Install a self-hosted VPN platform // Netbird
Рет қаралды 62,986
Күн бұрынNetbird is a new VPN platform that I recently installed and tested in my Homelab. It uses the fast and secure WireGuard protocol to establish point-to-point tunnels between all my devices, including cloud and HomeLab servers, PCs, Macs, and phones. With its zero-trust features and the option to self-host, Netbird offers a flexible and secure solution for connecting and protecting your devices. Join me as I install the self-hosted open-source deployment of Netbird, and I walk through all the important features and give my honest review of this exciting new platform.
References:
Netbird: netbird.io
Netbird GitHub Repo: github.com/netbirdio/netbird
________________
💜 Support me and become a Fan!
→ christianlempa.de/patreon
💬 Join our Community!
→ christianlempa.de/discord
________________
Read my Tech Documentation
christianlempa.de/docs
My Gear and Equipment-*
christianlempa.de/kit
________________
Timestamps:
00:00 Introduction
01:03 Netbird overview
03:20 Install self-hosted Netbird platform
12:30 How does Netbird work?
15:05 Install Netbird agent
19:05 Access Control policies
23:50 Posture checks
25:27 Network Routes and DNS
29:40 Final thoughts
________________
All links with `*` are and/or include affiliate links.
@netbirdio 3 ай бұрын
Amazing! Thank you, Christian from the whole NetBird team.
@christianlempa 3 ай бұрын
Thank you, guys!
@MichelStumpf 3 ай бұрын
Over the last couple of years, have used Tailscale, Headscale with Tailscale, Twingate... but remove everything to migrate to selfhosted Netbird... Great tool with the right features I need to my personal needs... Well done ... one thing missing though is to be able to route traffic to Internet via a given connected agent
@ti4go 3 ай бұрын
PLEASE implement exit nodes!! There is a full git request with multiple votes for this feature
@RyanMcCue42 3 ай бұрын
There’s an open draft PR and it is on their roadmap for this month!
@drizzlymood 3 ай бұрын
The access control policy configuration is intuitive compared to Tailscale. Good job, guys.
@BalintAdorjan 2 ай бұрын
This thing is awesome. I'm searching for like 2 weeks now for a zero trust like get-to-home solution with which I can use domain names, and i think now I don't need to look anywhere else. Thank you for the video, I love all of yours. Thank you for the good content, keep it up!
@KardonGER 3 ай бұрын
Thank you Christian. Since I've struggled the last couple days with installing headscale in my environment, this is really the perfect timing for me, that you released this video 👍👍😁😁
@christianlempa 3 ай бұрын
Awesome! Hope it helps a bit 😊
@ichilvers 3 ай бұрын
I did like headscale / tailscale, but I needed a LAN-to-LAN solution and headscale seemed to be peer access only. I could be wrong, but I couldn't see a way of configuring LAN-to-LAN.
@_TbT_ 3 ай бұрын
@@ichilvers“Network routes“ is where you can configure that with Netbird.
@SpiritedSeeker 2 ай бұрын
+1 on the comparison video. Thanks for making this one! After banging my head against the wall getting headscale to run and realising how it is still missing a bunch of features, really excited to give a fully supported foss variant a go! I have no idea why anyone would trust tailscale to run the controllers. So I am super happy that this exists! Thanks netbird team ❤❤❤
@christianlempa 2 ай бұрын
Glad it helped!
@playeronthebeat 3 ай бұрын
Without watching the video, yet, I just wanted to chime in and say that I've tried NetBird, too, but gave up due to me not fully understanding it and it giving me a headache but I'll try it at a later stage when I got more time and I'll happily watch your video, too, to get some help and tips on that matter! It's like you've been listening to me!
@christianlempa 3 ай бұрын
Haha amazing 🤩
@netbirdio 3 ай бұрын
hey there. What exactly you had difficulty understanding? And what is your use case, home or work?
