NetBird is an open-source zero trust networking platform that connects people, machines and AI agents across any network. It lets organisations, and home users, build private networks with near-zero configuration, without opening ports, writing complex firewall rules or running VPN gateways.
The problem it addresses is that traditional remote access concentrates risk and effort in exposed gateways, while teams increasingly need servers, laptops and automated workloads in different places to reach each other securely.
At A Glance
| Vendor | NetBird |
|---|---|
| Category | Zero trust network access, open-source WireGuard overlay networking |
| Identities covered | Human users through SSO, devices and machines (peers) |
| Deployment | NetBird Cloud or self-hosted |
| Certifications | GDPR, ISO 27001, DORA |
| Customers | Sport Alliance, netgo, Signicat, VIEW Group, Zerodha |
| Market classification | Workforce IAM |
What NetBird Does
Traditional VPNs send traffic through a central gateway that has to be sized, exposed and maintained. NetBird has no central VPN server. Devices connect directly to each other over WireGuard, and a management service holds network state and pushes configuration to the client on each machine.
Access control policies decide which peers or groups may connect, over which protocols and ports, and optionally only when posture checks pass. People authenticate through an identity provider, while servers and other machines can be enrolled in bulk with setup keys.
Products
NetBird Cloud
NetBird Cloud is for teams that want the network without running its infrastructure. Customers install the client and log in; highly available Management servers and geo-distributed relays, which clients pick automatically, are run for them. MSP functionality, for providers managing networks on behalf of clients, is available only in the cloud.
Self-Hosted NetBird
Organisations that need to keep every component in house can self-host, installing and maintaining all parts including their own relay servers. Built-in local users mean a self-hosted network does not need a separate identity provider. Users and groups provisioning (including SCIM), traffic events logging, event streaming, EDR integrations and peer approval are also available for self-hosted deployments.
Open-Source Project
The open-source project gives engineers the full networking toolkit:
- Kernel WireGuard, peer-to-peer connections with relay fallback, network routes, DNS routes, exit nodes and IPv6 dual-stack
- Browser-based SSH and RDP, and a reverse proxy with automatic TLS
- Group-based access rules, activity and traffic logging, central SSH access policies and device posture checks
- Post-quantum resistance through Rosenpass, and periodic re-authentication
How It Works
Four components make up a network. Peers exchange connection details through the Signal service and then build a direct WireGuard tunnel; if that fails, the Relay carries the traffic.
| Component | What it does |
|---|---|
| Management service | The central coordination component, with a UI dashboard. It stores network state and peers’ public WireGuard keys, authenticates peers and distributes network changes. |
| Client agent | Installed on each machine, it generates the device’s WireGuard keys, registers the device and applies access rules and DNS settings. The private key never leaves the machine. |
| Signal service | Brokers the initial handshake so peers can swap connection candidates. It stores no data and no traffic passes through it. |
| Relay service | Forwards traffic when a direct connection is impossible. The relay is WebSocket-based. |
Each peer gets a unique private IP address. Without policies the network denies all traffic; policies can be bidirectional and support port ranges.
Identities And Systems Covered
| Human users | Sign in through an identity provider or built-in local users, with SSO and MFA |
|---|---|
| Devices and machines | Servers, laptops, phones and other peers, enrolled by user login or setup keys |
| Groups | Peers can belong to several groups, used as policy sources and destinations, with IdP group sync |
| Platforms | Linux, macOS, Windows, Android, iOS, FreeBSD, pfSense, OPNsense, MikroTik RouterOS, OpenWRT, Synology, TrueNAS, Proxmox, Raspberry Pi and containers |
Integrations
| Area | Integrations |
|---|---|
| Identity providers | Google Workspace, Microsoft Entra ID, Okta |
| OIDC providers | Authentik, Keycloak, JumpCloud, Auth0, Duo Security, Zitadel, cidaas, AWS Cognito, Zoho, IIJ ID |
| Social logins | GitHub and other social accounts |
| Endpoint security | EDR integrations such as CrowdStrike |
| Automation | Terraform provider, Ansible collection |
Company Background
| Founded | Launched on GitHub in 2021 by Misha Bragin and Maycon Santos |
|---|---|
| Headquarters | Berlin, Germany |
| Funding | €4 million seed round (2024) co-led by InReach Ventures and Nauta with Antler; $10 million Series A (2026) led by Pace Capital with Nauta Capital, InReach Ventures and Antler |
| Scale | By the seed round, hundreds of thousands of users and devices connected |
Note: This overview is compiled from NetBird’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.