NetBirdy

A self-hosted WireGuard mesh VPN

A fork of NetBird that works with NetBird clients.

Download Compare with NetBird

An independent fork built in the open.

Four devices linked directly to each other A laptop, a phone, a home lab machine and a cloud server each connect straight to the other three. A dashed line from your NetBirdy server to each device shows coordination only. Your server control panel and sign-in Laptop Phone Home lab Cloud server
Device to device, encrypted Coordination only

Setup

One server, one client per machine.

  1. Run the server

    Start the container stack.

  2. Install the client

    Install netbirdy and join with a setup key.

  3. Set access rules

    Choose which groups reach which machines.

What is in the box

Everything NetBird does, plus what the fork adds.

  • Mesh VPN

    Devices talk directly to each other over encrypted WireGuard tunnels. No concentrator in the data path.

  • NAT traversal

    Peers connect through NAT and firewalls without port forwarding. A relay carries traffic when no direct path exists.

  • Sign-in

    Built-in identity service with OIDC connectors: Google, Microsoft Entra, Okta, Zitadel, Keycloak, Authentik, Pocket ID and Quad4 ID.

  • Access rules

    Groups, policies and posture checks decide which peers reach what. Setup keys enroll servers and devices without user accounts.

  • Dashboard

    Web UI for peers, groups, policies and DNS. Dark and light themes, a command palette and built-in help that works offline.

  • SSH and DNS

    Built-in SSH between peers, mesh hostnames and per-domain nameserver groups.

  • Routing

    Subnet routes through routing peers and exit nodes for full-tunnel traffic.

  • Reverse proxy

    An identity-aware proxy in front of your services that slows or blocks scanners and AI crawlers. Supports HTTP/3.

  • Anomaly detection

    Flags new peer locations, failed login bursts and setup key misuse. Can require approval.

  • Audit and SIEM

    JSON audit and security logs, an optional syslog sink and a Wazuh 4.x rule pack.

  • Backups

    Encrypted snapshots of the server database to any S3 bucket, scheduled or on demand.

  • Offline reconnect

    Clients reconnect to peers after a restart while the server is down.

  • Updates

    Releases are signed. The server can cache client updates and update itself with backup and rollback.

  • Sandboxing

    Server and client restrict their own file access with Landlock on Linux.

  • Self-hosted

    One Podman stack with optional Pocket ID and Quad4 ID profiles. Desktop app for Linux, Windows and macOS. No usage reports are sent to NetBird. Crash reports go to the project's own tracker and can be disabled.

NetBirdy and NetBird

Same protocol and clients.

Self-hosted editions, NetBird 0.81.
FeatureNetBirdyNetBird
Usage reports to the projectCrash reports only, can be disabledOn unless disabled
Built-in help in the dashboardYes, works offlineHosted docs site
Reverse proxy shield for scanners and crawlersYesNot included
HTTP/3 on the reverse proxyYesNot included
Sign-in and key anomaly detectionWatch or preventNot included
Clients reconnect while the server is downYes, with limitsNo
Client updates cached on your serverYes, signedNo
Server updates itself with backup and rollbackOptional helperManual
Hosted cloud serviceNoYes
Desktop and phone appsDesktop app, NetBird phone appsYes
Commercial supportCommunity onlyYes

NetBird may add features later. NetBirdy is an independent fork and is not affiliated with the NetBird company.

Install

You need Podman and make.

Start the server

git clone https://github.com/Quad4-Software/netbirdy.git
cd netbirdy
make podman-build
make podman-up
# panel at http://localhost:8080

Your admin email and password are saved in podman/.env.

Connect a device

sudo netbirdy up \
  --management-url http://YOUR-SERVER:8081 \
  --setup-key YOUR-KEY
netbirdy status

Create the key under Setup Keys. Get clients from releases.