@playeronthebeat 3 ай бұрын
@@netbirdio It's for home use, really. I guess, it was just the combination of multiple factors: Me getting excited jumping ahead, following your guide and maybe leaving it to early. I'll work on it during the weekend a little further. My main point was (could be HW related!) that Zitadel was awfully slow (want to check out the other options) and I had troubles routing traffic through, for example, Finland (got a server there, where I installed NetBird, too, as well). I will get back to you after watching this video on looking through your documentation a little more. Honestly, it could've been my fault all the time (I'm currently sick as well, which doesn't make things better if you can't think properly lol). Thanks for reaching out!
@netbirdio 3 ай бұрын
@@playeronthebeat We probbaly need to improve our advanced guide indeed. The quickstart guide should be enough for home use :) Thank you for the feedback!
@Oliveira-Tech 3 ай бұрын
@@netbirdio Even when I release the ports correctly on my network, the wainting zitadel message keeps loading forever. I've done everything and I still can't complete the installation.
@4733R70 3 ай бұрын
thank you for this video! you are always reliable! i have often used in my company solutions that you brought us in your videos
@christianlempa 3 ай бұрын
Thank you! That's nice to hear :)
@chrisumali9841 Ай бұрын
Awesome demo and setup, thanks for the information. Have a great day
@christianlempa Ай бұрын
Thanks! you too :)
@nicoladellino8124 3 ай бұрын
Very useful video, THX Christian.
@christianlempa 3 ай бұрын
Thank you! :)
@safaros38 3 ай бұрын
I was breakin gmy head with this for the last 3 days and when I finally get it to work I see this video lmao. Still learned some tricks. Great stuff.
@Seba11PL 3 ай бұрын
Thx! Definitly need to check this and think to change from my old one ipsec l2tp vpn.
@cheebadigga4092 3 ай бұрын
same for me, using raw WireGuard at the moment and the access policy stuff in Netbird seems like a godsent
@cheebadigga4092 3 ай бұрын
Daaaaaaaamnnnnnnn this is awesome!!! Thank you so much for this! Gonna try it right away :D
@christianlempa 3 ай бұрын
Cool! Let me know how it works for you :)
@cheebadigga4092 3 ай бұрын
@@christianlempa unfortunately Zitadel won't start up. Somehow some ports don't seem to be open but I setup NAT correctly. 80 and 443 are open but the others are not... maybe it's a layer 8 issue lol I'll try again sometime later today
@Glatze603 3 ай бұрын
Hi Christian, thanks for this video. Netbird is awesome. I only use 2 internal vm´s as a peer group in the netbird server, that are installed in a separate vlan at home. So I have to define access policies in the netbird server ui and I have to create firewall rules at home in order to communicate with any other systems in my homelab (and in other vlans than the both vm´s) over these 2 vm´s. The advantage is, that I have another layer of security (if someone gets access to your admin-account, he could change the access ruls to any/any, but he can not change my firewall-rules in my homelab) and I only have to install 2 internal netbird-clients. Unfortunately some features that you described are only available with business subscription (device posture checks), but the self hosting edition is a really cool and secure solution.
@milicsantiago 3 ай бұрын
great video Christian!
@christianlempa 3 ай бұрын
thank you! :)
@dean.kannenberg 3 ай бұрын
Great Video! Thank you again for that!
@christianlempa 3 ай бұрын
Glad you enjoyed it!
@michael.andreae 3 ай бұрын
I have to try this!
@FaithMediaChannel 2 ай бұрын
Thank goodness for this video
@christianlempa 2 ай бұрын
Thanks for watching :)
@freestudymusic550 3 ай бұрын
I actually use netbird a long time ago anyway great video ❤
@christianlempa 3 ай бұрын
Thank you!
@thiagomz 3 ай бұрын
Thank you ! Amazing !
@christianlempa 3 ай бұрын
Thanks 😊
@mihirishan 3 ай бұрын
A short speed comparison between other providers like tailscale and zerotier would be great.
@christianlempa 3 ай бұрын
Since it uses the same protocol stack, I didn’t consider doing it. Maybe when I make a comparison video in the future that would be a good addition 👍
@sulochanacharya4892 3 ай бұрын
I actually found latency to be double of that to tailscale when I did testing by connecting a dallas vps to a chicago vps
@LtdJorge 3 ай бұрын
@@christianlempayeah speed comparison is not very useful. Since all use WG, a features comparison is more important, because it’s how they differentiate from each other.
