Self-host NetBird

VPN & Mesh Networking

deployed & timed by usprices checked · Jul 2026

An open-source WireGuard-based mesh VPN that connects your devices, servers, and clouds into a single private network with SSO and access controls — a self-hostable alternative to Tailscale and Twingate. The client is BSD-3-licensed; the self-hosted control-plane components (management, signal, relay) are AGPL-3.0.

Tailscale / yr$96

Self-hosted / yr~$55

You keep$41/yr

Pocket the difference — spin it up on a cheap VPS in minutes.Start free on Kamatera →

Key facts

CategoryVPN & Mesh Networking

LicenseBSD-3-Clause

StackGo

Min RAM2048 MB

Dockeryes

Difficulty

What you need

Any VPS with at least 2048 MB of RAM
A domain you control — most self-hosted setups need HTTPS in front of them
About the better part of a day

Install

Run these commands on your server:

# NetBird — self-hosted control plane (management, signal, relay, dashboard)
export NETBIRD_DOMAIN=netbird.example.com
# The script prompts for a reverse proxy and a Let's Encrypt email —
# run it at a real terminal, it reads /dev/tty and loops without one.
curl -fsSL https://github.com/netbirdio/netbird/releases/latest/download/getting-started.sh | bash
# Publishes 80 + 443/tcp (dashboard), 51820/udp (relay), 3478/udp (TURN).

deploy guideHow to Deploy NetBird on a VPS vps picksBest VPS for self-hostingbenchmarked quarterly · re-priced monthly

An alternative to

Tailscale →

Head-to-head

VPNJul 2026

NetBird

Headscale

An all-in-one mesh vs. your own Tailscale control plane.

Expose services to the world vs. a private mesh.

Read the verdict →

More in VPN & Mesh Networking

VPN & Mesh NetworkingHeadscale

An open-source, self-hosted implementation of the Tailscale control server — run your own coordination plane for a private WireGuard mesh and keep using the official Tailscale clients, without depending on Tailscale's hosted service.

moderateRead guide →

VPN & Mesh NetworkingPangolin

A self-hosted tunneled reverse proxy that exposes services on your private network to the internet over WireGuard, with built-in identity, access control, and automatic SSL. A self-hostable alternative to Cloudflare Tunnel that keeps the ingress on a server you own.

TypeScriptGo

moderateRead guide →

VPN & Mesh Networkingwg-easy

The easiest way to run your own WireGuard VPN server, with a clean web UI for adding and managing clients — a self-hosted alternative to Tailscale and commercial VPNs for private access to your network from anywhere.

TypeScriptNode.js

easyRead guide →

Command Palette