netbird

NetBird : une application Open Source pour simplifier la création de réseaux privés sécurisés en combinant VPN WireGuard, connexions en P2P et gestion centralisée des accès 👉 netbirdio/netbird t.co

NetBird : une application Open Source pour simplifier la création de réseaux privés sécurisés en combinant VPN WireGuard, connexions en P2P et gestion centralisée des accès 👉 netbirdio/netbird

netbirdio/netbird Bit more than the basics, but not as much as tailscale.

We reviewed NetBird's SSH server after Tailworm: one smaller issue found, fixed in v0.81.5 Hey folks, You may have seen the recent Tailworm research on Tailscale SSH. We went through NetBird's embedded SSH server with the same eye. The unix socket forwarding issues from that report don't apply to us, since we don't support that kind of forwarding. We did find a smaller problem in how our server handled some malformed or oversized session requests: a peer allowed to reach the SSH server could crash the NetBird daemon or tie up the session. This is fixed in v0.81.5: github.com/netbirdio/netbird/releases/tag/v0.81.5 Only peers with the NetBird SSH server enabled are affected, and only from peers that an access policy allows to reach SSH on them. When SSH JWT auth is on, only authenticated users can reach this code. If you run the SSH server, we recommend updating your client to avoid such issues.

NetBird: 12,226 title matches, 3 application matches, 1,234 certificate hits NetBird: 12,226 title matches, 3 application matches, 1,234 certificate hits Overlay networks are the modern answer to remote access: instead of publishing services, you join machines to a private mesh and let the mesh handle addressing and policy. NetBird is an open-source option in that category, combining WireGuard tunnels with an identity-aware control plane. Measuring it online produces three numbers that disagree with each other, and the disagreement describes the architecture. The counts ZoomEye queries on 23 October 2026, sub_type=all, page size one: - title="NetBird": 12,226 - app="NetBird": 3 - title="NetBird" && port="443": 3,292 - title="NetBird" && ssl="netbird": 1,234 Twelve thousand title matches against three application fingerprint matches is a large ratio. It is also a predictable one for a product whose self-hosted deployment is a web dashboard in front of an API, where the distinctive evidence lives in the certificate and the page rather than in a protocol banner. Three interfaces, three exposure profiles A self-hosted NetBird deployment has distinguishable parts, and the counts map onto them unevenly. The management dashboard is the part humans log into. It is a web application, it presents a title and a TLS certificate, and it is the component most likely to be published through a reverse proxy on 443. That accounts for the 3,292 figure. The management API is what agents and clients talk to. It is often exposed on the same hostname, sometimes on a separate port or path. It authenticates peers and distributes configuration, which makes it a control plane with credentials. The signal and relay components carry peer traffic. They are infrastructure, they do not normally need a browser-facing title, and they are the part an organisation is most likely to leave in a cloud network without a public listener. What a certificate count tells you The ssl="netbird" figure of 1,234 is not a subset relationship with the title count; the two measure different artefacts. A certificate in the TLS handshake is text the organisation chose, and choosing a certificate that names the product is a small disclosure with an outsized effect on reconnaissance. That disclosure is not a vulnerability. It is a naming decision that lets anyone confirm what runs at an address, and it survives the login page that otherwise hides the product. Why the control plane is the asset The interesting component in any overlay network is the one that decides who joins and what they may reach. For NetBird, that is the management service: it holds peer registrations, access policies and the keys that authenticate members of the mesh. An unauthorised party who can reach that service has a target that a public dashboard does not offer. They see the enrolment endpoint and can attempt to obtain membership, and from inside the mesh the network looks flat in a way that its topology is designed to provide. This is the point where an overlay network differs from a VPN concentrator. The concentrator's public surface is a single gateway with a login. The overlay's public surface includes the enrolment path that every endpoint uses, and that path has to be reachable by endpoints wherever they are. The practical reading A title population of this size suggests the deployment patterns are worth standardising. The fingerprint count is not a contradiction; it is a reminder that fingerprints are one instrument among several. For an operator, the useful questions sit inside the estate. - Which of the three components are reachable from outside the private network, and does the dashboard require identity provider authentication rather than a local account. - Is the enrolment endpoint restricted to expected sources, and is there a record of every peer that joined. - Are certificates issued with names that describe the organisation rather than the software. A generic certificate reduces the reconnaissance value of the exposure at no functional cost. - Does the mesh policy separate administrators from regular peers. An overlay that gives every member reach to every other member is a flat network with extra steps. Detection notes Peer enrolment is the signal to watch. A new peer joined from an unexpected address, or with a name that does not follow the naming convention, is a discrete event with a timestamp, and it is the moment to decide whether it belongs. Authentication events on the dashboard form the second record. Because the dashboard is the human interface, its logon history is short and unusually readable compared with the traffic logs of the overlay itself. Measurement note The counts here describe different things: a page title, a protocol fingerprint, and a certificate string. Presenting them as a single "number of NetBird instances" would be wrong in a way that matters, because the first includes documentation mirrors and demos, and the second is limited by what the index recognises. Each answers its own question, and the questions were the point. References - NetBird documentation: docs.netbird.io - NetBird source repository: netbirdio/netbird - ZoomEye queries executed 23 October 2026 with sub_type=all: title="NetBird" 12,226; app="NetBird" 3; title="NetBird" && port="443" 3,292; title="NetBird" && ssl="netbird" 1,234

