Catalog / Networking & remote access

NetBird

Self-hosted WireGuard mesh VPN with an embedded identity provider

CIS Level 1 hardened Ubuntu 24.04 LTS image by Lynxroute · unique credentials at first boot · CVE-scanned · SBOM and CIS report inside

Azure Marketplace0.80.0↗
Availability and pricing
CloudVersionSoftware priceLast build
Azure Marketplace
VM image · plan payg-gen2 · Gen2
0.80.0$0.028/vCPU/hr
Recommended VM: Standard_D2s_v3
2026-10-02Listing ↗

Software price only; cloud infrastructure is billed separately by the provider. Prices in USD.

Image facts
Base OSUbuntu 24.04 LTS
HardeningCIS Level 1, Ubuntu 24.04 LTS (tailored)
LicenseAGPL-3.0
UpstreamNetBird
Machine-readableproduct.json · catalog.json
What is NetBird

NetBird is an open-source overlay network that connects your machines into a private WireGuard mesh. Peers discover each other and build encrypted point-to-point tunnels wherever the network allows it, falling back to a relay when it does not, so laptops, servers, containers and cloud VMs reach each other by a stable private address regardless of NAT, firewalls or which network they are on. Access is governed centrally by groups and policies rather than by per-host firewall rules.

This image runs the complete NetBird control plane on a single instance: the management service, the signal service, the relay, a STUN server and an EMBEDDED identity provider, all from one upstream binary. There is no external identity provider to register, no SaaS account, and no separate coturn container to operate. The server components are AGPL-3.0 and fully auditable; the corresponding source is offered in writing inside the image.

WHY SELF-HOST

Running the control plane yourself means the map of your network - every machine, user, group and access policy - stays inside your own account. Peer traffic is end-to-end encrypted by WireGuard and never traverses a third party. Self-hosting suits teams with data residency requirements, organisations under GDPR, HIPAA or ISO 27001, and anyone who would rather not price a VPN per user per month.

What the Lynxroute image adds

Complete control plane, no external dependencies:

  • Embedded identity provider - create the first administrator and invite users directly, with no third-party IdP to configure
  • Management, signal, relay and STUN all served from this instance, multiplexed behind one TLS port
  • Peers, groups and policies in a local SQLite datastore on the persistent volume; PostgreSQL and MySQL supported for larger deployments

Security hardening:

  • nginx TLS perimeter - dashboard, REST API, gRPC and relay all reached through port 443; the container ports stay bound to the instance
  • No baked administrator password - the credential is generated at first boot into /root/netbird-credentials.txt (mode 600) and stored as a bcrypt hash
  • The TLS certificate is issued at first boot for this instance's address, so peers can validate it immediately; certbot is pre-installed to swap in a CA-signed certificate
  • Anonymous telemetry disabled by default
  • UFW firewall pre-configured (only ports 22, 80, 443 and UDP 3478 open)
  • CVE scan - every image is scanned for vulnerabilities before release

OS hardening (CIS Level 1):

  • CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown
  • auditd, fail2ban, AppArmor, SSH key-only, kernel hardening, IMDSv2 enforced

Compliance artifacts:

  • SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json
  • CIS Conformance Report at /etc/lynxroute/cis-report.html
  • CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md
  • Licences and written source offer at /usr/share/doc/lynxroute/LICENSES.txt
Deploy

Launch in one command

Credentials are generated at first boot and written to /root/netbird-credentials.txt.

# accept the plan terms once, then:
az vm image terms accept --publisher lynxroute --offer netbird --plan payg-gen2
az vm create -g my-rg -n netbird --size Standard_D2s_v3 \
  --image lynxroute:netbird:payg-gen2:latest --admin-username azureuser --generate-ssh-keys
Release notes

Latest release

The most recent release with notes; the full release history is in product.json.

NetBird 0.80.0

Azure · 2026-10-02
  • NetBird updated 0.79.0 -> 0.80.0. AGPL-3.0 (server components) unchanged
  • Security: changing a password in the embedded identity provider now revokes its existing sessions, and identity-provider clients refuse HTTP redirects
  • Security: upload URLs are signed and rate limited, and the management service throttles proxy credential attempts
  • Peer connection IPs are now taken from the forwarded client address behind the bundled Nginx proxy, so the dashboard shows each peer's real public address
  • Fixes peers not being notified when a relay connection drops, which could leave stale peer state
  • Everything runs on one instance - management, signal, relay, STUN and an embedded identity provider; no external IdP or SaaS account required
  • Rebuilt on the current CIS Level 1 hardened Ubuntu 24.04 LTS base to pick up the latest Ubuntu security updates