#netbird — Public Fediverse posts

Netbird is showing some new showstoppers. It's very easy to publish a service from internal network. Netbird uses internally Traefik for reverse proxy, and it all gets configured automatically - certificates and all.

But there is downside: there are no usual options available for reverse proxy customization like URL rewrite, response rewrite, caching etc. I can do a little bit of tweaking with docker labels, but it's already an uphill battle. I can apparently replace the whole reverse proxy with e.g. nginx, but then i lose all the automation from Netbird+Traefik.

Netbird should also be able to do TCP/UDP port forwarding. But after defining one, it doesn't work. When checking the reverse proxy machine, i see nothing listening that port nor anything in iptables.

I have some management tools using http internally, which i hoped to be able to wrap into https. They have links to e.g. consoles. These are typically like http://ip:port, and auto-generated from e.g. container definitions. Netbird can rewrite the address of the tool itself, but not these links to other services.

I think i'll look some alternatives. I have one service which absolutely needs cache at the edge, and few others using TCP/UDP port forwarding.
#homelab #vpn #netbird #zerotrust #security #opensource #selfhosting

Second try to install Netbird is going smoothly. My first attemp ran into showstoppers after deploying Netbird into hosts running virtual and containers, and to clients. This time:
- Didn't install Netbird to hosts nor clients.
- Deployed a Netbird client container to each VLAN.
- Created network definitions in Netbird manager for each VLAN.
- Added the Netbird client containers as routing peer in their corresponding network.
- Added container/vm endpoints as https services in their corresponding network definition. Target ip/port is their location in VLAN, In access rights added SSO requirement plus limited their global visibility.

After those steps I have services available both in old home network and in Netbird. At home I can access e.g. HTTP://syncthing.local:8384/ , and the same via Netbird at https://syncthing.home.example.com/ . The Netbird address is public but protected by Netbird SSO login. Both work at the same time.

The good thing is that I can migrate and test each service in a stable environment over several weeks. Few test migrations have now proved it.

The bad thing is that this is only half-secure. But my first attempt failed because going fully into Netbird was too demanding, needing everything configured at once. Now I can migrate gradually.

The next step is to finish publishing all services in Netbird.

In third step I plan to isolate the VLANs, and close the old, local access in their firewall. I can e.g. isolate a Syncthing VLAN, remove access to its GUI in firewall, and allow only the p2p traffic between Syncthing instances. The GUI is accessible only via the Netbird routing peer container, placed into same segment. When finished, all client access to services would be through public Netbird endpoints, all authenticated and controlled access rights.

Fourth step would be migrating all user clients into Netbird. That would allow me to move some services away from public visibility into Netbird-internal-only. For each service I just replace external SSO login with internal-only access rights.

The last step, migrating hosts, I'm unsure of. It's months away, and needs solutions for e.g. how to put containers into Netbird network. I'll think about it later.
#homelab #vpn #netbird #zerotrust #security #opensource #selfhosting

I have to tear down my Netbird installation and rethink it. The main issue is that it is too invasive. It cuts old connections. That would be OK after everything is migrated to Netbird. The all-or-nothing is a showstopper. I need a path of gradual migration.

I think I need to leave main hosts out of Netbird, and only migrate their containers and virtuals one at a time. I probably need to start by adding a routing container/vm per each VLAN to replace routing via hosts. The old containers stay at old address. The new routing containers would do the NAT/routing between mesh and old VLAN.

Then DNS is second issue. Netbird disables old DNS settings. That was too harsh. I can solve that by leaving client computers away from the initial Netbird network. Then I can continue accessing unmigrated services through private DNS, and migrated services as external client through public DNS with enforced authentication.

#homelab #vpn #netbird #zerotrust #security #opensource #selfhosting

🚀 Deploy #Netbird on #Debian #VPS

This article provides a guide to deploy Netbird on Debian VPS.
What is Netbird?
Netbird is an open-source, WireGuard-based overlay network platform that simplifies secure, peer-to-peer ...
Continued 👉 #selfhosted #selfhosting #reverseproxy #wireguard

🚀 Deploy Netbird on Debian VPS

Netbird is great - and terrible. Netbird is an open source program that creates a virtual zero-trust network. I'm setting up a self-hosted version of it. With it I'm trying to reorganize my homelab with two decades of rigging, and also reorganize the public servers i'm sharing.

So far Netbird has managed to do all i've thrown into it: multiple segments, multiple VLANs, segments behind segments, etc. Policies work, permissions work, and security looks great. But also i've fallen to many bogholes with it.

Some lessons:
- Ignore all docs about environment variables. It's config.yaml now.
- You can make public servers into address like matrix.chat.example.com, and then have private services at files.home.example.com. Just add to manager's docker compose files, proxy.env, one more line: NB_PROXY_PRIVATE=true
found in some release note. O_o
- While e.g. Android connects to private server fine, Windows won't until you add a Netbird DNS server to resolve e.g. home.example.com. Without explicit DNS Windows resolves internal names to manager node's external address, which then rejects the connection because it's coming from the outside.
- The program auto-generates all Traefik rules and fetches certificates in few secs. Having been writing years nginx-confs by hand, or by NPM, or by OPNSense, i'm awestruck.

I guess the program is under speedy development, and documents lag behind. They are dropping updates *every day*, which is great - and terrible.
#homelab #vpn #netbird #zerotrust #security #opensource #selfhosting

🚀 Deploy #Netbird on #Debian #VPS

This article provides a guide to deploy Netbird on Debian VPS.
What is Netbird?
Netbird is an open-source, WireGuard-based overlay network platform that simplifies secure, peer-to-peer ...
Continued 👉 #selfhosting #wireguard #reverseproxy #selfhosted

🚀 Deploy Netbird on Debian VPS

En las últimas semanas logré implementar #netbird en mi propio servidor para tener una red "interna" entre varios dispositivos y tener aplicaciones auto-hosteadas.