出门想访问家里的电脑或服务器？🌐 NetBird 用 WireGuard 组建私有设备网络，支持访问控制和远程连接。适合多设备协作。🔐 netbirdio/netbird #RemoteAccess #浇朋友 #蓝朋友 #互关 #fo

写了个仓库把自己的Agent开发环境版本化（boman-ng/skills%EF%BC%89%EF%BC%8C%E6%8A%8A%E7%94%A8%E9%A1%BA%E6%89%8B%E7%9A%84%E5%B7%A5%E4%BD%9C%E6%B5%81%E5%9C%A8%E5%87%A0%E5%8F%B0Server%E4%B8%8A%E8%BF%81%E7%A7%BB%E5%92%8C%E5%90%8C%E6%AD%A5%E3%80%82%E4%B8%8D%E8%BF%87%E5%8D%B3%E4%BD%BF%E8%BF%99%E6%A0%B7%E8%BF%98%E6%98%AF%E6%84%9F%E8%A7%89%E4%B8%8D%E6%96%B9%E4%BE%BF%E3%80%82 想到一个事，既然我的所有Client和Server都安装了netbird组网，那是不是可以选择一台稳定的机器作为唯一的Agent开发环境作为中枢，仅在单节点上部署Agent，让这个Agent直接进入其它机器的工作区完成工作就好。 看到Codex官方也内置了Tailscale插件，调研了一下发现netbird其实也没掉队，github.com/netbirdio/netbird/tree/main/agent-netw… 。 准备开始折腾。 （相比起Tailscale，我只是单纯喜欢netbird的控制面板）

We're building an AI assistant into NetBird and want feedback before we go further Hey all, Brandon from NetBird here. Alongside the 1.0 work, we've been building the NetBird Assistant. It lives in the dashboard and can troubleshoot connectivity, draft policy and DNS changes, set up Agent Network access, and answer questions from the docs. Here's a short demo: youtu.be Since these questions always come up: it's read-only, so it drafts changes in the Control Center and nothing applies until you review and deploy them. IPs, emails, and other sensitive data get redacted before anything reaches the model. For self-hosted, the plan is a separate optional container you can skip entirely. But we still have some TBD items: - deployment model for self-hosted - licensing for the assistant - AI provider in cloud It's early, and we're sharing it now while there's still room to change things. Would you use something like this? What would you want it to do? Would you rather hook NetBird up to your own agents through MCP or something similar, or have both? If you think it's a bad idea, I'd like to hear that too. There's also a GitHub discussion if you'd rather comment there: netbird#8208

My Grok Bot's computer got an upgrade! It runs NetBird on it and can connect to my internal @metabase 🤯 netbirdio/netbird t.co

Here's the full breakdown by Brandon: netbird.io Watch the video here: youtube.com All the flags are in the docs: docs.netbird.io And drop us a star on GitHub: netbirdio/netbird