Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Netbird – Open Source Zero Trust Networking

netbird.io

Post reply on HN
Print view View original

141–150 of 299 posts

Re: Netbird – Open Source Zero Trust Networking

#141

Post by ErneX »

FazJaxton wrote: post #134
mittermayr wrote: post #47

I can only recommend giving headscale a try. It's free, works extremely well, and can be used with the official Tailscale clients. Was super easy to set up. https://headscale.net/stable/

Could you give a brief description of your use case? I'm looking at all the tailscale buzzwords on their site, but am not really understanding what I would use this for in my home setup

I have some servers sending their telegraf data to a server in my home using the tailnet instead of opening a port on my firewall for that, to name one use case.

It has a pretty good ACL functionality, you can configure which hosts with certain tag can access certain routes.

Re: Netbird – Open Source Zero Trust Networking

#143

Post by PLG88 »

I like Netbird, its a better VPN, but its not zero trust networking. Zero Trust requires identity to create connectivity itself—per service, per session—rather than granting network reachability and constraining it with routes and rules. I have had this conversation on Reddit many times... curious if anyone agrees/disagrees.

Re: Netbird – Open Source Zero Trust Networking

#144

Post by PLG88 »

ysleepy wrote: post #77
aaronds wrote: post #36

A bit lower level than most things discussed here but on the topic of overlay networks, I’ve used nebula for years and can recommend it https://github.com/slackhq/nebula

I've used it for some time, it feels very much like it is in maintenance mode. You manage a PKI and have to distribute the keys yourself, no auth/login etc. it's much better than wireguard, not requiring O(N) config changes to add a node, and allowing peoxy nodes etc. iirc key revocation and so on are not easy.

This problem has been brought up in the OpenZiti community many times. I like Nebula, but it's not 'truly open source'.

Re: Netbird – Open Source Zero Trust Networking

#145

Post by PLG88 »

binnacle wrote: post #113

I tried migrating our organization from Twingate to self-hosted Netbird for cost savings but couldn't get it working reliably for 10-15% of users. The client failed intermittently with no clear pattern to troubleshoot. It became very frustrating for our end users. My advice: if you're considering self-hosted Netbird, set clear expectations that it's best-effort QoS, not enterprise-grade reliability. There's no such t…

Check out OpenZiti. Its open source, runs at prodution scale, and recently someone who used to work at Twingate said OpenZiti is many times more powerful than TG.

Re: Netbird – Open Source Zero Trust Networking

#146

Post by benoliver999 »

pranaysy wrote: post #65

Long-time ZeroTier user here. Recently switched to NetBird (self-hosted on a Hetzner VPS) and it’s been seamless so far. DNS functionality is excellent (something ZeroTier lacked), and the access-control model is very well designed. It’s easy to understand what’s going on and to grant one-off access when needed. Only real and very minor gripe is the Android app: I wish it were on F-Droid and a bit more robust, as it…

Also long time zerotier user here, I run a controller for our company. I'm starting to experience infrequent but annoying drops in connection, and DNS is a headache.

How is netbird on iOS?

Re: Netbird – Open Source Zero Trust Networking

#148

Post by PLG88 »

RedShift1 wrote: post #23

I'm really missing something like Cisco DMVPN. A VPN mesh between different routers where all routers have a connection to each other, so that all traffic doesn't have to pass through the hub. And that runs on a router, because all these solutions only run on a regular computer with a complete OS.

Out of curiosity, why? Because you dont want to run software on users devices?

Re: Netbird – Open Source Zero Trust Networking

#149

Post by PLG88 »

sunshine-o wrote: post #55

For someone who want to setup a private network between host/devices, I feel the dilemma is always: 1. Trust a third party like Tailscale by giving them the key to your kingdom, but everything is incredibly easy and secure. 2. Self-host but need at least one host with a fixed IP address and an open port on the Internet. What requires a set of security skills and constant monitoring. That includes headscale, selhosted…

You could use a solution that allows you to have E2E with private sovereign keys on the endpoint, as well as bring your own IdP/PKI, so the provider does not have your keys. Would that be good enough?

Re: Netbird – Open Source Zero Trust Networking

#150

Post by braginini »

binnacle wrote: post #113

I tried migrating our organization from Twingate to self-hosted Netbird for cost savings but couldn't get it working reliably for 10-15% of users. The client failed intermittently with no clear pattern to troubleshoot. It became very frustrating for our end users. My advice: if you're considering self-hosted Netbird, set clear expectations that it's best-effort QoS, not enterprise-grade reliability. There's no such t…

Would you mind sharing more about the issue? We have enterprises running NetBird with thousands of users with near zero issues. Apparently it is usually other way around - people migrating from Twingate to NetBird because of the former solution instability. Well, that is from our experience.

I suggest trying NetBird cloud to eliminate a potential misconfiguration of the self-hosted instance.

Post reply on HN