard Home
Network-wide DNS server that blocks ads, trackers, phishing and malware
Open-source DNS-based ad & tracker blocking server for networks. Offers per-device rules, parental controls, encrypted upstream DNS (DoH/DoT/DNSCrypt), web UI and API.
Web-Check
All-in-one OSINT tool for analyzing any website.
Comprehensive on-demand OSINT to analyze a website's security, architecture, and tech stack.
wg-easy
WireGuard VPN server with a web-based admin interface
Run a WireGuard VPN server with an easy web admin UI to manage clients, generate configs and QR codes, and monitor connections and traffic.
SafeLine
Self-hosted WAF and reverse proxy for securing web apps
SafeLine is a self-hosted Web Application Firewall (WAF) and reverse proxy that defends web apps from SQL injection, XSS, bot abuse, and DDoS using ML-powered threat dete...