@iwaf 3 ай бұрын
@@LtdJorgewell it still matters to some people, and we could definitely see some differences cause tailscale has been doing a lot of optimizations on their wireguard integration for the past years iirc tailscale provides its own drivers for wg, which leads to better bandwidth, less latency and less cpu overhead
@ThatNateGuy 3 ай бұрын
I would love to see a video on Zitadel, too!
@christianlempa 3 ай бұрын
It would be interesting, however, I'm looking at another IdP solution called authentik, video is coming next week hopefully ;)
@ThatNateGuy 3 ай бұрын
@@christianlempa I've heard of that one as well. I'm excited!
@LtdJorge 3 ай бұрын
@@christianlempaAuthentik is pretty simple and works well. I’d like to try Keycloak too and maybe integrate it with FreeIPA
@davidszabo6836 3 ай бұрын
How is this even possible that you coming up with those ideas/problems that I'm currently trying to solve? It integrates with Authentik identity provider as well, that I recently set up! Nice T-shirt by the way. :D
@christianlempa 3 ай бұрын
Awesome! Thanks 😊
@theprecipiceofreason 3 ай бұрын
The thing I love about VPN conversation is that it's nearly always in the context of privacy, on windows devices, while widgets just harvest all of your data and now copilot does the same. Hilarious.
@fixplizz 3 ай бұрын
Came across your channel and liked the videos. very high quality content. It just so happens that there is a cluster of proxmox servers of different configurations at hand. No separate storage. Can you tell me if you have any articles or videos on how to unite different hardware into one convenient interface? How to properly distribute storage and virtual machine management. Thanks in advance!
@christianlempa 3 ай бұрын
Thank you so much! :) I've done some videos on Linux Server OS, featuring Proxmox, etc. Maybe that's gonne be helpful
@johnnydepp4114 3 ай бұрын
Awsome Video!!!! very very nice :)
@christianlempa 3 ай бұрын
Thank you very much!
@johnnydepp4114 3 ай бұрын
@@christianlempaYou are very much welcome :) What do you think of putting their selv-hosted server with so many ports open as a webfaced server ? I am slightly concerned My connections stops working if i make fw rules for the sites i want to be connected aka source ip. - I recon it can be because of the certificates from Letsencrypt cant check the connection server anymore. and Zitidal is doing somthing too, as it stalled first time installing the server when i forgot to open the ports at before install I actually think Headscale is better here, as you can make source ip and still working. Tho i am missing the 2FA method there Thanks again for the video :) :)
@MhNetSecurity 20 күн бұрын
Thank you for the video, I`m planning to deploy this solution to have a remote access to clients sites everywhere ,I did test that with a self-hosted server on AWS, I configured a Raspi on my local network to test with, and it`s easily blocked by the snort IPS installed on pfsense. So I imagine it wont work as all our clients have a sophisticated IPS installed.
@deeds793 3 ай бұрын
Thanks for this video. I've been looking at all the different self hosted options out there. Does netbird work with NGINX Proxy Manager? Also thank you for touching on the routes for connecting to "LAN" resources. Hoping to use this with phones to connect to my pihole instance for on the road DNS filtering. Overall really thorough and well put together video. Keep them coming!
@christianlempa 3 ай бұрын
You're welcome ;) I've not tested it with NPM, but I don't see a reason why it shouldn't
@fathnojoum Ай бұрын
How to update the latest version in Linux if there is an Update notification?
@tomstechnews 3 ай бұрын
Great vid! Thanks. A tailscale killer?
@christianlempa 3 ай бұрын
Thanks! Maybe? :D
@KR1ML0N 3 ай бұрын
Might have to try this. I've been looking for an alternative to wireguard.
@_TbT_ 3 ай бұрын
Netbird is controller based Wireguard. The controller does the annoying key exchange for you.
