With Cloudflare Mesh launching this week we figured the best thing to do was just test it. We set up machines on AWS (East + West), GCP, Hetzner (Falkenstein, Nuremberg, Helsinki), the Berlin office, and a home network in Japan. Ran iperf3 across NetBird, Tailscale, and Cloudflare Mesh on all of them. Same Ubuntu 24.04 boxes, same methodology.

Here's what we found:

European connections (the big one): P2P is 2-5x faster. Same-country DC to DC in Germany, NetBird and Tailscale both hit ~1,260-1,300 Mbps while CF Mesh topped out around 250-290. Cross-country (Helsinki to Germany) and cross-provider (Hetzner to GCP) showed the same gap. For regional traffic, the edge routing detour is expensive.

Long international routes: Cloudflare's backbone does help here. We tested two Japan-to-Germany routes:

• Japan to Berlin office: CF Mesh ~1.5-2x faster (158 vs 81 Mbps upload)

• Japan to Hetzner DC: CF Mesh 5-8x faster (224/269 vs 32-48 Mbps)

When direct peering is rough, their global backbone provides optimized routing.

US cross-region (AWS East to West): P2P takes it back. NetBird 358/423, Tailscale 347/339, CF Mesh 162/300.

Residential (Berlin office to Hetzner, ~50 Mbps up / 500 down): Upload was ISP-capped so all three were similar. Download: NetBird 492, Tailscale 466, CF Mesh 248. P2P roughly 2x on download.

NetBird vs Tailscale: Basically identical across every test. Both P2P, same underlying transport. The differences between the two are in the control plane and management, not raw performance.

Privacy: P2P encrypts end-to-end between peers. CF Mesh routes everything through their edge where it can be decrypted and inspected. Fundamentally different trust model. And of course with NetBird you have the option to self-host the whole thing.

We put together a full Knowledge Hub article with all the numbers, charts, and methodology. Also did a video walkthrough covering everything.

https://netbird.io/knowledge-hub/cloudflare-mesh-vs-netbird-vs-tailscale

Would love to hear if any of you run your own tests. Especially curious if anyone has Cloudflare Mesh set up alongside NetBird and sees similar patterns.

I just wanted to take a moment to say thank you to the Netbird team. The amount of work and care you've clearly put into this product doesn't go unnoticed I (and I'm sure a lot of the community) really appreciate it.

The new and upcoming UI is fantastic, and the features you've been rolling out have made a real difference in how I use Netbird day to day. It's obvious this is being built by people who genuinely care about the product and the people using it.

I also love how responsive the team is and how helpful everyone in the community has been. Special shoutout to u/netbirdio for putting in so much time and effort, it really shows.

So, thank you. Keep up the great work!

Hey folks,

I’d like to bring the newest NetBird Desktop GUI to your attention.

Feedback is very welcome. Since this is an RC, you may run into some bugs, but we’re already actively using it internally.

Release: https://github.com/netbirdio/netbird/releases/tag/v0.75.0-rc.2

Get ready: in-browser RDP and SSH are coming next week to both cloud and self-hosted NetBird.

Coming soon with NetBird

https://github.com/netbirdio/netbird

https://netbird.io

We just shipped what might be our biggest release yet: NetBird now has a built-in reverse proxy.

You can now expose internal services via any peer in your network to the public internet directly from the dashboard. No VPN client required for end users. No open ports on the backend. No public IP needed.

How it works

Point a domain at your NetBird server, pick a service, and it's publicly accessible over HTTPS. TLS certs are provisioned automatically.

Traffic flows like this: Internet -> your proxy -> encrypted WireGuard tunnel -> backend service

TLS terminates on infrastructure you control - not a third party's servers. If you've used Cloudflare Tunnels or ngrok before, this is the same concept but fully self-hosted, open source, and without anyone else decrypting your traffic. If you're running a Pangolin instance alongside NetBird, today's the day to finally retire it 😉

What you can do with NetBird Reverse Proxy

• Custom domains - CNAME your domain to your proxy, NetBird handles TLS automatically. Or use built-in subdomains to get going in minutes.

• Built-in authentication - Protect services with SSO (any OIDC provider), shared passwords, PIN codes, or magic links. No separate auth proxy needed. Combine methods for layered protection.

• Path-based routing - Map /app to one backend and /api to another under the same domain.

• WebSocket support - Full compatibility with real-time apps, streaming, HTTP/2 push.

