Every remote access tool you don't control is a liability. Commercial VPN gateways log your traffic, SaaS zero-trust platforms hold your peer keys, and per-user pricing that looks reasonable for a small team compounds fast as headcount grows. NetBird changes that math: it's an open-source, WireGuard-based overlay network that you host yourself, where your private keys never leave your machines and your access policies live on your own server.
This guide covers a real install of NetBird on is*hosting's Start plan. You'll have a working management dashboard, your first peer connected, and access policies configured by the end.
NetBird is a zero-trust networking platform that assembles four components into a single deployable stack.
The Management service is the control plane. It holds the network map, distributes WireGuard public keys between authorized peers, assigns addresses from the 100.64.0.0/10 block, manages access control rules, handles private DNS, and logs network activity. It runs as the netbird-server container, consolidating what older NetBird deployments ran as four separate containers (management, signal, relay, and STUN).
The Signal service handles peer discovery. Before two peers can talk directly, they need to exchange ICE candidates. Signal brokers that exchange. It stores nothing and sees nothing, since messages are point-to-point encrypted. Once a connection is established, Signal steps out entirely.
The Relay service is the fallback. When direct WireGuard tunnels fail because of carrier-grade NAT or restrictive firewalls, traffic routes through the relay. WireGuard encryption persists through it, so the relay operator sees nothing useful.
The Client agent runs on every peer: your VPS, your laptop, your developer's workstation. It generates a local private key that never leaves the machine, registers with Management, and handles WireGuard tunnel setup.
Two things are off by default and require manual steps. Device posture checks (verifying that a connecting machine meets your security baseline) require the Business cloud plan or equivalent self-hosted configuration. External SSO with providers like Okta or Azure AD requires additional identity provider setup after the initial installation. The quickstart uses NetBird's embedded Dex-based IdP, which handles local user accounts and lets you add external providers later from the dashboard.
NetBird works on Linux, Windows, macOS, iOS, Android, Docker containers, and routers. The self-hosted management server requires Linux.
The cloud version is free for up to five users. Once you need a sixth, you move to the Team plan at $6 per user per month, billed across all users, so six users cost $36 a month. A Start plan VPS on is*hosting covers the same deployment at $10.19 a month (annual billing), with no per-user ceiling, no machine cap, and your peer keys and access logs staying on your own infrastructure.
The jurisdiction argument matters for teams handling regulated data. With is*hosting's 40+ server locations, you can place your NetBird management server in the same region as your existing infrastructure, keeping peer coordination traffic off third-party networks and satisfying requirements around where control-plane data flows.
For small teams already running other services on a VPS, adding NetBird to that same server costs nothing extra. The three containers sit alongside your other Docker workloads and use around 580 MB of RAM under load.
Before running the installer, have these in place:
NetBird's minimum requirements are 1 CPU and 2 GB RAM. The Start plan covers that with headroom.
|
Team size / use case |
RAM |
CPU |
is*hosting plan |
|
Up to ~10 peers, light policy load |
2 GB |
2 CPU |
Start ($10.19/mo, annual billing) |
|
10–50 peers, activity logging enabled |
4 GB |
3 CPU |
Medium ($21.24/mo, annual billing) |
All is*hosting plans include 1 dedicated IPv4 by default. It is pre-selected at checkout and cannot be removed. NetBird requires a publicly reachable IP for the installer's Let's Encrypt challenge and for peer signaling, so this requirement is already covered. Weekly VPS backups are included on all plans. Docker is not pre-installed; you'll add it in Step 1.
Provision your VPS at ishosting.com/en/vps. Select CentOS 9 x64 as the operating system. The Start plan (2 CPU / 2 GB RAM / 30 GB SSD) at $10.19/mo (annual billing) is the right pick for a fresh NetBird deployment. The Start plan comes with 3 TB of metered bandwidth, and NetBird's control-plane traffic is lightweight, so this limit is unlikely to be a concern for most deployments.
KVM VPS with a dedicated IPv4 included, 2 GB RAM, and CentOS 9 — enough to run the full NetBird stack, in 40+ locations near your existing infrastructure.
