Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Netbird – Open Source Zero Trust Networking

netbird.io

Post reply on HN
Print view View original

271–280 of 299 posts

Re: Netbird – Open Source Zero Trust Networking

#271

Post by woile »

patmorgan23 wrote: post #262
woile wrote: post #195

For the guys at Netbird, please create an entry in the https://wiki.nixos.org explaining how to use it with nixos. - Tailscale has one entry - Pangolin is getting one I would like to see, even if brief: 1. Getting started 2. Hardware requirements 3. Security considerations 4. Recommended architecture, like running in a VPS if it makes sense 5. Configuring a server 6. Configuring devices 7. Resources (links to read mo…

Anyone can contribute to the nixos wiki, why don't you get the page started?

Because I don't feel confident. I'm super green at VPN's and this kind of networks. I don't want to give the wrong advice.

I'm editing what I can, but you don't want to take my advice, it would be better if someone who knows does it.

The fact that I'm into home lab, doesn't mean I know specifically how to do this. And I'm just saying, when I go to the wiki, to pick up on one of the options, they are missing.

I don't know why the hostility for asking to add some docs

Re: Netbird – Open Source Zero Trust Networking

#272

Post by FloatArtifact »

edentrey wrote: post #14
FloatArtifact wrote: post #12

If the VPN connection would stay connected despite having it set up that way in the web UI.. It would be a good product. Still haven't figured out how to do Termux on Android with netbird ssh yet.

can you please elaborate on this? I use termux on android with tailscale and it works flawless, is it not possible on Netbird?

If I simply try... ssh user@100.119.230.104 it asked for a password, but there is no password.

Re: Netbird – Open Source Zero Trust Networking

#273

Post by kolp »

chillfox wrote: post #254
pranaysy wrote: post #65

Long-time ZeroTier user here. Recently switched to NetBird (self-hosted on a Hetzner VPS) and it’s been seamless so far. DNS functionality is excellent (something ZeroTier lacked), and the access-control model is very well designed. It’s easy to understand what’s going on and to grant one-off access when needed. Only real and very minor gripe is the Android app: I wish it were on F-Droid and a bit more robust, as it…

Does Tailscale/ZeroTier/Netbird provide anything beyond a GUI wrapper for Wireguard? How easy is it to make it manage an already configured Wireguard mesh network?

I had to use tailscale to bust through port forwarding on chained routers because, even with ports configured correctly, wireguard wasn't able to get through.

My use case was for remote access into a home-hosted Nextcloud instance, via an ISP supplied fibre router (IPv4, not CGNAT), then my own Gl iNet router, then to my Nextcloud instance.

Despite opening up port forwarding correctly, wireguard just couldn't get through that chain, whereas tailscale got through with no problems.

Downside of using tailscale is that it's messy to use at the same time as a VPN on your client device. Split tunnelling supposedly works, but I couldn't get it going.

Re: Netbird – Open Source Zero Trust Networking

#274

Post by PLG88 »

esseph wrote: post #237
PLG88 wrote: post #228

Earlier quoted context omitted.

Fair, I was being loose with my language. What I should have said is that it does not come fully featured open source, that you need to do a certain amount of rolling your own.

The same could be said for a webserver, a radius server, etc. I mean ssh "requires" a network to be remotely useful :) Edit, since I can't reply sadly: You're right, that was a bad example. I can probably list at least a few dozen things that all require certificates though, which was really my point. Everything has dependencies. Also if you just... Don't trust big tech, run your own CA.

Right, but if certificates are a fundamental part of your design, you should include the functional mechanisms to manage them imho (i.e., key distribution, auth/login). The developers created it, but they keep it in the commercial product. Other overlays which use PKI include those functions in the FOSS.

Re: Netbird – Open Source Zero Trust Networking

#275

Post by moontear »

braginini wrote: post #32
estsauver wrote: post #8

There's also https://pangolin.net/ which is kind of similar, and I believe a YC company.

Not quite similar tho. Pangolin is a reverse proxy, NetBird is p2p mesh for internal resources remote access

It is not only a reverse proxy (which is actually just traefik), see this blog post https://pangolin.net/blog/posts/1-15-0-release

Pangolin is a hub-and-spoke style network. They actually have some comparisons between Netbird and Pangolin https://pangolin.net/blog/posts/pangolin-v-netbird and Pangolin and Tailscale https://pangolin.net/blog/posts/pangolin-v-tailscale

Re: Netbird – Open Source Zero Trust Networking

#276

Post by moontear »

pkulak wrote: post #263
pranaysy wrote: post #65

Long-time ZeroTier user here. Recently switched to NetBird (self-hosted on a Hetzner VPS) and it’s been seamless so far. DNS functionality is excellent (something ZeroTier lacked), and the access-control model is very well designed. It’s easy to understand what’s going on and to grant one-off access when needed. Only real and very minor gripe is the Android app: I wish it were on F-Droid and a bit more robust, as it…

But paid Tailscale is $5 a month right? So you gotta be paying more to self host and deal with all the problems yourself, not have derp servers all over the world, etc. Why?

