NetBird

Last reviewed Aug 26, 2026 · 788 words

Choose NetBird when you want the Tailscale experience with the control plane on your own hardware and you are not willing to give up single sign-on to get it. That is the gap it fills precisely: Tailscale's coordination server is theirs, Headscale is yours but has no first-class SSO or admin UI, and NetBird is yours with both. The price is a self-host that is 5 services plus an identity provider, and a project 2 years younger than the one it is measured against.

The three-way decision in one table

The client point matters more than it looks. Headscale reuses Tailscale's excellent clients and simply replaces the server; NetBird ships its own clients for Linux, macOS, Windows, iOS and Android, which are good and improving but younger. Both build on WireGuard, so throughput and latency are equivalent once a direct path is established.

The self-host is five services and an identity provider

The management server holds peers, groups and policies; the signal server brokers connection setup; a relay carries traffic when NAT traversal fails; coturn provides STUN and TURN; and the dashboard is the web UI. On top, NetBird requires an OIDC identity provider, because every user login goes through one. The official quickstart script pulls all of this together with Zitadel as the bundled IdP and a Caddy in front, and it works, but understand that "install NetBird" means "run an IdP" from day one. If you already have Authentik, point NetBird at it and skip the bundled one; the docs have a per-provider page.

Expose 443 TCP for the dashboard, API and signal traffic, 3478 UDP for STUN and TURN, and the relay's UDP port range. Get a real DNS name and certificate before the first client, because the management URL is baked into every enrolled device.

Most traffic never touches the relay

Peers exchange candidates through the signal server and then connect directly over WireGuard through NAT hole-punching, which works on the majority of home and office networks. The relay is the fallback for hostile NATs and corporate firewalls. Check where a peer landed with netbird status -d; a "Relayed" line means every byte between those two machines is transiting your server, which is fine for SSH and painful for a 40 GB backup. Enrolment itself is one command:

netbird up --management-url https://nb.example.com --setup-key <key>

Setup keys come from the dashboard, can be one-off or reusable, and drop the new peer into groups, which is how a headless server joins without a browser login.

Policies and posture are where it pulls ahead of Headscale

Access rules are group-to-group with protocol and port, edited in the UI and applied within seconds. You can add posture checks (OS version, NetBird version, geolocation) to a policy, route a subnet through a peer, and hand out DNS names, all from the same screen. Headscale can express most of the network rules in its ACL file, but the "which contractor sees which server" lifecycle is where NetBird's admin UI and SSO earn the extra containers.

The young-project tax

NetBird started in 2021 and moves fast. The self-host compose has changed shape between releases, defaults have moved, and the upgrade notes are required reading rather than optional. Back up the management store (SQLite by default, Postgres optional) before each update, and keep the IdP's data with it, because peers are bound to user identities. It is not fragile, but it does reward reading the changelog in a way that Tailscale's cloud never asks of you.

What I'd do

Fewer than 20 devices, one user, no SSO needs: Headscale, with a clear conscience. A family or small team that wants login by Google or an existing Authentik, self-hosted, with an admin page a non-expert can read: NetBird, on a 1 GB VPS with a real domain, Authentik as the IdP, and a calendar reminder to read release notes monthly. Happy to let a vendor hold the control plane: plain Tailscale and go home early. The wider remote access category has the VPN-shaped alternatives if a mesh is more than you need.