@tsaopaulo 2 ай бұрын
Awsome video, can you please cover Zitadel using Google as an identity provider?
@TillmannHuebner 22 күн бұрын
Would be more interesting to see a tutorial on how to use another auth provider instead of zitadel or how to deploy zitadel and then attach netbird so you can actually reuse zitadel.
@leonkernan 3 ай бұрын
Have they fixed the insane battery usage on the iOS client yet?
@ExpandDog 3 ай бұрын
MFA should not be a paid only option IMO, its an essential feature to a program that can access all my systems
@mikhailbragin5255 3 ай бұрын
It is available in a free plan via your IDP (Google, MS…) You can enable it there and it will be automatically added to NetBird
@Glatze603 3 ай бұрын
MFA is available in the free plan for accessing/protecting the netbird server web-ui. The function descriptions are a bit misleading.
@ExpandDog 3 ай бұрын
@@Glatze603 yeah installed it myself and found that out, kinda shooting themselves in the foot a bit not pointing out what they really mean
@RazoBeckett. 3 ай бұрын
hey yooo!
@volleyballaligse 3 ай бұрын
The install script fails with: Creating new Zitadel SPA Cli application ERROR calling create_service_user_secret_id: User could not be found (QUERY-Dfbg2) Probably a zitadel issue... :(
@JustinJ. 3 ай бұрын
6:00 What are you using to do the arrows and green lines?
@christianlempa 3 ай бұрын
It's called "ScreenBrush"
@davidzuccarini8376 Ай бұрын
I have a question does autohost have limits?
@Trozpent 2 ай бұрын
@Christian - you change infrastructure security more often then Matt @ The Linux Cast changes distro's! 🤣
@christophappel9341 3 ай бұрын
Hi christian, we tried it also on our company, but in out test every user on an domain joined laptop had the same connection and no additional authentication was needed. For us this is a no go. In a zero trust setup every user needs the own connection. Is there a setting to change this? Greetings christoph
@Brinkmasterj 3 ай бұрын
In the ACL can you set up servers to not talk to each other but a set of clients have access to all servers?
@Glatze603 3 ай бұрын
Yes! To allow something you have to explicitly allow it via an access rule. All other traffic is denied - these are firewall basics.
@Crypherr Ай бұрын
Thanks for the video, Any ideas as to how a self-hosted instance of Netbird can secure a Synology NAS?
@christianlempa Ай бұрын
Good question, I don't have a Synology NAS to test :/
@tailorkhartah7302 3 ай бұрын
new to this , its this like a vpn ?
@vasquezmi 3 ай бұрын
Hello Christian any thoughts or recommendations on how to manage netbird through a reverse proxy?
@christianlempa 2 ай бұрын
No, yet. Have just tried this self-hosting version :D
@randomnoobpt 3 ай бұрын
Since the installation is using docker, could this be done on TrueNAS Scale? I've been trying to get it working but no luck :(
@christianlempa 3 ай бұрын
In theory, yes, but since TrueNAS Scale is using Kubernetes, you'll have to write your own charts and so on. It's a bit complicated.
@kylelaker539 Ай бұрын
How fast do you think is this when streaming plex while netbird is on and using your mobile data accessing your plex server at home? Tailscale is doable but i have a problem where it buffers and you have to pause it for 3 to 5minutes to download the stream and watch it.?
@christianlempa Ай бұрын
Netbird uses the same protocol that tailscale uses, so I'd expect it to have similar performance.
@eikeholz 2 ай бұрын
Serious question: I have setup NetBird on their servers, I’ve added a few peers, but when I connect two peers to NetBird I’m not able to do or reach anything. My phone says, it’s connected to a vpn, but I’m still getting the ip address from my mobile provider, not from my home network. On my server the NetBird client runs as a docker container.. anybody has some ideas?
@emiellr 3 ай бұрын
Hey Christian, your face footage at the start of the video (at least) is quite laggy *(
@xiLike2Doitx 3 ай бұрын
I wish this would rollout into kubernetes
@fakharhussain219 3 ай бұрын
QQ: Why someone who uses Tailscale would switch to Netbird?