Comparado con #tailscale fue mucho más fácil crear enlaces a servicios que sean accesibles por un dominio disponible en internet.

Ahora toca experimentar con proxmox en una notebook vieja para un lugar donde guardar fotos lejos de las grandes tecnológicas.

🚀 Deploy #Netbird on #Debian #VPS

This article provides a guide to deploy Netbird on Debian VPS.
What is Netbird?
Netbird is an open-source, WireGuard-based overlay network platform that simplifies secure, peer-to-peer ...
Continued 👉 #reverseproxy #selfhosting #selfhosted #wireguard

🚀 Deploy Netbird on Debian VPS

🚀 Deploy #Netbird on #Debian #VPS

This article provides a guide to deploy Netbird on Debian VPS.
What is Netbird?
Netbird is an open-source, WireGuard-based overlay network platform that simplifies secure, peer-to-peer connectivity between devices. It enables Zero Trust Network Access (ZTNA) without complex firewall rules or #VPN gateways, automatically connecting computers, servers, and cloud ...
Continued 👉 https://blog.radwebhosting.com/deploy-netbird-on-debian-vps/?utm_source=mastodon&utm_medium=social&utm_campaign=mastodon.raddemo.host #selfhosting #selfhosted #reverseproxy #wireguard

@sp4rkr4t I'm beginning with #netbird after using #tailscale for some time. I'm very novice, but is working good for the reverse proxy, lot easier than what I tried with tailscale.

🚀 Deploy #Netbird on #Debian #VPS

This article provides a guide to deploy Netbird on Debian VPS.
What is Netbird?
Netbird is an open-source, WireGuard-based overlay network platform that simplifies secure, peer-to-peer connectivity between devices. It enables Zero Trust Network Access (ZTNA) without complex firewall rules or #VPN gateways, automatically connecting computers, servers, and cloud ...
Continued 👉 https://blog.radwebhosting.com/deploy-netbird-on-debian-vps/?utm_source=mastodon&utm_medium=social&utm_campaign=mastodon.raddemo.host #reverseproxy #selfhosted #selfhosting #wireguard

NetBird vs Tailscale: el Layer 4 reverse proxy de NetBird + control plane self-hosted es un game changer para homelabs que necesitan soberania total de datos. Migre un cliente de salud (EU, datos sanitarios) de Tailscale a NetBird hace 3 meses por requisito legal: los datos no pueden salir de infraestructura EU. El relay QUIC en 0.74.7 redujo latencia cross-region un 40%. Trade-off: las ACLs son mas granulares pero la UI a escala necesita cariño. Para homelabs personales Tailscale sigue ganando en facilidad. #NetBird #Tailscale #Homelab #SelfHosted #Networking #Privacy

🚀 Deploy #Netbird on #Debian #VPS

This article provides a guide to deploy Netbird on Debian VPS.
What is Netbird?
Netbird is an open-source, WireGuard-based overlay network platform that simplifies secure, peer-to-peer connectivity between devices. It enables Zero Trust Network Access (ZTNA) without complex firewall rules or #VPN gateways, automatically connecting computers, servers, and cloud ...
Continued 👉 https://blog.radwebhosting.com/deploy-netbird-on-debian-vps/?utm_source=mastodon&utm_medium=social&utm_campaign=mastodon.raddemo.host #reverseproxy #selfhosting #wireguard #selfhosted

I think I'll drop my #netbird experiment, I'm more comfortable with bare metal wireguard.
Also, the (recent???) changes/ options in the web UI in regards to exit router vs routes are just plain confusing to me.

@JulianOliver same for people who use @tailscale private exit nodes via #mullvad which costs $5 (btw one alternative to #tailscale worth mentioning is #NetBird)

I know I'm probably late to the show, but self-hosted #NetBird is amazing. Currently sitting in the train and having immediate access to all machines that I need without having to dial into various VPNs is a real game changer for me.

🚀 Deploy #Netbird on #Debian #VPS

This article provides a guide to deploy Netbird on Debian VPS.
What is Netbird?
Netbird is an open-source, WireGuard-based overlay network platform that simplifies secure, peer-to-peer ...
Continued 👉 #selfhosted #wireguard #reverseproxy #selfhosting

🚀 Deploy Netbird on Debian VPS

🚀 Deploy #Netbird on #Debian #VPS

This article provides a guide to deploy Netbird on Debian VPS.
What is Netbird?
Netbird is an open-source, WireGuard-based overlay network platform that simplifies secure, peer-to-peer connectivity between devices. It enables Zero Trust Network Access (ZTNA) without complex firewall rules or #VPN gateways, automatically connecting computers, servers, and cloud ...
Continued 👉 https://blog.radwebhosting.com/deploy-netbird-on-debian-vps/?utm_source=mastodon&utm_medium=social&utm_campaign=mastodon.raddemo.host #selfhosting #reverseproxy #wireguard #selfhosted

🚀 Deploy #Netbird on #Debian #VPS

This article provides a guide to deploy Netbird on Debian VPS.
What is Netbird?
Netbird is an open-source, WireGuard-based overlay network platform that simplifies secure, peer-to-peer ...
Continued 👉 #selfhosted #reverseproxy #selfhosting #wireguard

🚀 Deploy Netbird on Debian VPS