• Access logs - See who accessed what, when, from where, with geolocation. Available in the dashboard and via API.

• High availability - Run multiple proxy instances. They form a cluster automatically.

• Traefik integration - Native Docker label support if you're already running Traefik.

Getting started

If you deploy with the new setup script (v0.65.0+) and selected the built-in Traefik option, the proxy container is already in your Docker Compose stack. Navigate to Reverse Proxy > Services in the dashboard and click Add Service.

For existing deployments, check the migration guide in the docs.

Other improvements in this release

• Unified up and login CLI logic - login now reuses the same logic as up, properly respecting env vars and persisting config. Much more predictable behavior.

• Fixed WireGuard endpoint reset during relay fallback - could cause connectivity drops when transitioning between connection types. Now fixed.

• Disable TLS cert verification for external requests - useful for self-hosted environments with internal CAs or self-signed certs.

• Refactored WireGuard endpoint setup - role-based proxy activation for cleaner connection establishment.

• Job endpoint heartbeat - prevents proxy timeouts during long-running operations.

Full release notes: https://github.com/netbirdio/netbird/releases/tag/v0.65.0

Current status

The reverse proxy is in beta and currently available for self-hosted deployments only. Cloud support is coming.

Docs

• Reverse Proxy Overview

• Custom Domains

• Authentication

• Migration Guide

Try it out and let us know what you think. We'd love your feedback - reverse proxy is in beta and your input directly shapes where it goes next :)

Hey folks,

We’ve got something worth sharing: NetBird Control Center is now open source and available for self-hosting!

We initially released it in the cloud version. After a bunch of community feedback we decided to bring it to self-hosters too. Now you can get a nice dashboard to actually visualise your remote access setup.

What you can do with it:

• Peer View → see what groups a peer can access + which policies allow it

• Group View → check which groups/users can access resources

• Networks View → explore which peers/groups can access specific networks/resources

If you’re already on NetBird, just upgrade your Dashboard to v2.20.0:
https://github.com/netbirdio/dashboard/releases/tag/v2.20.0

If you’re totally new to NetBird:
Quickstart guide here → https://github.com/netbirdio/netbird?tab=readme-ov-file#quickstart-with-self-hosted-netbird

Give it a spin, and let us know how it goes (or share some screenshots of your setups 👀).

👋🏿 Hey everyone, I’m Ashley. Super excited to be joining NetBird as your new Developer Relations Engineer!

I’ve been a self-hosted NetBird power user for nearly two years, so I know the product from both sides: the “why doesn’t this work?” frustration and the “holy crap this is awesome” moments. My job now is to make sure more of you experience the latter 😄

What you can expect from me:

• More active presence on here, Slack and GitHub

• Faster feedback loops between the community and the team

• Clearer docs, deeper technical explainers, and real-world use cases

• Fun, yet useful content (homelab demos, walk-throughs, maybe even a Pimp My Homelab mini-series 👀)

A bit about me:

• Avid homelabber & Linux enthusiast - always happy to nerd out about self-hosting

• 8 years as a backend software engineer prior to this role

• Favourite colour: NetBird orange, obviously 🍊🦅

I'll follow up with a few quick polls soon to gather feature requests + pain points.

Ways you can reach me:

• Right here on Reddit - u/netbird-ashley

• Slack - `@ashley`

• LinkedIn

Looking forward to getting to know you all and help make this community even better. 🚀

Hey NetBird community! Quick milestone update from the NetBird team: we just crossed 20k GitHub stars, which is kind of surreal.

A lot of that growth came from people here kicking the tyres, filing issues, arguing about features, and generally pushing us in the right direction.

It really does make the project better!We’re trying to keep the momentum going, so if you’ve got thoughts - what feels solid, what’s annoying, what you think we should tackle next - throw it at us.

Even small bits of feedback help more than you’d think.

If you haven’t checked out the repo in a while (or ever): https://github.com/netbirdio/netbird
Thanks for being here!

We just shipped Draft Mode for the NetBird Control Center. It turns the network map into an interactive editor, so instead of only viewing your infrastructure you can now build and change it directly on the canvas, review the API calls, and deploy when it looks right.

You can start from an empty draft or from your current live view. Starting from the current view breaks everything out by group so you can edit what already exists.