@HaiHoang-nc7mp 2 ай бұрын
I tried installing Netbird and found out that without a domain and email server I can't use it, I'm stuck there and can't use it anymore :)
@MadChristianX 3 ай бұрын
is netbird secure? my MacOS 14.4 warns me about the client app that is has to be renewed.
@ti4go 3 ай бұрын
I have stopped using Netbird because of the lack of exit nodes... Once implemented, im switching back!
@netbirdio 3 ай бұрын
On the roadmap and we are already working on it!
@ti4go 3 ай бұрын
@@netbirdio Niice! TY!
@ichilvers 3 ай бұрын
I must confess I really like Netbird too. However I have had some issues, mainly with LANA to NetBird to LANB routing. I.e. a device on LANA talking to a device on LANB through the NetBird VPN. It only seems to work if the access control default policy is set from all to all, allowing all, which is a shame. I'm sure its a bug, or missing feature, as the UI looks like it should work. Oh Hum. That said I do like NetBird. My favourite VPN solution "would have been" NetMaker, but since features like egress and relay has moved from the CE edition NetBird got one number slot ;-)
@christianlempa 3 ай бұрын
Cool! Yeah, Netbird is truly amazing
@Roadsguy 3 ай бұрын
I'm hosting it locally on my own network, but I don't see any of the tabs on the left sidebar when I log into the admin panel, so I can't proceed with adding a peer. Anyone have any idea why? I'm logged in with the automatically created admin account.
@christianlempa 3 ай бұрын
Maybe check out the support community of netbird
@InsaiyanTech Ай бұрын
Can I encrypt the tunnel with a vpn like NordVPN while using this? So I can have it still hidden by my isp
@christianlempa Ай бұрын
No idea, I haven't used NordVPN yet.
@InsaiyanTech Ай бұрын
@@christianlempa dang thanks for responding though
@lucaschneider4714 3 ай бұрын
Hey Christian. Mich würde mal interessieren, als was du arbeitest, also der genaue Fachbereich. Fällt das unter DevOps oder wie ist deine genaue Job Bezeichnung (sofern du nicht vollzeit KZfaqr bist)
@christianlempa 3 ай бұрын
Hi! Ich komme aus dem IT Support und bin aktuell als Technical Account Manager angestellt. Allerdings arbeite seit einiger Zeit mehr oder weniger Projekt-basiert was auch viel mit dem Bereich automatisierung, security, usw. zu tun hat. Eventuell werde ich mich da demnächst weiterentwickeln, aber mal sehen... ;)
@patrickjoseph3412 3 ай бұрын
Las Pollos hermanos... Have the same shirt but purple
@christianlempa 3 ай бұрын
Awesome 👊
@patrickcasavant1044 3 ай бұрын
Is the self hosted version have all the same features as the cloud version?
@RyanMcCue42 3 ай бұрын
Yes
@netbirdio 3 ай бұрын
Nope. These are available in the cloud but not in the self-hosted version: 1. Identity provider groups and users sync 2. Event streaming to Datadog and others 3. Peers approval 4. Geo distributed relay servers 5. Posture checks with Crowdstrike 6. User invites (thought, as Christian explained in the video, it can be done with Zitadel)
@patrickcasavant1044 3 ай бұрын
@@netbirdio 😒Will they be add at somepoint? Do you have plan for non profit or school entities?
@netbirdio 3 ай бұрын
@@patrickcasavant1044 we haven’t thought about it but it is possible. For nonprofits and schools all cloud plans have a 50% discount.
@patrickcasavant1044 3 ай бұрын
@@netbirdio Maybe you shoud change this sentence on the pricing web page. "The self-hosted version is open-source and free to use "without any limitations"."
