.github/workflows | ||
client | ||
docs | ||
encryption | ||
iface | ||
infrastructure_files | ||
management | ||
release_files | ||
signal | ||
util | ||
.gitignore | ||
.goreleaser_ui_darwin.yaml | ||
.goreleaser.yaml | ||
AUTHORS | ||
CODE_OF_CONDUCT.md | ||
go.mod | ||
go.sum | ||
LICENSE | ||
README.md |
Big News! Wiretrustee becomes Netbird. Learn more
Start using Netbird at app.netbird.io
See Documentation
Join our Slack channel
Netbird is an open-source VPN platform built on top of WireGuard® making it easy to create secure private networks for your organization or home.
It requires zero configuration effort leaving behind the hassle of opening ports, complex firewall rules, VPN gateways, and so forth.
Netbird automates Wireguard-based networks, offering a management layer with:
- Centralized Peer IP management with a UI dashboard.
- Encrypted peer-to-peer connections without a centralized VPN gateway.
- Automatic Peer discovery and configuration.
- UDP hole punching to establish peer-to-peer connections behind NAT, firewall, and without a public static IP.
- Connection relay fallback in case a peer-to-peer connection is not possible.
- Multitenancy (coming soon).
- Client application SSO with MFA (coming soon).
- Access Controls (coming soon).
- Activity Monitoring (coming soon).
- Private DNS (coming soon)
Secure peer-to-peer VPN in minutes
Note: The main
branch may be in an unstable or even broken state during development. For stable versions, see releases.
Hosted version: https://app.netbird.io/.
A bit on Netbird internals
- Netbird features a Management Service that offers peer IP management and network updates distribution (e.g. when a new peer joins the network).
- Netbird uses WebRTC ICE implemented in pion/ice library to discover connection candidates when establishing a peer-to-peer connection between devices.
- Peers negotiate connection through Signal Service.
- Signal Service uses public Wireguard keys to route messages between peers. Contents of the messages sent between peers through the signaling server are encrypted with Wireguard keys, making it impossible to inspect them.
- Occasionally, the NAT traversal is unsuccessful due to strict NATs (e.g. mobile carrier-grade NAT). When this occurs the system falls back to the relay server (TURN), and a secure Wireguard tunnel is established via the TURN server. Coturn is the one that has been successfully used for STUN and TURN in Netbird setups.
Product Roadmap
Client Installation
Linux
APT/Debian
- Add the repository:
sudo apt-get update sudo apt-get install ca-certificates curl gnupg -y curl -L https://pkgs.wiretrustee.com/debian/public.key | sudo apt-key add - echo 'deb https://pkgs.wiretrustee.com/debian stable main' | sudo tee /etc/apt/sources.list.d/wiretrustee.list
- Update APT's cache
sudo apt-get update
- Install the package
# for CLI only sudo apt-get install netbird # for GUI package sudo apt-get install netbird-ui
RPM/Red hat
- Add the repository:
cat <<EOF | sudo tee /etc/yum.repos.d/wiretrustee.repo [Wiretrustee] name=Wiretrustee baseurl=https://pkgs.wiretrustee.com/yum/ enabled=1 gpgcheck=0 gpgkey=https://pkgs.wiretrustee.com/yum/repodata/repomd.xml.key repo_gpgcheck=1 EOF
- Install the package
# for CLI only sudo yum install netbird # for GUI package sudo yum install netbird-ui
MACOS
Homebrew install
- Download and install homebrew at https://brew.sh/
- If wiretrustee was previously installed with homebrew, you will need to run:
# Stop and uninstall daemon service:
sudo wiretrustee service stop
sudo wiretrustee service uninstall
# unlik the app
brew unlink wiretrustee
netbird will copy any existing configuration from the Wiretrustee's default configuration paths to the new Netbird's default location
- Install the client
# for CLI only
brew install netbirdio/tap/netbird
# for GUI package
brew install --cask netbirdio/tap/netbird-ui
- If you are install CLI only, you need to install and start the client daemon service:
sudo netbird service install
sudo netbird service start
Installation from binary (CLI only)
- Checkout Netbird releases
- Download the latest release (Switch VERSION to the latest):
curl -o ./netbird_<VERSION>_darwin_amd64.tar.gz https://github.com/netbirdio/netbird/releases/download/v<VERSION>/wiretrustee_<VERSION>_darwin_amd64.tar.gz
- Decompress
tar xcf ./netbird_<VERSION>_darwin_amd64.tar.gz
sudo mv netbird /usr/bin/netbird
chmod +x /usr/bin/netbird
After that you may need to add /usr/bin in your PATH environment variable:
export PATH=$PATH:/usr/bin
- Install and run the service
sudo netbird service install
sudo netbird service start
Windows
- Checkout Netbird releases
- Download the latest Windows release installer
netbird_installer_<VERSION>_windows_amd64.exe
(Switch VERSION to the latest): - Proceed with installation steps
- This will install the client in the C:\Program Files\Netbird and add the client service
- After installing, you can follow the Client Configuration steps.
To uninstall the client and service, you can use Add/Remove programs
Client Configuration
If you installed the UI client, you can launch it and click on Connect
It will open your browser, and you will be prompt for email and password
Simply run:
netbird up
It will open your browser, and you will be prompt for email and password
Check connection status:
netbird status
In case you are activating a server peer, you can use a setup-key as described in the steps below:
- Login to the Management Service. You need to have a
setup key
in hand (see ).
For all systems:
netbird up --setup-key <SETUP KEY>
For Docker, you can run with the following command:
docker run --network host --privileged --rm -d -e NB_SETUP_KEY=<SETUP KEY> -v netbird-client:/etc/netbird netbirdio/netbird:<TAG>
TAG > 0.6.0 version
Alternatively, if you are hosting your own Management Service provide --management-url
property pointing to your Management Service:
sudo netbird up --setup-key <SETUP KEY> --management-url http://localhost:33073
You could also omit the
--setup-key
property. In this case, the tool will prompt for the key.
- Check connection status:
netbird status
- Check your IP: For MACOS you will just start the service:
sudo ifconfig utun100
For Linux systems:
ip addr show wt0
For Windows systems:
netsh interface ip show config name="wt0"
- Repeat on other machines.
Troubleshooting
-
If you are using self-hosted version and haven't specified
--management-url
, the client app will use the default URL which ishttps://api.wiretrustee.com:33073
. -
If you have specified a wrong
--management-url
(e.g., just by mistake when self-hosting) to override it you can do the following:netbird down netbird up --management-url https://<CORRECT HOST:PORT>/
To override it see solution #1 above.
Running Dashboard, Management, Signal and Coturn
Legal
WireGuard is a registered trademark of Jason A. Donenfeld.