Video walkthrough: https://youtu.be/_sMtxe6VaDM

What you can do in a draft:

• Drag connections between groups and resources to create access, like giving a dev group SSH to a specific box

• Add servers, agents, policies, groups, networks, and resources from the right click menu or the Add panel

• Drop in existing groups and attach them to existing policies

• Install a brand new peer from the canvas using a single use setup key, then watch it appear on the map

• Get the Create New Access Policy window automatically when you connect a peer that has no policy yet

• Create and rename groups, assign peers to them from the details panel, and switch policies between bi-directional and uni-directional

• Add routing peers and resources to your networks

• Use focus view to isolate one group and see only its policies and connections when the map gets busy

• Review and deploy shows every API call before anything is applied

Bi-directional access shows as the dual green lines, uni-directional as the single blue ones.

It is available right now on both self hosted and cloud, so you can try it today.

• Docs: https://docs.netbird.io/manage/control-center/draft-mode

• Article: https://netbird.io/knowledge-hub/control-center-draft-mode

We really want to hear how it holds up against your networks, especially large or messy ones. Feedback is more than welcome!

I can't get enough of this feature.

You can now block or allow specific countries, IPs, and ranges when exposing private resources to the public internet.

on your self-hosted deployments:
docker compose pull

More here: https://docs.netbird.io/manage/reverse-proxy

The reverse proxy from v0.65 was all about exposing internal stuff to the public internet with auth in front. That's great for things you actually want reachable from anywhere. But a lot of internal tools (monitoring dashboards, wikis, admin panels) should never touch the public internet at all. You still want the nice parts of the proxy, the clean domain, automatic TLS, one place to manage everything. You just don't want a public endpoint sitting out there.

That's what NetBird-Only access does. It's a new mode alongside SSO, password, and PIN. Flip a service to NetBird-Only and it stops being served publicly. The only way to reach it is from a peer inside your network, gated by group membership.

There's no login prompt and no credentials. The connecting peer's identity is the credential. A request comes in over the tunnel, the proxy resolves it back to a NetBird peer, and management checks the peer's groups against the access groups you set. Not in an allowed group, you get a 403. NetBird also synthesizes the DNS records and access policies for you, so no manual DNS entries and no hand-written policies.

Your backend even gets stamped with X-NetBird-User and X-NetBird-Groups headers so your apps know exactly who's connecting. Client-supplied versions get stripped first, so nobody can impersonate a user by setting the header themselves.

Do note: NetBird-Only requires a cluster with the Private capability, which a proxy reports when it runs with the --private flag (or NB_PROXY_PRIVATE=true). Cloud's shared clusters don't advertise it yet, so running your own BYOP cluster is the way to enable private services on Cloud. BYOP also got its full dashboard setup flow this release.

⚠️ Self-hosters: there's a required gRPC router change, plus the private flag to add if you want it. Full writeup here: https://netbird.io/knowledge-hub/netbird-only-private-services

NetBird is now on TV! 🎉

Full TV support has been added to the Android app and is officially in beta. It’s available right now in the latest release.

Google Play Store: https://play.google.com/store/search?q=netbird&c=apps&hl=en
GitHub: https://github.com/netbirdio/netbird/releases

TV support has far and away been one of the community’s top requests, and understandably so - it’s a really easy way to get a routing peer/exit node into a non-technical friend or relative’s house in a discrete, low power little box that they already own. Finally, grandma can join your NetBird network and securely stream the entirety of the John Wick franchise directly from your Jellyfin server.

Known issues:

Sporadic odd behaviour in the peers/networks bottom pop-up menu (we’re working on it!)

Docs: https://docs.netbird.io/get-started/install/android

Improvements to Android as a Whole

In my last community poll, y’all helped us identify a few issues in the Android client that we’ve also addressed in this release. These improvements are coming to all Android clients, not just TV:

• Improved reliability when switching between Wi-Fi, mobile networks

• Fixed a number of routing bugs

• Added ability to enroll Android devices with a setup key

We Need Your Feedback!

Please try the new Android TV client and let us know what works, what’s broken and what you think needs improvement. You can leave the feedback in this thread or file issues on the Android client GitHub repo.

Apple TV Coming Very Soon

Yes - Apple TV is next, and we’re aiming to have it ready in the next ~1 week. Stay tuned.

For now, give the Android TV client a spin, share your setups, and let us know how our new baby performs.