@repairstudio4940 3 ай бұрын
So NetBird is Peer to Peer from my understanding and can provide a secure way for other users to work on the same project. Now CloudFlare can also do the same thing basically right if your hosting your server in via a CloudFlare tunnel however its not just Peer to Peer in CloudFlare making it less secure than NetBird? Am I understanding this right Christian? 🤔🤔
@christianlempa 3 ай бұрын
There will be a comparison video at some point
@repairstudio4940 3 ай бұрын
@@christianlempa that's be awesome thank you immensely. I get lost in so many facets of different cloud infrastructure and many can be utilized many ways and it's always awesome to explore the possibilities with them.
@theangelofspace155 3 ай бұрын
So another tailscale?
@_TbT_ 3 ай бұрын
But with self-hosting officially supported and documented by the company itself.
@leonkernan 3 ай бұрын
More like a Headscale server and Tailscale clients.
@EDIIIZ 3 ай бұрын
no IPv6 support unfortunately!
@michaelpietrzak2067 3 ай бұрын
Better than cloudflare tunnel?
@freestudymusic550 3 ай бұрын
Cloud flare tunnel are for end user not homelab
@Glatze603 3 ай бұрын
@@freestudymusic550That´s not correct. I use cloudflare tunnel for homelab, too. It is another technology than netbird, but awesome, too.
@wombatpt Ай бұрын
Doesn't work, but thanks for the video.
@Elker54 3 ай бұрын
Putting MFA behind a paywall is really bad. Why? It makes no sense
@netbirdio 3 ай бұрын
It is not behind a paywall. If you use SSO login with Google, MS, Github, etc and enable MFA there, then you will have it in NetBird automatically. Also in the free plan. The paid one is for accounts with username/password where we will need to configure MFA manually.
@tritnaha1345 2 ай бұрын
It's cool and all, but netbird is severely lacking in documentation - i ended up just reinstalling tailscale
@drewlarson65 3 ай бұрын
Here's a video idea for ya: MacOS: The linux-distro that will make you sad!
@christianlempa 3 ай бұрын
Nah, I don't want to fight or argue with the linux community :D
@fbifido2 Ай бұрын
@18:33 - can you make it so the admin has to approve each connection before the client can access the network?
@shephusted2714 2 ай бұрын
just use wireguard and save money - it is the same core tech
@DSVWARE 3 ай бұрын
It would be nice if you disclosed this is a sponsored / ad video... The watermarks on the top right corner is not enough
@keeswolterstorff940 3 ай бұрын
Absolutely have to agree here, some of the more recent videos have been with either closed source or have anti-features, or they've been sponsored ones, which seem not too unbiased of reviews.
@GeorgeAlexanderTrebek 3 ай бұрын
Instantly what i thought as well... he needs to make it way more clear from the start that its an advert.
@brathaneq 3 ай бұрын
He said up front in first minutes that this is sponsored..
@thekikaz 3 ай бұрын
Agree! I understand the need for making money, but this channel is switching to an advert instead of tech channel...
@christianlempa 3 ай бұрын
I’ve done it at multiple places throughout the video, adding a watermark, mentioning it twice in the video (beginning and end), and added the checkmark on YT it includes a promotion. Please tell me: what else should I have to do in your opinion? Really! Because I don’t know…
@ernestoditerribile 3 ай бұрын
Around 8 minutes your screen recording flickers a lot. You are probably using OBS, If you switch to ScreenFlow, You have a way better interface and don't run into those problems. Oops it is visible on all dark screens.
@yongu12 3 ай бұрын
Netbird draining iphone battery hard. More than 50% of used battery by netbird.
@shanagondaarun2436 3 ай бұрын
from my understanding it is glorified and sophisticated tailscale service.
@strangetoucane 3 ай бұрын
More like competitor
@RazoBeckett. 3 ай бұрын
and i am happy using tailscale
@_TbT_ 3 ай бұрын
A correct wording would be: „Tailscale as well as Netbird are controller based Wireguard services.“ There are several other competitors in this space, e.g. Netmaker.
Lawrence Systems
Рет қаралды 60 М.
DVP Development Best Practices
Рет қаралды 2 М.
Lawrence Systems
Рет қаралды 41 М.
Techno Tim
Рет қаралды 68 М.
Immersed
Рет қаралды 65 МЛН
business Us
Рет қаралды 8 МЛН