Docker is not pre-installed on is*hosting VPS plans. SSH into your server as root and install it:
curl -fsSL https://get.docker.com | sh
systemctl enable --now dockerVerify that both the Docker engine and Compose plugin are working:
docker --version
docker compose versionYou'll see output similar to this from the install on this guide's test server:
Docker version 29.6.0, build fb59821
Docker Compose version v5.2.0One thing to be aware of on CentOS 9: if podman-docker is installed (it ships by default on some CentOS 9 images), it conflicts with Docker CE. Remove it first before running the install script:
dnf remove -y podman-dockerDocker manages its own iptables/nftables rules and doesn't integrate with firewalld out of the box. If firewalld is running, it can override or drop the DOCKER chain on reload, breaking container networking. Check its status after install:
systemctl status firewalldIf it's active and you don't need it for anything else on this box, disable it:
systemctl disable --now firewalldIf you do need firewalld for other services, add Docker's chain to the trusted zone instead of disabling it outright. See Docker's firewalld documentation for the exact rule.
In your DNS registrar, add an A record for your chosen subdomain (e.g., netbird.yourdomain.com) pointing to your VPS's public IP. The installer runs a Let's Encrypt challenge over port 80 before it can proceed. DNS propagation can take anywhere from a few minutes to several hours, depending on your registrar. If the TLS step fails with a certificate provisioning error, your domain hasn't resolved yet.
Confirm the record has propagated before continuing:
dig +short netbird.yourdomain.comThe output should return your server's IP address.
Set your domain and run the install script:
export NETBIRD_DOMAIN=netbird.yourdomain.com
curl -fsSL https://github.com/netbirdio/netbird/releases/latest/download/getting-started.sh | bashThe script prompts for your reverse proxy selection:
Which reverse proxy will you use?
[0] Traefik (recommended - automatic TLS, included in Docker Compose)
[1] Existing Traefik (labels for external Traefik instance)
[2] Nginx (generates config template)
[3] Nginx Proxy Manager (generates config + instructions)
[4] External Caddy (generates Caddyfile snippet)
[5] Other/Manual (displays setup documentation)
Enter choice [0-5] (default: 0):Press Enter to accept the default (Traefik). This bundles a Traefik container that automatically handles TLS certificate provisioning via Let's Encrypt.
The script asks for a Let's Encrypt notification email, then whether to enable the NetBird Proxy service:
Do you want to enable the NetBird Proxy service?
The proxy allows you to selectively expose internal NetBird network resources
to the internet. You control which resources are exposed through the dashboard.
Enable proxy? [y/N]:Press Enter to skip. You can enable it later from the dashboard.
The script generates docker-compose.yml, config.yaml, and dashboard.env, then pulls three images and brings up the stack. On the Start plan, this took 3 minutes 16 seconds from start to running containers. When everything is up, the installer prints:
==========================================
NETBIRD SETUP COMPLETE
==========================================
You can access the NetBird dashboard at:
https://netbird.yourdomain.com
Traefik is handling TLS certificates automatically via Let's Encrypt.
If you see certificate warnings, wait a moment for certificate issuance to complete.
Open ports:
- 443/tcp (HTTPS - all NetBird services)
- 80/tcp (HTTP - redirects to HTTPS)
- 3478/udp (STUN - required for NAT traversal)Confirm the containers are running:
docker compose psExpected output:
NAME IMAGE COMMAND SERVICE CREATED STATUS
netbird-dashboard netbirdio/dashboard:latest "/usr/bin/supervisor…" dashboard 5 seconds ago Up 4 seconds 80/tcp, 443/tcp
netbird-server netbirdio/netbird-server:latest "/go/bin/netbird-ser…" netbird-server 5 seconds ago Up 4 seconds 0.0.0.0:3478->3478/udp
netbird-traefik traefik:v3.6 "/entrypoint.sh --lo…" traefik 5 seconds ago Up 4 seconds 0.0.0.0:80->80/tcp, 0.0.0.0:443->443/tcpnetbird-dashboard and netbird-traefik handle inbound HTTPS; netbird-server is the only container that binds a UDP port directly (3478 for STUN). All management, signal, and relay traffic goes through Traefik on 443.