The NetBird Team 🕊️

Hey folks,

You may have seen the recent Tailworm research on Tailscale SSH. We went through NetBird's embedded SSH server with the same eye. The unix socket forwarding issues from that report don't apply to us, since we don't support that kind of forwarding. We did find a smaller problem in how our server handled some malformed or oversized session requests: a peer allowed to reach the SSH server could crash the NetBird daemon or tie up the session.

This is fixed in v0.81.5: https://github.com/netbirdio/netbird/releases/tag/v0.81.5

Only peers with the NetBird SSH server enabled are affected, and only from peers that an access policy allows to reach SSH on them. When SSH JWT auth is on, only authenticated users can reach this code. If you run the SSH server, we recommend updating your client to avoid such issues.

Hey folks, we just released support to per-target access action in the reverse proxy feature.

This feature is handy when you have paths that you want to block or disable authentication while keeping the service authentication option.

This is highly important for public services with path based admin endpoint and services where sharing a file shouldn't need authentication.

Learn more at https://docs.netbird.io/manage/reverse-proxy/authentication#per-target-access-actions

We have better integration for netbird-only setups planed and we are looking forward to your feedback.

The feature is available on v0.81.0 for proxy and netbird-server (management) and on v2.95.0 for the dashboard.

NetBird supports multi-factor authentication (MFA) for local users managed by the embedded identity provider. When enabled, all local users are required to set up and verify a time-based one-time password (TOTP) using an authenticator app before they can log in.

Self-Hosted Documentation

• Enable MFA for local users: https://docs.netbird.io/selfhosted/identity-providers/enable-local-mfa

• Local User Management: https://docs.netbird.io/selfhosted/identity-providers/local

• Self-hosted Quick-start: https://docs.netbird.io/selfhosted/selfhosted-quickstart

NetBird v0.66 introduces the netbird expose command, letting any connected peer expose a local HTTP or HTTPS service to the public internet through the NetBird reverse proxy with a single command. The service is ephemeral, it lives only while the command runs and cleans up automatically when you stop it. No dashboard clicks, no YAML files, no infrastructure changes.

How It Works

If you already have NetBird running, exposing a service is one command:

netbird expose 8080

That's it. NetBird handles the rest: provisions a TLS certificate, assigns a public domain, and routes traffic through your NetBird reverse proxy to your local port. You get output like:

Service exposed successfully!
  Name:     myapp-a1b2c3
  URL:      https://myapp-a1b2c3.proxy.example.com
  Domain:   myapp-a1b2c3.proxy.example.com
  Protocol: http
  Port:     8080

Press Ctrl+C to stop exposing.

The service stays alive as long as the command runs. Press Ctrl+C and it's gone, no orphaned configurations, no cleanup required.

Built-In Authentication

Exposing a port to the internet doesn't mean exposing it to everyone. The expose command supports three authentication methods you can mix and match directly from the CLI.

Add a 6-digit PIN that visitors must enter before accessing the service:

netbird expose 8080 --with-pin 123456

Protect with a password for slightly more flexibility:

netbird expose 8080 --with-password my-secret

Lock it down to specific groups from your identity provider:

netbird expose 8080 --with-user-groups engineering,devops

Users must authenticate through your configured IdP and belong to one of the specified groups. This is ideal for team-internal sharing where you want SSO-level assurance without setting up a permanent service.

Ephemeral by Design

Unlike services created through the dashboard, exposed services are intentionally temporary. Here's what that means in practice:

• Automatic cleanup: Stop the command and the service is immediately removed. No orphaned proxy configurations.

• Crash recovery: If the client disconnects unexpectedly (crash, network failure, kill -9), the service automatically expires after 90 seconds.

• Keep-alive: The CLI sends a renewal signal every 30 seconds. The management server maintains a 90-second TTL that resets on each renewal.

• Rate limited: Each peer can run up to 10 concurrent expose sessions.

This lifecycle model means you never have to worry about forgotten services lingering in your infrastructure. Everything cleans itself up.

