Connect your devices into a single secure private WireGuard®-based mesh network with SSO/MFA and simple access controls.
Go to file
2022-04-18 09:43:37 +02:00
.github/workflows Skip docker login and upload artifacts (#298) 2022-04-15 18:59:23 +02:00
client Make systray connected/disconnected icon switch faster (#299) 2022-04-18 09:43:37 +02:00
docs Replace Wiretrustee links and naming (#287) 2022-03-26 11:39:27 +01:00
encryption Rename module to netbirdio/netbird (#288) 2022-03-26 12:08:54 +01:00
iface Run tests in serial and update multi-peer test (#269) 2022-03-16 11:02:06 +01:00
infrastructure_files update audience documentation (#291) 2022-04-04 14:22:42 +02:00
management Rename module to netbirdio/netbird (#288) 2022-03-26 12:08:54 +01:00
release_files Fix goreleaser version to 1.6.3 (#266) 2022-03-14 13:16:16 +01:00
signal Rename module to netbirdio/netbird (#288) 2022-03-26 12:08:54 +01:00
util Rename module to netbirdio/netbird (#288) 2022-03-26 12:08:54 +01:00
.gitignore Add Settings window to Agent UI 2022-04-15 17:30:12 +02:00
.goreleaser_ui_darwin.yaml Rename module to netbirdio/netbird (#288) 2022-03-26 12:08:54 +01:00
.goreleaser.yaml Add Settings window to Agent UI 2022-04-15 17:30:12 +02:00
AUTHORS chore: update license and AUTHORS 2022-01-19 16:22:40 +01:00
CODE_OF_CONDUCT.md Conduct (#205) 2022-01-26 09:33:16 +01:00
go.mod Add Settings window to Agent UI 2022-04-15 17:30:12 +02:00
go.sum Add Settings window to Agent UI 2022-04-15 17:30:12 +02:00
LICENSE chore: update license and AUTHORS 2022-01-19 16:22:40 +01:00
README.md Changing back link for Docker (#293) 2022-04-04 21:53:31 +02:00

Big News! Wiretrustee becomes Netbird. Learn more


Start using Netbird at app.netbird.io
See Documentation
Join our Slack channel


Netbird is an open-source VPN platform built on top of WireGuard® making it easy to create secure private networks for your organization or home.

It requires zero configuration effort leaving behind the hassle of opening ports, complex firewall rules, VPN gateways, and so forth.

Netbird automates Wireguard-based networks, offering a management layer with:

  • Centralized Peer IP management with a UI dashboard.
  • Encrypted peer-to-peer connections without a centralized VPN gateway.
  • Automatic Peer discovery and configuration.
  • UDP hole punching to establish peer-to-peer connections behind NAT, firewall, and without a public static IP.
  • Connection relay fallback in case a peer-to-peer connection is not possible.
  • Multitenancy (coming soon).
  • Client application SSO with MFA (coming soon).
  • Access Controls (coming soon).
  • Activity Monitoring (coming soon).
  • Private DNS (coming soon)

Secure peer-to-peer VPN in minutes

Note: The main branch may be in an unstable or even broken state during development. For stable versions, see releases.

Hosted version: https://app.netbird.io/.

UI Dashboard Repo

A bit on Netbird internals

  • Netbird features a Management Service that offers peer IP management and network updates distribution (e.g. when a new peer joins the network).
  • Netbird uses WebRTC ICE implemented in pion/ice library to discover connection candidates when establishing a peer-to-peer connection between devices.
  • Peers negotiate connection through Signal Service.
  • Signal Service uses public Wireguard keys to route messages between peers. Contents of the messages sent between peers through the signaling server are encrypted with Wireguard keys, making it impossible to inspect them.
  • Occasionally, the NAT traversal is unsuccessful due to strict NATs (e.g. mobile carrier-grade NAT). When this occurs the system falls back to the relay server (TURN), and a secure Wireguard tunnel is established via the TURN server. Coturn is the one that has been successfully used for STUN and TURN in Netbird setups.