Open your browser and navigate to https://netbird.yourdomain.com. The server redirects to the setup page at /setup. You'll see a form with three fields:
Fill them in and click Create Account. This creates the first administrator. After that, the /setup route closes permanently, and subsequent visits go to the standard login page.
Log in with the credentials you just created. The dashboard loads showing an empty Peers view.
For headless Linux servers, setup keys are the right approach. There's no browser SSO required, which makes it clean for automated or unattended enrollment.
From the dashboard, go to Peers and click Add Peer, or go to Settings → Setup Keys and click Create Setup Key. A one-off key that expires in 24 hours is the safest default for a single server enrollment.
On the peer machine, install the NetBird client:
curl -fsSL https://pkgs.netbird.io/install.sh | shThen connect it to your self-hosted management server using the setup key:
netbird up --setup-key <YOUR_SETUP_KEY> --management-url https://netbird.yourdomain.comThe terminal confirms the connection immediately:
ConnectedThe peer appears in the Peers list in the dashboard within a few seconds, with a 100.64.x.x address assigned automatically. Check the status from the peer:
netbird statusA healthy connection shows:
Daemon status: Connected
Management: Connected
Signal: Connected
Relayed: falseRelayed: false means a direct WireGuard tunnel is established between peers. If it shows true, the peers are behind NAT configurations that block a direct path, and traffic is routing through the relay instead.
By default, all peers in the same account can reach each other. To apply least-privilege access, go to Access Control → Policies, and click Add Policy.
Assign peers to named groups first: go to Peers, select a peer, and assign it to a group (e.g., "servers" or "devs"). Back in Policies, set the source group, destination group, and optionally specify which ports and protocols are permitted. Save the policy, and NetBird distributes the updated rules to all connected peers immediately.
Go to Activity in the sidebar. Every peer connection, disconnection, policy change, and user action appears here with a timestamp. This is useful for auditing who accessed which resources and when, without pulling logs from individual machines.
Before pulling new images, back up your configuration files and database. The configuration files live in the directory where you ran the installer (by default /root):
mkdir backup
cp docker-compose.yml dashboard.env config.yaml backup/Back up the Management service database:
docker compose stop netbird-server
docker compose cp -a netbird-server:/var/lib/netbird/ backup/
docker compose start netbird-serverThen pull and recreate:
docker compose pull netbird-server dashboard
docker compose up -d --force-recreate netbird-server dashboardThe dashboard shows an update indicator in the bottom-left navigation panel when a new version is available.
is*hosting VPS plans include free weekly server-level backups on all plans. Those snapshots cover the full server state. The targeted application backup above is faster to restore from when an update breaks something specific; you restore two files and a database directory rather than rolling back the entire VPS.
Free weekly VPS backups on every plan — so a broken NetBird update never means rebuilding your peer keys and access policies from scratch.
On the is*hosting Start plan (2 CPU / 2 GB RAM / 30 GB SSD, $10.19/mo on annual billing), the full NetBird stack installs in 3 minutes 16 seconds. The install pulls three images totaling around 760 MB and adds 1.3 GB to disk (from 1.8 GB used to 3.1 GB). The three containers (netbird-server, netbird-dashboard, netbird-traefik) use around 580 MB of RAM combined while running.
What's available from this point: a WireGuard-based mesh network that assigns stable 100.64.x.x addresses to every peer, a web dashboard for managing peers and policies, TLS-secured management traffic via Traefik with Let's Encrypt certificates that auto-renew, local user accounts via the embedded Dex IdP with the option to add Google or Microsoft SSO later, an activity log, and private DNS so peers can reach each other by hostname.
For teams that have outgrown the free five-user tier, self-hosting cuts the bill from $36/mo (six users on Team) to $10.19/mo (annual billing for Start VPS) regardless of headcount. For anyone already running services on a VPS, adding NetBird means deploying one Docker stack, not adding another line item to a SaaS bill.
For a walkthrough of initial VPS configuration before deploying any tools, the Linux VPS setup guide covers SSH hardening and base system setup. If you're building out a self-hosted stack, the Uptime Kuma guide covers adding a monitoring layer that runs on the same VPS alongside NetBird.