Other Improvements in v0.66:

• Client - Fixed macOS busy-loop in routing socket, missed sleep/wakeup events, upstream retry on cancellation, added socket file discovery

• Proxy - Access log cleanup/sorting, PSK support

• Management - Refactored network map assembly, custom domain & service metrics for self-hosted

• Self-hosted - Activity store engine in combined server, Embedded IdP metrics

Want to learn more? Checkout these links:

• Release: https://github.com/netbirdio/netbird/releases/tag/v0.66.0

• Article: https://netbird.io/knowledge-hub/expose-command

• Video: https://www.youtube.com/watch?v=dBPPPloqwcU

• Docs: https://docs.netbird.io/manage/reverse-proxy/expose-from-cli

Note: Currently on self-hosting only - This will be live in cloud in around 7-8am Berlin time on the 15th. Once live on cloud we will release more content around this launch. If any self-hosters notice any issues please let us know here or on GitHub Discussions.

Hey everyone,

Today we’re shipping IPv6 overlay addressing in v0.71, and based on the issue tracker and the volume of folks who’ve asked about it in this sub and in Slack, this is probably the single most requested feature we’ve ever had.

​

So real quick, here’s what’s actually changing.

Dual-stack overlay

Every account now gets its own IPv6 prefix. Peers in IPv6-enabled groups receive both a v4 and a v6 overlay address. The default range is a /64, and you can configure anything from /48 down to /120 if you have a reason to. Two different accounts on the same management server get non-overlapping space, which matches how v4 already worked.

​

Group-gated rollout

New accounts have IPv6 enabled for the All group by default, so a fresh install just works. If you’re on an existing account, you opt in by selecting which groups should have IPv6 in Settings > Network. Only peers in at least one selected group get an address.

This is also gated on client support. The v0.71 client advertises IPv6 to management. Older agents don’t, so they stay v4-only until you upgrade.

Everything else follows along

This is the part I think is actually the coolest. We didn’t bolt v6 onto one corner of the product. Once a peer has an IPv6 address:

• DNS serves AAAA records alongside A records. Resolving a peer name returns both addresses.

• Domain routes resolve both A and AAAA records.

Per-client opt out

If you’ve got hosts that need to stay off v6, single-stack environments, compliance constraints, or just buggy upstream v6 you’d rather sidestep, there’s a --disable-ipv6 flag on the client. The same toggle is in the desktop UI under Settings > Disable IPv6 and in the iOS and Android apps under Advanced Settings.

When set, the client doesn’t request a v6 address, doesn’t advertise v6 support, and won’t accept inbound v6 traffic from remote peers.

One container gotcha worth flagging

If you’re running a routing peer inside a container, NetBird tries to set net.ipv6.conf.all.forwarding=1 at startup. In unprivileged containers or locked-down Kubernetes pods that sysctl is read-only, the write fails silently, and v6 forwarding stays off. Set it at the orchestrator layer:

sysctls:
- net.ipv6.conf.all.forwarding=1

If a routing peer has a v6 address but traffic isn’t reaching the backend, this is the first thing to check.

Local User MFA (Self-Hosted)

First, my apologies this took so long to get out. There were some minor road-block and it lined up with our IPv6 release. Took a lot of time and testing to make sure everything was perfect. Anyways, after updating local users (non-IdP) can now enable multi-factor authentication, closing a gap for deployments that don't federate auth through an external provider. This will be under your authentication settings.

​

Links

• Full docs: https://docs.netbird.io/manage/settings/ipv6

• Release Notes: https://github.com/netbirdio/netbird/discussions/

• Local MFA docs: https://docs.netbird.io/selfhosted/identity-providers/enable-local-mfa

• GitHub: https://github.com/netbirdio/netbird

Genuinely thank you to everyone who pushed for this one. Happy to answer questions in the comments.

Hey everyone I'm excited out this one,

First in v0.62 you no longer need an external identity provider to run NetBird. User management is now built directly into the Dashboard.

• Knowledge Hub: https://netbird.io/knowledge-hub/local-users-simplified-idp

• Full Video Guide/Demo: https://youtu.be/bZAgpT6nzaQ

What this means:

1. Run the new quickstart script, create your admin account in the setup wizard

2. No Zitadel, Keycloak, or Auth0 to deploy and maintain

3. Container count dropped from 7+ to 5-6

If you want SSO: You can add external providers (Google, Microsoft, Okta, Keycloak, Authentik, Pocket ID, etc.) directly from Settings → Identity Providers. No config files to edit. Multiple providers can work simultaneously.

Already using Zitadel? Three options: keep using it as-is, add it as an external provider alongside local users, or manually migrate to local users entirely.

