{
 "slug": "netbird",
 "name": "NetBird",
 "tagline": "Self-hosted WireGuard mesh VPN with an embedded identity provider",
 "category": "networking",
 "use_cases": [
  "mesh-vpn",
  "wireguard",
  "zero-trust-networking"
 ],
 "aliases": [],
 "status": "live",
 "upstream": {
  "vendor": "NetBird",
  "url": "https://netbird.io",
  "license": "AGPL-3.0",
  "license_url": "https://github.com/netbirdio/netbird/blob/main/combined/LICENSE"
 },
 "image": {
  "os": "Ubuntu 24.04 LTS",
  "cis_level": 1,
  "ports": [
   80,
   443,
   3478
  ],
  "artifacts": [
   "/etc/lynxroute/sbom.json",
   "/etc/lynxroute/cis-report.html",
   "/usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md"
  ]
 },
 "clouds": {
  "aws": {
   "status": "restricted",
   "restricted_on": "2026-08-24"
  },
  "azure": {
   "status": "live",
   "version": "0.80.0",
   "last_build": "2026-10-02",
   "offer_id": "netbird",
   "plan_id": "payg-gen2",
   "image_urn": "lynxroute:netbird:payg-gen2:latest",
   "listing_url": "https://azuremarketplace.microsoft.com/en-us/marketplace/apps/lynxroute.netbird?tab=Overview",
   "recommended_vm_size": "Standard_D2s_v3",
   "price_usd_per_vcpu_hour": 0.028,
   "unit": "vcpu-hour"
  },
  "alicloud": {
   "status": "not_offered"
  }
 },
 "urls": {
  "page": "https://lynxroute.com/products/netbird/",
  "json": "https://lynxroute.com/products/netbird/product.json"
 },
 "release_notes": [
  {
   "version": "0.80.0",
   "title": "NetBird 0.80.0",
   "notes": "* NetBird updated 0.79.0 -> 0.80.0. AGPL-3.0 (server components) unchanged\n* Security: changing a password in the embedded identity provider now revokes its existing sessions, and identity-provider clients refuse HTTP redirects\n* Security: upload URLs are signed and rate limited, and the management service throttles proxy credential attempts\n* Peer connection IPs are now taken from the forwarded client address behind the bundled Nginx proxy, so the dashboard shows each peer's real public address\n* Fixes peers not being notified when a relay connection drops, which could leave stale peer state\n* Everything runs on one instance - management, signal, relay, STUN and an embedded identity provider; no external IdP or SaaS account required\n* Rebuilt on the current CIS Level 1 hardened Ubuntu 24.04 LTS base to pick up the latest Ubuntu security updates\n",
   "source": "backfill-git",
   "live": {
    "azure": "2026-10-02"
   }
  },
  {
   "version": "0.76.3",
   "title": "NetBird 0.76.3 - Initial release (August 2026)",
   "notes": "* NetBird 0.76.3 server with dashboard v2.90.9 on Ubuntu 24.04 LTS\n* Management, signal, relay, STUN and an embedded identity provider on one instance\n* No external identity provider and no SaaS account required\n* Administrator credential generated at first boot, stored as a bcrypt hash\n* TLS certificate issued at first boot for the instance address so peers can validate it\n* Dashboard, REST API, gRPC and relay behind an nginx TLS perimeter on 443\n* Container ports bound to the instance, never exposed\n* Peers, groups and policies in a local SQLite datastore on the persistent volume\n* Anonymous telemetry disabled by default\n* CIS Level 1 hardening applied (ansible-lockdown/UBUNTU24-CIS)\n* CVE-scanned before every release\n* certbot pre-installed for CA-signed TLS certificates\n* UFW firewall pre-configured (ports 22, 80, 443 and UDP 3478 only)\n* fail2ban, auditd, AppArmor pre-configured\n* SBOM (CycloneDX 1.6) at /etc/lynxroute/sbom.json\n* CIS Conformance Report (OpenSCAP) at /etc/lynxroute/cis-report.html\n* Written source offer for the AGPL-3.0 components at /usr/share/doc/lynxroute/LICENSES.txt\n* IMDSv2 enforced\n",
   "source": "backfill-aws-listing",
   "live": {
    "azure": "2026-08-17"
   }
  }
 ],
 "release_history": [
  {
   "version": "0.80.0",
   "azure": "2026-10-02"
  },
  {
   "version": "0.79.0",
   "azure": "2026-09-21"
  },
  {
   "version": "0.78.2",
   "azure": "2026-09-16"
  },
  {
   "version": "0.78.1",
   "azure": "2026-09-06"
  },
  {
   "version": "0.77.0",
   "azure": "2026-08-19"
  },
  {
   "version": "0.76.3",
   "azure": "2026-08-17"
  }
 ],
 "deploy": {
  "azure_cli": "# accept the plan terms once, then:\naz vm image terms accept --publisher lynxroute --offer netbird --plan payg-gen2\naz vm create -g my-rg -n netbird --size Standard_D2s_v3 \\\n  --image lynxroute:netbird:payg-gen2:latest --admin-username azureuser --generate-ssh-keys"
 },
 "description": {
  "what_is": "NetBird is an open-source overlay network that connects your machines into a private WireGuard mesh. Peers discover each other and build encrypted point-to-point tunnels wherever the network allows it, falling back to a relay when it does not, so laptops, servers, containers and cloud VMs reach each other by a stable private address regardless of NAT, firewalls or which network they are on. Access is governed centrally by groups and policies rather than by per-host firewall rules.\n\nThis image runs the complete NetBird control plane on a single instance: the management service, the signal service, the relay, a STUN server and an EMBEDDED identity provider, all from one upstream binary. There is no external identity provider to register, no SaaS account, and no separate coturn container to operate. The server components are AGPL-3.0 and fully auditable; the corresponding source is offered in writing inside the image.\n\nWHY SELF-HOST\n\nRunning the control plane yourself means the map of your network - every machine, user, group and access policy - stays inside your own account. Peer traffic is end-to-end encrypted by WireGuard and never traverses a third party. Self-hosting suits teams with data residency requirements, organisations under GDPR, HIPAA or ISO 27001, and anyone who would rather not price a VPN per user per month.",
  "image_adds": "Complete control plane, no external dependencies:\n* Embedded identity provider - create the first administrator and invite users directly, with no third-party IdP to configure\n* Management, signal, relay and STUN all served from this instance, multiplexed behind one TLS port\n* Peers, groups and policies in a local SQLite datastore on the persistent volume; PostgreSQL and MySQL supported for larger deployments\n\nSecurity hardening:\n* nginx TLS perimeter - dashboard, REST API, gRPC and relay all reached through port 443; the container ports stay bound to the instance\n* No baked administrator password - the credential is generated at first boot into /root/netbird-credentials.txt (mode 600) and stored as a bcrypt hash\n* The TLS certificate is issued at first boot for this instance's address, so peers can validate it immediately; certbot is pre-installed to swap in a CA-signed certificate\n* Anonymous telemetry disabled by default\n* UFW firewall pre-configured (only ports 22, 80, 443 and UDP 3478 open)\n* CVE scan - every image is scanned for vulnerabilities before release\n\nOS hardening (CIS Level 1):\n* CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown\n* auditd, fail2ban, AppArmor, SSH key-only, kernel hardening, IMDSv2 enforced\n\nCompliance artifacts:\n* SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json\n* CIS Conformance Report at /etc/lynxroute/cis-report.html\n* CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md\n* Licences and written source offer at /usr/share/doc/lynxroute/LICENSES.txt"
 },
 "generated_at": "2026-10-31T09:36:34Z"
}