NetBird is a Go-based platform that creates secure WireGuard-based overlay networks with centralized access control, enabling organizations and individuals to connect devices into a private mesh network with minimal configuration. The project combines peer-to-peer connectivity with enterprise-grade security features including single sign-on, multi-factor authentication, and granular access controls.
The core functionality centers on automatic peer discovery and configuration, allowing machines to establish encrypted connections without manual firewall or port management. NetBird uses WireGuard as its underlying protocol and implements ICE-based peer-to-peer connection negotiation with STUN server support for candidate discovery. When direct peer-to-peer connections fail due to NAT constraints, the system automatically falls back to relay services to maintain connectivity. The architecture consists of a NetBird agent running on each machine, a centralized Management Service that maintains network state and distributes updates, a Signal Service for encrypted peer negotiation, and a Relay Service for fallback connectivity.
Key connectivity features include kernel WireGuard support, automatic peer discovery, connection relay fallback, routes to external networks, domain-based DNS routing, exit nodes, IPv6 dual-stack overlay support, and quantum-resistance capabilities through Rosenpass integration. The management layer provides an admin web UI, identity provider integrations, private DNS management, custom DNS zones, multiuser support, and multi-account profile switching. Security capabilities encompass SSO and MFA support, access control through groups and rules, activity logging, traffic event logging, device posture checks, peer-to-peer encryption, SSH with central access policies, browser-based SSH and RDP, and periodic re-authentication enforcement.
The platform supports extensive automation through a public API, setup keys for bulk provisioning, a self-hosting quickstart script, IdP groups synchronization with JWT, a Terraform provider, and an Ansible collection. NetBird runs on diverse platforms including Linux, macOS, Windows, Android, Android TV, iOS, Apple TV, FreeBSD, pfSense, OPNsense, MikroTik RouterOS, OpenWRT, Synology, TrueNAS, Proxmox, Raspberry Pi, serverless environments, and containers.
NetBird is distributed under the BSD-3 license and maintains active community engagement through Slack channels and a community forum. The project received support through Germany's StartUpSecure program in November 2022, sponsored by the Federal Ministry of Education and Research in partnership with the CISPA Helmholtz Center for Information Security.