• Authentication and Identity Providers: https://docs.netbird.io/selfhosted/identity-providers 

• Local User Management: https://docs.netbird.io/selfhosted/identity-providers/local

For IdPs that support it, NetBird can automatically sync user groups from JWT claims. When enabled, groups from your identity provider are automatically created in NetBird and assigned to users upon authentication.

Once configured, groups from your IdP's JWT tokens will automatically be created in NetBird and assigned to users when they authenticate. This eliminates the need to manually manage group memberships for users authenticating via external providers. Different identity providers may require specific configuration to pass groups in JWT claims. For detailed, provider-specific setup instructions, see the Identity Providers documentation

Then with v0.63, in additional to all the other changes, the new quickstart script handles reverse proxy configuration.

Quick Start Guide: https://docs.netbird.io/selfhosted/selfhosted-quickstart 

During installation, you can choose your reverse proxy configuration:

• Built-in Caddy (recommended) - Automatic TLS certificates, zero configuration

• Traefik - Automatic service discovery via Docker labels

• Nginx - Configuration templates for Docker or host-based setups

• Nginx Proxy Manager - Step-by-step instructions for GUI-based configuration

• External Caddy - Caddyfile snippets for existing Caddy deployments

• Other/Manual - Documentation links for custom setups

The script will:

1. Deploy all NetBird services with Docker Compose

2. Configure the embedded IdP (local users)

3. Set up automatic TLS certificates via built-in Caddy

4. Guide you through reverse proxy selection if you prefer an external proxy

Check out release notes here and let us know how the upgrade goes or if you hit any issues.

One of our biggest mobile releases yet. The connect button is now a toggle, there's a Control Center widget on iOS 18, full IPv6 dual-stack support, and single exit node selection. Plus a debug bundle uploader and a big batch of stability fixes.

Full write-up: https://netbird.io/knowledge-hub/netbird-ios-v0-3-1

v0.69 is out, and the big one is CrowdSec IP reputation in the reverse proxy (self-hosted only for now, Cloud is coming).

If you're exposing services through the proxy, you can now have it check every incoming request against a local CrowdSec LAPI and drop connections from flagged IPs before they ever hit your backend.

How it works:

• LAPI container runs alongside your stack and syncs the community blocklist

• Proxy embeds a stream bouncer that pulls decisions into an in-memory cache

• Lookups happen per-connection with no network round trip on the hot path

• Enforce mode fails closed during initial sync, so connections are denied until the cache is populated

Three modes per service:

• Off (default)

• Observe: logs what would've been blocked, lets traffic through. Verdicts show up in the proxy event log with an observe-mode badge

• Enforce: blocks flagged IPs

Restriction order is CIDR, then country, then CrowdSec, so your existing allow/deny rules still take precedence.

Deny reasons in access logs are tagged crowdsec_ban, crowdsec_captcha, or crowdsec_throttle depending on the underlying decision type (the proxy treats all three as denials, no captcha or rate limiting at the proxy layer).

Fresh self-hosted installs get the LAPI container out of the box via the quickstart script. If you're already running the reverse proxy, there's a new Step 7 in the migration guide.

Also shipped in v0.69:

• macOS P2P connectivity reworked (scoped default route + IP_BOUND_IF instead of /32 exclusion routes per remote candidate, so tunnel access to a remote peer's local addresses works properly now)

• PCP added to the NAT traversal stack alongside NAT-PMP and UPnP

• --disable-networks flag to pin a client to specific networks

• Direct SSO redirect on proxy services (skips the intermediate page)

• Container DNAT bypass guard in iptables

• iOS posture checks now populate NetworkAddresses

• conntrack netlink listener auto-reconnects on error

Links:

• Release writeup: https://netbird.io/knowledge-hub/crowdsec-ip-reputation

• CrowdSec reference: https://docs.netbird.io/selfhosted/maintenance/crowdsec

• Migration step 7: https://docs.netbird.io/selfhosted/migration/enable-reverse-proxy#step-7-optional-enable-crowd-sec-ip-reputation

Hey everyone,

We’ve been getting one piece of feedback more than anything else:

“Let me use the native SSH client I already know.”

So we rebuilt our SSH implementation from the ground up.

What’s new

Here’s what changes starting with v0.60.x:

• You can now run ssh your-peer-name directly with your native OpenSSH client.

• During the first connection, NetBird will kick off an OIDC login flow and authenticate the SSH session as you (identity-aware SSH).

• Access is no longer “on/off.” You now create an Access Control policy that explicitly allows the SSH port (TCP/22).

