Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Netbird – Open Source Zero Trust Networking

netbird.io

Post reply on HN
Print view View original

61–70 of 299 posts

Re: Netbird – Open Source Zero Trust Networking

#61

Post by fc417fc802 »

sunshine-o wrote: post #56
niemandhier wrote: post #54

Earlier quoted context omitted.

Could be intentional: German privacy advocates really like that the limited ipv4 pool forces reusing IPs and prevents accidental imprinting a practically static address on a device.

Makes a lot of sense. But self-hosting still require at least a public domain name [0], so here goes your privacy right? - [0] https://docs.netbird.io/selfhosted/selfhosted-quickstart#inf...

> The VM must be publicly accessible on TCP ports 80 and 443, and UDP port 3478.

> A public domain name that resolves to the VM’s public IP address.

Since it already uses DNS it's disappointing that it hardcodes ports instead of using SRV records. IMO anything that can use SRV records should. It makes for a more robust internet.

Re: Netbird – Open Source Zero Trust Networking

#62

Post by [deleted] »

edentrey wrote: post #25
tass wrote: post #19

Earlier quoted context omitted.

Tailscale allows you to disable the expiration time - I do this for my gateways. My other simplifier is having everything at home get a .home dns name, and telling Tailscale to route all these via tailnet.

can you please tell me how to disable expiration time? I see auth keys have an Expiration which says it "Must be between 1 and 90 days." I do use a custom domain name as well with a Nameservers rule to have all my services reachable as subdomains of my custom domain.

[deleted]

Re: Netbird – Open Source Zero Trust Networking

#63

Post by abcd_f »

sunshine-o wrote: post #55

For someone who want to setup a private network between host/devices, I feel the dilemma is always: 1. Trust a third party like Tailscale by giving them the key to your kingdom, but everything is incredibly easy and secure. 2. Self-host but need at least one host with a fixed IP address and an open port on the Internet. What requires a set of security skills and constant monitoring. That includes headscale, selhosted…

You can conceal that open port with some form of port knocking. Though this does reinforce your "easy" point.

Also, if it's an UDP port, then using a protocol that expects first client packet to be pre-authenticated and not emitting any response otherwise gets you pretty damn close to having this port closed.

Re: Netbird – Open Source Zero Trust Networking

#65

Post by pranaysy »

Long-time ZeroTier user here. Recently switched to NetBird (self-hosted on a Hetzner VPS) and it’s been seamless so far. DNS functionality is excellent (something ZeroTier lacked), and the access-control model is very well designed. It’s easy to understand what’s going on and to grant one-off access when needed. Only real and very minor gripe is the Android app: I wish it were on F-Droid and a bit more robust, as it sometimes drops when roaming. Nevertheless, congratulations on a fabulous piece of software! I hope it keeps improving :)

Re: Netbird – Open Source Zero Trust Networking

#66

Post by ZoomZoomZoom »

Tailscale is great and headscale is an important step to gain trust. However, headscale is useless without the clients, and Tailscale geoblock installing clients where they can. If the platform requires jailbreak for installing user-chosen software, as is the case with iOS, then it all becomes useless.

Open (preferably free software) clients without idiotic restrictions could be one of the main advantages for any competing solution. Does Netbird provide them?

Re: Netbird – Open Source Zero Trust Networking

#67

Post by Borealid »

no_time wrote: post #40

F-droid inclusion seems to be stalled https://gitlab.com/fdroid/rfp/-/issues/2688 Having it in F-droid, vetted by their policies is kind of my benchmark for "software that is guaranteed to be not crapware." That being said I'm rooting for the devs, having an alternative for tailscale+headscale would be nice, because as it stands it's kind of dependant on the goodwill of a for profit company (finite).

https://codeberg.org/bg443/JetBird appears to use the same core library (and is just a different Android frontend wrapper).

Re: Netbird – Open Source Zero Trust Networking

#68

Post by moonlightbandit »

edentrey wrote: post #20
OtomotO wrote: post #11

Earlier quoted context omitted.

Does that have ties to the US? If so it's not playing in the same ballpark. US citizens may not be aware, but due to POTUS "made and maintained in Europe" is becoming more and more important to EU.

I see Pangolin has a Self-Host Community Edition, doesn't that already give something over digital sovereignity for EU users? I am considering both for a migration from Tailscale, any suggestion on their differences?

They solve different problems.

For a Tailscale migration, NetBird is the direct swap. Pangolin won't give you device-to-device connectivity.

On EU sovereignty: NetBird is Germany-based and explicitly positions itself as a European alternative. Self-hosted gives full control with no callbacks to their servers. Pangolin is US/YC-backed, so while self-hosting gives you control of the data plane, the project itself is American.

Also, NetBird has a reverse proxy feature coming this quarter, which would cover the Pangolin use case within the same platform.

Re: Netbird – Open Source Zero Trust Networking

#70

Post by geoctl »

(Shamless plug) I am also working on a similar FOSS, self-hosted project called Octelium https://github.com/octelium/octelium that you might find interesting if you are interested in this space. Octelium is, however, more of a generic/unified zero trust secure access platform that can operate as a remote access VPN, a ZTNA platform, API/AI/MCP gateway, a PaaS, an ngrok-alternative and a homelab infrastructure. It provides unified client-based as well as clientless access for both humans and workloads; dynamic identity-based secretless access (e.g. access to HTTP/gRPC/k8s upstreams without sharing API keys and access tokens, SSH without distributing passwords/private keys, postgres/MySQL databases without sharing passwords, etc.); dynamic L7-aware, identity-based access control ABAC via CEL and OPA as well as dynamic routing to upstreams via policy-as-code; native Passkey login/WebAuthn/TOTP MFA and support for OIDC/SAML IdPs, OpenTelemetry-native L7-aware visibility and auditing; clientless access via OAuth2 for workloads, WireGuard and QUIC tunneling with dual-stack and automatic private DNS, including in rootless mode; passwordless SSH'ing into containers and IoT without SSH servers; deploying and securing access to containers; declarative k8s-like management with horizontal scalability among other features. You can read more in the README if you're interested.
Post reply on HN