Netbird
App in the BluixApps catalog
What it is
NetBird is a WireGuard-based mesh VPN with identity — connect devices, servers, and sites securely without managing peer configs manually. Tailscale's open-source alternative, with full self-hosted control over the management plane and identity provider integration.
For teams that need zero-trust network access without committing to a SaaS coordinator.
What it's for
- Site-to-site mesh — connect offices, datacenters, cloud regions
- Remote workforce — secure access for distributed teams
- DevOps — engineers connecting to private servers behind NAT
- Multi-cloud peering — AWS ↔ GCP ↔ Hetzner ↔ home lab
- Compliance — self-hosted control plane for regulated industries
Who it's for
- DevOps teams managing distributed infrastructure
- MSPs / managed service providers offering VPN to clients
- Regulated industries needing on-prem control plane (finance, health)
- Open-source advocates rejecting Tailscale's SaaS-only model
- Hosting providers bundling secure-access offerings
Why teams pick NetBird over alternatives
- BSD-3 licensed — fully open, no commercial gating
- Self-hosted control plane — your management server, your IdP
- WireGuard — modern crypto, kernel-level perf
- Identity-based — peers identified by user/device, not IP
- ACL policies — group-based, fine-grained, declarative
- Active dev — backed by NetBird Inc. (Berlin)
Integrations
- IdP — Zitadel (bundled), Authelia, Authentik, Keycloak, Okta, Azure AD, Google Workspace
- WireGuard — kernel module on Linux; userspace fallback
- Mobile — iOS + Android clients (Apple/Google stores)
- DNS — automatic peer-to-peer hostnames + custom domains
- Routing — declarative routes per peer group
- API — REST API + Terraform provider
Notable users & community
- 13k+ GitHub stars
- Backed by NetBird Inc. with paid managed offering
- Used by mid-size DevOps teams + privacy advocates
- Active Slack + Discord communities
- Berlin/EU-based vendor (GDPR-aligned)
Tips & operations
- IdP setup is the bulk of work — minimal install runs single-account mode for eval
- HTTPS + DNS required for production — reverse proxy + LE cert
- Peer onboarding —
curl install.sh | shthennetbird up --management-url ... - ACL discipline — group peers + grant least-privilege; review quarterly
- Backup — postgres or config files (depending on backend)
- NAT traversal — relay servers (TURN-like) for peers behind strict NAT
What we ship in BluixApps
- Docker: Management + Signal services (minimal setup)
- Pinned
netbirdio/management:latest+netbirdio/signal:latest - Port 33073 (HTTP), reverse-proxy + cert needed for production
- Single-account mode bootstrap for evaluation
- Install report with peer onboarding guide
- Documentation pointer to full production setup (Zitadel/Authentik)
- Backup hook covers /etc/netbird config
Get this app — pick a BluixApps plan
Same catalog. Scaling tenant isolation, white-label and support tier.
| Tier | Tenants | Catalog | Support | White-label | Monthly | |
|---|---|---|---|---|---|---|
| Stacks | 1 | 19 curated stacks | Standard | — | $19/mo | DetailDeploy |
| Starter | 10 | Full catalog | Standard | +$15–25/mo | $49/mo | DetailDeploy |
| Pro | 25 | Full catalog | Priority bugfix | +$15–25/mo | $149/mo | DetailDeploy |
| Growth | 100 | Full catalog | Priority bugfix | +$15–25/mo | $349/mo | DetailDeploy |
| Scale | 500 | Full catalog | 7-day window | +$15–25/mo | $799/mo | DetailDeploy |
| Enterprise | Unlimited | Full catalog | Priority 7-day | Bundled | $1,499/mo | DetailDeploy |