Product Roadmap

Client Installation

Linux

APT/Debian

  1. Add the repository:
    sudo apt-get update
    sudo apt-get install ca-certificates curl gnupg -y
    curl -L https://pkgs.wiretrustee.com/debian/public.key | sudo apt-key add -
    echo 'deb https://pkgs.wiretrustee.com/debian stable main' | sudo tee /etc/apt/sources.list.d/wiretrustee.list
    
  2. Install the package
    sudo apt-get update
    sudo apt-get install wiretrustee
    

RPM/Red hat

  1. Add the repository:
    cat <<EOF | sudo tee /etc/yum.repos.d/wiretrustee.repo
    [Wiretrustee]
    name=Wiretrustee
    baseurl=https://pkgs.wiretrustee.com/yum/
    enabled=1
    gpgcheck=0
    gpgkey=https://pkgs.wiretrustee.com/yum/repodata/repomd.xml.key
    repo_gpgcheck=1
    EOF
    
  2. Install the package
    sudo yum install wiretrustee
    

MACOS

Brew install

  1. Download and install Brew at https://brew.sh/
  2. Install the client
brew install wiretrustee/client/wiretrustee

Installation from binary

  1. Checkout Netbird releases
  2. Download the latest release (Switch VERSION to the latest):
curl -o ./wiretrustee_<VERSION>_darwin_amd64.tar.gz https://github.com/netbirdio/netbird/releases/download/v<VERSION>/wiretrustee_<VERSION>_darwin_amd64.tar.gz
  1. Decompress
tar xcf ./wiretrustee_<VERSION>_darwin_amd64.tar.gz
sudo mv wiretrusee /usr/bin/wiretrustee
chmod +x /usr/bin/wiretrustee

After that you may need to add /usr/bin in your PATH environment variable:

export PATH=$PATH:/usr/bin
  1. Install and run the service
sudo wiretrustee service install
sudo wiretrustee service start

Windows

  1. Checkout Netbird releases
  2. Download the latest Windows release installer wiretrustee_installer_<VERSION>_windows_amd64.exe (Switch VERSION to the latest):
  3. Proceed with installation steps
  4. This will install the client in the C:\Program Files\Wiretrustee and add the client service
  5. After installing, you can follow the Client Configuration steps.

To uninstall the client and service, you can use Add/Remove programs

Client Configuration

  1. Login to the Management Service. You need to have a setup key in hand (see ).

For Unix systems:

sudo wiretrustee up --setup-key <SETUP KEY>

For Windows systems, start powershell as administrator and:

wiretrustee up --setup-key <SETUP KEY>

For Docker, you can run with the following command:

docker run --network host --privileged --rm -d -e WT_SETUP_KEY=<SETUP KEY> -v wiretrustee-client:/etc/wiretrustee wiretrustee/wiretrustee:<TAG>

TAG > 0.3.0 version

Alternatively, if you are hosting your own Management Service provide --management-url property pointing to your Management Service:

sudo wiretrustee up --setup-key <SETUP KEY> --management-url https://localhost:33073

You could also omit the --setup-key property. In this case, the tool will prompt for the key.

  1. Check your IP: For MACOS you will just start the service:
sudo ipconfig getifaddr utun100

For Linux systems:

ip addr show wt0

For Windows systems:

netsh interface ip show config name="wt0"
  1. Repeat on other machines.

Troubleshooting

  1. If you have specified a wrong --management-url (e.g., just by mistake when self-hosting) to override it you can do the following:

    sudo wiretrustee down
    sudo wiretrustee up --management-url https://<CORRECT HOST:PORT>/
    
  2. If you are using self-hosted version and haven't specified --management-url, the client app will use the default URL which is https://api.wiretrustee.com:33073.

    To override it see solution #1 above.

Running Dashboard, Management, Signal and Coturn

See Self-Hosting Guide

WireGuard is a registered trademark of Jason A. Donenfeld.