Why do you assume OP paid $5 a month? You get Tailscale for free in many use-cases. Your argument that self-hosting is more expensive is still valid, but I don't get the 5$.

Re: Netbird – Open Source Zero Trust Networking

#277

Post by moontear »

chillfox wrote: post #254
pranaysy wrote: post #65

Long-time ZeroTier user here. Recently switched to NetBird (self-hosted on a Hetzner VPS) and it’s been seamless so far. DNS functionality is excellent (something ZeroTier lacked), and the access-control model is very well designed. It’s easy to understand what’s going on and to grant one-off access when needed. Only real and very minor gripe is the Android app: I wish it were on F-Droid and a bit more robust, as it…

Does Tailscale/ZeroTier/Netbird provide anything beyond a GUI wrapper for Wireguard? How easy is it to make it manage an already configured Wireguard mesh network?

They are not only a wrapper for Wireguard even though people keep saying that.

Each of the tools gives different benefits and yes, you can roll all of that on your own, but let's take Tailscale as an example: You have custom ACLs to secure your network on a client/user/device basis with tagging of devices. You have your own tailscale SSH connection, the possibility to create private-public tunnels (just like Cloudflare tunnels). The hole punching using DERP servers and native IPv6/IPv4 interoperability means it really connects any device on any network type to all other devices. And of course the management pane and GUI you talked about.

This is not supposed to be a marketing ploy for Tailscale, but saying "they are just a wrapper for Wireguard" is plain wrong.

Re: Netbird – Open Source Zero Trust Networking

#278

Post by PLG88 »

newzino wrote: post #259
NewJazz wrote: post #202

Earlier quoted context omitted.

Honestly no it is kind of nonsense. Nothing requires you to microsegment with wireguard meshes, for example.

[flagged]

That’s a fair framing, with one important distinction.

Overlay ACLs give you network-scoped microsegmentation, not service-scoped Zero Trust (as intended in NIST 800-207). You’re limiting which IPs/ports can talk after a node is attached, not deciding whether a service path exists at all per identity and per session.

The crypto isn’t the issue - WireGuard keys are strong. The issue is scope. A node identity that grants network reachability is different from a capability-scoped identity that creates only explicit service connectivity. NIST also warns that IP-based enforcement tends to reintroduce ambient trust once a device is attached. In that model, lateral movement is reduced, not eliminated.

A simple litmus test: - If authenticating gives you an IP and routes, you’ve built network trust with segmentation. - If authenticating only creates explicit service paths, you’ve built Zero Trust.

Mapping this to Wireguard and overlays, I’d say: - WireGuard + identity + ACLs = good overlay microsegmentation - Identity-first connectivity (no IP reachability, no inbound listeners) = Zero Trust by construction

If you adopt the latter, the former becomes unnecessary for Zero Trust — because identity creates connectivity directly instead of attaching nodes to a network. Bringing it back to the topic, microsegmentation manages risk inside a network. Identity-first connectivity removes the network from the trust model altogether.

Re: Netbird – Open Source Zero Trust Networking

#279

Post by debugnik »

fc417fc802 wrote: post #58
niemandhier wrote: post #54

Earlier quoted context omitted.

Could be intentional: German privacy advocates really like that the limited ipv4 pool forces reusing IPs and prevents accidental imprinting a practically static address on a device.

Can't do IPv6 internally or externally? Internally there should be zero need for ~infinite addresses. Externally though I certainly hope all software is capable of operating via IPv6 at this point because otherwise it will only be increasingly broken.

Can't do it externally, kinda. Last year I succeeded in joining a device reachable only through IPv6 to a Netbird network, but their service would fail when I tried to configure IPv6 nameservers for it; the web UI did accept them fine though, they just didn't work. A shame, since I was otherwise fine with IPv4-only for the Netbird network.

Re: Netbird – Open Source Zero Trust Networking

#280

Post by rpastuszak »

esseph wrote: post #229
rpastuszak wrote: post #140

Earlier quoted context omitted.

Not sure about the parent, but here's what I use it for: A) easy access my other, older machines from my phone or work laptop to: - self-host a Coolify server (a "vercel-lite" control panel) - remote connect to my older laptop to run tests/longer coding tasks for work (e.g. large browser test suites, sandboxed claude running in bg to answer longer code questions, or build fire and forget spikes/experiments) - control…

Hamachi is layer2 (like zerotier) Wireguard, talescale, netbird, etc. are layer 3.

Ah, correct, https://devilutionx.com uses it for that specific reason.
Post reply on HN