NetBird is a Go-based platform that creates secure WireGuard-based overlay networks with centralized access control, enabling organizations and individuals to connect devices into a private mesh network with minimal configuration. The project combines peer-to-peer connectivity with enterprise-grade security features including single sign-on, multi-factor authentication, and granular access controls.
The core functionality centers on automatic peer discovery and configuration, allowing machines to establish encrypted connections without manual firewall or port management. NetBird uses WireGuard as its underlying protocol and implements ICE-based peer-to-peer connection negotiation with STUN server support for candidate discovery. When direct peer-to-peer connections fail due to NAT constraints, the system automatically falls back to relay services to maintain connectivity. The architecture consists of a NetBird agent running on each machine, a centralized Management Service that maintains network state and distributes updates, a Signal Service for encrypted peer negotiation, and a Relay Service for fallback connectivity.
Key connectivity features include kernel WireGuard support, automatic peer discovery, connection relay fallback, routes to external networks, domain-based DNS routing, exit nodes, IPv6 dual-stack overlay support, and quantum-resistance capabilities through Rosenpass integration. The management layer provides an admin web UI, identity provider integrations, private DNS management, custom DNS zones, multiuser support, and multi-account profile switching. Security capabilities encompass SSO and MFA support, access control through groups and rules, activity logging, traffic event logging, device posture checks, peer-to-peer encryption, SSH with central access policies, browser-based SSH and RDP, and periodic re-authentication enforcement.
The platform supports extensive automation through a public API, setup keys for bulk provisioning, a self-hosting quickstart script, IdP groups synchronization with JWT, a Terraform provider, and an Ansible collection. NetBird runs on diverse platforms including Linux, macOS, Windows, Android, Android TV, iOS, Apple TV, FreeBSD, pfSense, OPNsense, MikroTik RouterOS, OpenWRT, Synology, TrueNAS, Proxmox, Raspberry Pi, serverless environments, and containers.
According to GitGenius activity tracking, the repository demonstrates active maintenance with a median issue and pull request response latency of zero hours and a mean latency of 222.4 hours across 2390 tracked items. The most frequently applied issue labels are triage-needed with 1009 occurrences, feature-request with 721, and waiting-feedback with 277. Primary contributors include nazarewk with 2385 tracked events, mlsmaycon with 1543 events, and lixmal with 636 events. The repository shares overlapping contributors with major projects including Microsoft's VSCode and TypeScript repositories as well as the Rust language repository, indicating cross-pollination with significant open-source ecosystems.
NetBird is distributed under the BSD-3 license and maintains active community engagement through Slack channels and a community forum. The project received support through Germany's StartUpSecure program in November 2022, sponsored by the Federal Ministry of Education and Research in partnership with the CISPA Helmholtz Center for Information Security.