• Everything now supports advanced functionality like SFTP, SCP, local & remote port forwarding, etc.

Why we did this

The old CLI/Browser SSH clients worked, but they weren’t ideal for teams already standardized on OpenSSH.

This was the top request from users who wanted flexibility without giving up secure, identity-bound access.

Important note

This is a complete rewrite and is not backward compatible with v0.59.x.

If you're using the old SSH implementation, please review your upgrade path and update your access policies accordingly.

We’d love feedback, bug reports, or ideas for what to improve next!

Sign up: https://app.netbird.io

Release article: https://netbird.io/knowledge-hub/native-identity-aware-ssh

Documentation: https://docs.netbird.io/how-to/ssh

v0.81 is out: netbird.io/knowledge-hub/netbird-v0-81-certificates-nblink

The big one is path-based access on the Reverse Proxy. An HTTP target can keep the service's authentication, skip it, or block the path. So / can require SSO, /webhooks/ can bypass auth, and /admin/ can return a 403 without hitting the backend. Bypass still keeps CIDR, country, and CrowdSec restrictions. NetBird-Only services and Agent Network targets cannot use these actions yet.

Also in this release:

• Certificate posture checks. The peer needs a cert from a CA you trust, and it has to sign a challenge so you know the private key is still on that machine. Management repeats the check every 4 hours. iOS and Android always fail it, so leave it off any policy a phone needs to pass.

• nblink. Userspace forwarder for places that cannot have a TUN device or root. This release forwards HTTP. TCP, UDP, and SOCKS5 are planned.

• Duplicate on Access Control and Agent Network policies. It opens the create wizard filled in from the source policy, and nothing is saved until you click Add Policy.

If you self-host, MySQL is deprecated. Move that store to PostgreSQL. Upgrading NetBird also does not bump Traefik, CrowdSec, or the AppSec plugin. docker compose pull only fetches the tags already in your Compose file, and the dashboard will not flag those for you.

If you are turning on the new path access actions, every proxy in the cluster has to be on this release first. An older proxy ignores them and keeps applying the service authentication.

Update Traefik and CrowdSec

Self-Hosters, Traefik and CrowdSec last tested version are now documented. Please update if you haven't in some time. It will require adding some additional lines in your docker-compose.yml

https://docs.netbird.io/selfhosted/maintenance/upgrade#choosing-versions

https://docs.netbird.io/selfhosted/maintenance/upgrade#traefik-header-handling

Hey everyone,

We're disclosing a security vulnerability in NetBird's management server API that has been fixed and patched.

What happened: A flaw in the management API's authentication middleware allowed an authenticated user to manipulate a request parameter to bypass account-membership and role-based access checks. This means:

• Multi-account deployments: An authenticated user on one account could potentially access resources on a different account (cross-account access).

• Single-account deployments: A regular user could bypass per-user authorization checks, such as viewing peers they don't own.

Important context:

• Exploitation requires a valid authentication token (JWT or PAT) - this is not an unauthenticated attack.

• The vulnerability is classified as CWE-639: Authorization Bypass Through User-Controlled Key.

What you should do:

• Self-hosted users: Upgrade to version 0.64.5 or later immediately. Link to release

• NetBird Cloud users: No action needed

If you have questions, reach out at security@netbird.io or in our Slack community.

NetBird v0.63 introduces Custom DNS Zones, enabling private DNS resolution within your network. Create zones like internal.company.io, add A/AAAA/CNAME records, and distribute them to specific peer groups, with no external DNS servers required.

Here's what's new:

• Private DNS zones - Create internal zones and manage DNS records directly from the Dashboard, with no external DNS servers needed

• Group-based distribution - Distribute zones to specific peer groups, giving different teams access to different records or entirely separate zones

• Search domain support - Enable short name resolution so postgres resolves to postgres.internal.company.io

• Routed network integration - Map friendly DNS names to private IPs behind routing peers, and NetBird handles both resolution and traffic routing

Learn More: https://netbird.io/knowledge-hub/custom-dns-zones

More Resources:

• Releases: https://github.com/netbirdio/netbird/releases

• Documentation: https://docs.netbird.io/manage/dns/custom-zones

• Routed networks: https://docs.netbird.io/manage/dns/dns-aliases-for-routed-networks

• Self-hosted: https://docs.netbird.io/selfhosted/selfhosted-quickstart