Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Netbird – Open Source Zero Trust Networking

netbird.io

Post reply on HN
Print view View original

221–230 of 299 posts

Re: Netbird – Open Source Zero Trust Networking

#221

Post by Uptrenda »

Going to mention my own project which aims to be 100% open source, free, and relies almost only on public infrastructure: https://github.com/robertsdotpm/p2pd

Basically, I'm building a framework for building NAT traversal plugins. Software like ngrok and P2P VPNs can then be built on top of it. Examples of plugins for the library include direct connect, reverse connect (connect back to you), TCP hole punching, and UPnP-based port forwarding.

The underlying network stack for the project was also built from scratch to better support IPv6 and multiple interfaces. This allows plugins to fully utilise the underlying network paths and interfaces on the machine. This took considerable time because most software simply uses the default interface.

I'm still in the middle of building the software so its not yet functional. But if anyone is interested throw me a star or an email at matthew@roberts.pm.

Re: Netbird – Open Source Zero Trust Networking

#222

Post by impuremonad »

FazJaxton wrote: post #134
mittermayr wrote: post #47

I can only recommend giving headscale a try. It's free, works extremely well, and can be used with the official Tailscale clients. Was super easy to set up. https://headscale.net/stable/

Could you give a brief description of your use case? I'm looking at all the tailscale buzzwords on their site, but am not really understanding what I would use this for in my home setup

I run it on all my vps and allow me to close every port but 80 and 443, even port 22 is closed

I ssh through the tailnet network without worrying about remembering ips because of how their magicdns works

I have deployed some admin dashboards and it simplifies the security a lot because I don't have to worry about them being exposed to the internet, I can directly connect to them using http://my-vps:port on any device connected to the tailnet

I sometimes also use my vps as an exit node whenever I need a vpn

I know this might sound like a commercial but it is not, it's one of those pieces of tech that has really changed how I work since I discovered it and I can't do other thing than recommend it

That said, their free tier is more than enough for me, and if they haven't one I probably wouldn't pay for this and just find an open source alternative

I haven't checked headscale in depth but seems promising, will give it a try

Re: Netbird – Open Source Zero Trust Networking

#223

Post by gnufx »

moonlightbandit wrote: post #68
edentrey wrote: post #20

Earlier quoted context omitted.

I see Pangolin has a Self-Host Community Edition, doesn't that already give something over digital sovereignity for EU users? I am considering both for a migration from Tailscale, any suggestion on their differences?

They solve different problems. For a Tailscale migration, NetBird is the direct swap. Pangolin won't give you device-to-device connectivity. On EU sovereignty: NetBird is Germany-based and explicitly positions itself as a European alternative. Self-hosted gives full control with no callbacks to their servers. Pangolin is US/YC-backed, so while self-hosting gives you control of the data plane, the project itself is Am…

With regard to European sovereignty, I note that Netbird uses AWS.

Re: Netbird – Open Source Zero Trust Networking

#224

Post by mirashii »

Ingon wrote: post #131

I've been working for a while on https://github.com/connet-dev/connet . It gives a different twist at the same problem - instead of an overlay network at L4 (wireguard, etc) or publicly accessible endpoint at L7 (like ngrok) it "projects" a remote endpoint locally (e.g. as if you are running the service on your computer). Of course "locally" can always be a VPS that has caddy in front to give you ngrok-like experienc…

A neat idea, but projecting all of these services onto localhost is a bit of a security nightmare. Have you considered looking at what something like Twingate does? Using the CGNAT IP space for the projection allows you to give every individual service its own IP address, which helps quite a bit in terms of allowing you to isolate the services from e.g. malicious web pages.

Re: Netbird – Open Source Zero Trust Networking

#226

Post by gnufx »

somepleb wrote: post #115
gnufx wrote: post #89

I've looked without success for external audit reports of either Tailscale and Netbird, like Mullvad gets. While I don't approve of the sort of auditor box-ticking we get at work, it would be reassuring to see a report from a proper security consultancy.

Netbird has supposedly done a penetration test, but it is only supplied upon request [0]. I haven't bothered trying to get my hands on it since I don't use their product. I don't agree with gatekeeping the results instead of making them public. NetBird should also consider publishing an SBOM, similar to what Defguard does.[1]. [0] https://trust.netbird.io/ [1] https://defguard.net/sbom/

Oh, I hadn't found that. Yes, it seems strange not to publicize something like that to give users confidence (assuming the audit/pentest isn't damning). It doesn't have to have been perfect initially, as long as appropriate fixes were made.

Re: Netbird – Open Source Zero Trust Networking

#228

Post by PLG88 »

tjoff wrote: post #218
PLG88 wrote: post #209

Earlier quoted context omitted.

Referring to the previous person's comment, that you need to manage a PKI and have to distribute the keys yourself, no auth/login etc.

How does that make it not "truly open source"? I made a shell script that does most of that for my needs.

Fair, I was being loose with my language. What I should have said is that it does not come fully featured open source, that you need to do a certain amount of rolling your own.

Re: Netbird – Open Source Zero Trust Networking

#229

Post by esseph »

rpastuszak wrote: post #140
FazJaxton wrote: post #134

Earlier quoted context omitted.

Could you give a brief description of your use case? I'm looking at all the tailscale buzzwords on their site, but am not really understanding what I would use this for in my home setup

Not sure about the parent, but here's what I use it for: A) easy access my other, older machines from my phone or work laptop to: - self-host a Coolify server (a "vercel-lite" control panel) - remote connect to my older laptop to run tests/longer coding tasks for work (e.g. large browser test suites, sandboxed claude running in bg to answer longer code questions, or build fire and forget spikes/experiments) - control…

Hamachi is layer2 (like zerotier)

Wireguard, talescale, netbird, etc. are layer 3.

Re: Netbird – Open Source Zero Trust Networking

#230

Post by __float »

woile wrote: post #195

For the guys at Netbird, please create an entry in the https://wiki.nixos.org explaining how to use it with nixos. - Tailscale has one entry - Pangolin is getting one I would like to see, even if brief: 1. Getting started 2. Hardware requirements 3. Security considerations 4. Recommended architecture, like running in a VPS if it makes sense 5. Configuring a server 6. Configuring devices 7. Resources (links to read mo…

This is kind of a weird request, IMO.

If you're a homelab NixOS user, isn't it on you to try to answer these questions? A home lab is for learning, and if you don't want to do that, what's the point?

Post reply on HN