Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Netbird – Open Source Zero Trust Networking

netbird.io

Post reply on HN
Print view View original

151–160 of 299 posts

Re: Netbird – Open Source Zero Trust Networking

#151

Post by linsomniac »

db04 wrote: post #76
mittermayr wrote: post #47

I can only recommend giving headscale a try. It's free, works extremely well, and can be used with the official Tailscale clients. Was super easy to set up. https://headscale.net/stable/

Is Headscale suitable for production use?

I'd say no, but it really depends on what your use is. The biggest barrier is that it doesn't have a HA story that I'm aware of, but you might be able to get one by carefully replicating the sqlite and using something like pacemaker to fail over and fail back.

That said, I've been using headscale on 220 devices for ~3.5 years now and it's been quite reliable.

Re: Netbird – Open Source Zero Trust Networking

#152

Post by smashed »

PLG88 wrote: post #143

I like Netbird, its a better VPN, but its not zero trust networking. Zero Trust requires identity to create connectivity itself—per service, per session—rather than granting network reachability and constraining it with routes and rules. I have had this conversation on Reddit many times... curious if anyone agrees/disagrees.

I think the desktop client can authenticate to an IdP by opening a browser window and doing a login flow.

If the user is forced to authenticate to start the VPN session, would that make it zero trust?

I think once the VPN is on, it's on, and the remote service cannot get identity info from the network layer.

Seems like what you want to achieve can only be built on the application layer?

Re: Netbird – Open Source Zero Trust Networking

#153

Post by mittermayr »

protimewaster wrote: post #129
tucnak wrote: post #110

Earlier quoted context omitted.

No, it's only viable if your whole network is, like, five devices.

I assume this is an exaggeration? Another poster says they have good luck with headscale on two networks of 400 devices.

yeah looks like someone is either a hyper tailscale fan or had extremely bad experience with it, I also run several dozens of machines (and tablets and phones) on it. never had a single moment of downtime since I started.

Re: Netbird – Open Source Zero Trust Networking

#154

Post by winrid »

My favorite feature of netbird might be no search in the client

or network names literally overlapping in the "overlapping networks" tab

or maybe it's the need to toggle the network on and off a few times to get it to work

One of the few pieces of software I actually despise but have to use, and I use win11.

Re: Netbird – Open Source Zero Trust Networking

#155

Post by binnacle »

braginini wrote: post #150
binnacle wrote: post #113

I tried migrating our organization from Twingate to self-hosted Netbird for cost savings but couldn't get it working reliably for 10-15% of users. The client failed intermittently with no clear pattern to troubleshoot. It became very frustrating for our end users. My advice: if you're considering self-hosted Netbird, set clear expectations that it's best-effort QoS, not enterprise-grade reliability. There's no such t…

Would you mind sharing more about the issue? We have enterprises running NetBird with thousands of users with near zero issues. Apparently it is usually other way around - people migrating from Twingate to NetBird because of the former solution instability. Well, that is from our experience. I suggest trying NetBird cloud to eliminate a potential misconfiguration of the self-hosted instance.

DNS resolution failures occurred inconsistently—sometimes due to browser caching when accessing web resources, but often for no apparent reason. For some users, restarting or reconnecting Netbird resolved it; for others, it didn't. The fact it worked flawlessly for some users while barely functioning for others suggests client-side issues. We also saw sporadic failures in cron jobs (like DB exporters) that never happened with Twingate. We followed the Helm chart configuration exactly and properly configured the Network Load Balancer with appropriate timeout settings.

Re: Netbird – Open Source Zero Trust Networking

#156

Post by smashed »

regisso wrote: post #64

I recommend it the NetBird team is transparent and easy to reach. I switched from Tailscale a while ago (2y), went fully self-hosted, and upgrades across versions have been smooth, which tells me they care about the self-hosted, not just their cloud offering.

We tried netbird but could not get the client to register to a self hosted server. It ignored the setting or failed.

Good chance it was user error on our part.

Most of their documentation is very unclear about what is a cloud offering feature and what is possible using self-hosting. There are features not available on the community edition and you have to be very careful reading their doc.

Just putting it out there so people do not think it's an easy solution. It will require appropriate planning.

I do think its a more promising solution than headscale if you want to self host as it is a complete package, unlike tailscale where you need to modify registry keys to change the cloud URL and headscale is a simplified, non-multi-tenant signaler.

Re: Netbird – Open Source Zero Trust Networking

#157

Post by mittermayr »

FazJaxton wrote: post #134
mittermayr wrote: post #47

I can only recommend giving headscale a try. It's free, works extremely well, and can be used with the official Tailscale clients. Was super easy to set up. https://headscale.net/stable/

Could you give a brief description of your use case? I'm looking at all the tailscale buzzwords on their site, but am not really understanding what I would use this for in my home setup

I have one VPS node that I use as a connector, where the headscale app is installed. I have this on a domain (for convenience), so think something like:

hs.mygreatplace.com

Now, when I install Tailscale client on any device (phones, tablets, Linux machines, proxmox nodes, etc.), I simply say: don't use the tailscale network for this, please route this over my own network, so you point it to hs.mygreatplace.com as a connectivity server, which is compatible to Tailscale, and that's it. It's officially supported by Tailscale, so that's great and makes it all work.

Then, when pairing for the first time, you'll get a link/code, click it and/or enter it on the hub basically (hs.mygreatplace.com) and it's paired.

That connection is up and will stay up now. So while that new device may be behind a firewall, I can always connect to it. You open Tailscale and see all your paired devices. They basically now get an additional internal ip (100.0.0.1, etc.) and you use that to ssh or connect to it.

I have a beefy Proxmox machine, and used to route many of these services out to the public internet through port mapping, but now I just leave them cut off entirely and only surface them inside of my private network. When connecting to these nodes (from iPhone, Laptops, etc.), there's zero configuration once it is set up, it auto-routes correctly and just acts like those nodes are on the internet, it's a dream.

It also automatically adds the node as a subdomain, so if you pair a proxmox node that runs grafana, and maybe has a hostname "grafana", it will show up and be always reachable as: grafana.hs.mygreatplace.com

It doesn't get much easier than that.

All that said, I HIGHLY recommend Tailscale for anyone who hasn't done much with private networking, just to try out first, and get used to it. Their free tier is very generous and I think they've got a fantastic next-to-zero-config product, truly wonderful. However, my concern was to be trapped with a $160m dollar VC-funded (US-based) company, when the inevitable rug gets pulled (as it always does, and as anyone should come to accept, if you've been on the internet for a minute).

So I was looking for alternatives, and headscale immediately worked out. Of course, Tailscale ever killing their client's ability to use your own infra will lead to a similar end result (dead end), but I am sure those things can eventually be sorted out by open source attempts and clients (which headscale has, I just haven't tried them out yet, https://headscale.net/0.25.0/about/clients/).

I had a Wireguard network before (which this essentially also is, but in a much nicer packaging), but always ran into config problems with the shared profiles and IPs and so forth, so this was just a simpler step.

Worst case, it all goes back to Wireguard.

Re: Netbird – Open Source Zero Trust Networking

#158

Post by PLG88 »

smashed wrote: post #152
PLG88 wrote: post #143

I like Netbird, its a better VPN, but its not zero trust networking. Zero Trust requires identity to create connectivity itself—per service, per session—rather than granting network reachability and constraining it with routes and rules. I have had this conversation on Reddit many times... curious if anyone agrees/disagrees.

I think the desktop client can authenticate to an IdP by opening a browser window and doing a login flow. If the user is forced to authenticate to start the VPN session, would that make it zero trust? I think once the VPN is on, it's on, and the remote service cannot get identity info from the network layer. Seems like what you want to achieve can only be built on the application layer?

Short answer: no, authenticating to start a VPN doesn’t make it Zero Trust.

Once you authenticate to a VPN, you’re granted network attachment. From that point on, the network is effectively saying “I trust you enough to route packets,” and enforcement shifts to IPs, subnets, and firewall rules. That’s still network-level trust, even if the login was strong.

Zero Trust (architecturally; check out NIST 800-207) changes what identity does:

- Identity doesn’t just gate entry - Identity + policy decide whether a path exists at all, per service, per session - If you’re not authorized for a service, there is literally no route, IP, or port to talk to

On your last point: it’s not “only application-layer,” but it’s also not traditional L3/4 networking. It’s an overlay where identity is bound into connection establishment itself (mTLS/E2EE, service addressing, no inbound listeners), so the network never becomes a trust plane in the first place.

That’s the difference between “authenticate, then connect to a network” and “authenticate to create connectivity.”

For a reference, check out OpenZiti, thats a project I work on - https://openziti.io/

Re: Netbird – Open Source Zero Trust Networking

#159

Post by pydry »

FazJaxton wrote: post #134
mittermayr wrote: post #47

I can only recommend giving headscale a try. It's free, works extremely well, and can be used with the official Tailscale clients. Was super easy to set up. https://headscale.net/stable/

Could you give a brief description of your use case? I'm looking at all the tailscale buzzwords on their site, but am not really understanding what I would use this for in my home setup

if you self host immich, homeassistant or jellyfin you can access them while out as easily as you can on home wifi.

Re: Netbird – Open Source Zero Trust Networking

#160

Post by cpach »

c0balt wrote: post #87
ysleepy wrote: post #77

Earlier quoted context omitted.

I've used it for some time, it feels very much like it is in maintenance mode. You manage a PKI and have to distribute the keys yourself, no auth/login etc. it's much better than wireguard, not requiring O(N) config changes to add a node, and allowing peoxy nodes etc. iirc key revocation and so on are not easy.

Nebula does not require O(n) config changes for adding a node. O(n) is only required for: - active revocation of a certificate (requires adding the CA fingerprint to the config file) - adding/removing a lighthouses (hub for publishing IPs for p2p) or relay (for going over p2p) - CA rotation

AFAICT you and 'ysleepy are in agreement.
Post reply on HN