NetBird self-host 2026: the open-source mesh VPN

Most "self-hosted VPN" setups stop at a single WireGuard server you connect into. A mesh VPN is different: every device talks directly to every other device, peer-to-peer, with a coordination server only brokering connections. Tailscale popularised this model - but its coordinator is proprietary. NetBird is the answer for people who want the same mesh experience with a stack that is open-source from agent to server, and fully self-hostable on a VPS you control.

This guide explains how NetBird works, what self-hosting it actually involves, the honest cost and maintenance picture, and how it stacks up against Tailscale and Headscale. If you are still choosing between the two products rather than deploying one, start with NetBird vs Tailscale - the decision comes down to a single question about the control plane.

What is NetBird?

Server racks in a data center - self-hosting a mesh VPN

NetBird is an open-source overlay mesh VPN built on WireGuard for the data plane. Its components:

Agents on each device, establishing WireGuard tunnels.
A signal server that brokers peer-to-peer connection setup and NAT traversal.
A management server holding configuration, peers, groups and ACL policies.
A dashboard for administration.
A relay (TURN/coturn) as a fallback when two peers cannot connect directly.
SSO/IdP integration (OIDC) - NetBird can bundle Zitadel or connect to Authentik, Keycloak, Google and others.

The whole stack is open-source (github.com/netbirdio/netbird), which is the key point: unlike Tailscale, the coordination server itself is software you can run.

How peers actually connect

NetBird prioritises direct peer-to-peer WireGuard connections. The signal server helps two agents discover each other and punch through NAT; once connected, traffic flows directly between them - fast and not touching your server. Only when both peers sit behind restrictive NATs or firewalls does traffic fall back through the TURN relay. That distinction matters for sizing: the relay carries the worst-case minority, not your whole network. For the deeper WireGuard background, see our WireGuard vs OpenVPN comparison.

Self-hosting NetBird on a VPS

The realistic recipe in 2026:

A small VPS with a public IP. A Contabo Cloud VPS 10 at €5.50/month handles a small-to-medium mesh comfortably.
A domain name pointed at the VPS, with TLS via Let's Encrypt.
Docker Compose running the management server, signal server, dashboard and coturn.
An identity provider for SSO - bundle Zitadel or wire up an external OIDC provider.

# Outline only - follow the official NetBird self-hosting docs for current compose files
curl -fsSL https://github.com/netbirdio/netbird/releases/latest/download/getting-started-with-zitadel.sh -o install.sh
# review the script before running it, then:
export NETBIRD_DOMAIN=vpn.example.com
bash install.sh

Always read an install script before running it. For a step-by-step VPS hardening and base setup that applies here too, see our Contabo VPS setup guide and the broader best self-hosted VPN 2026 overview.

The honest cost and maintenance picture

Direct cost: roughly €66/year on a Contabo Cloud VPS 10 for a small-to-medium mesh - versus per-user SaaS pricing that scales with your team.
Setup time: a few hours, more than a single WireGuard box because of the IdP and relay.
Maintenance: container updates, certificate renewal (mostly automated), and watching relay bandwidth. NetBird has more moving parts than a plain WireGuard server or a lean Headscale install - that is the trade for an integrated, fully-owned platform.
Project maturity: younger and smaller-community than Tailscale; very active, but do your own due diligence on release cadence.

NetBird vs Tailscale vs Headscale

	NetBird (self-host)	Tailscale (SaaS)	Headscale (self-host)
Data plane	WireGuard	WireGuard	WireGuard
Server source	Fully open-source	Proprietary coordinator	Open-source reimplementation
Clients	NetBird agents	Official Tailscale	Official Tailscale
Built-in SSO/dashboard	✅ Yes	✅ (managed)	⚠️ Minimal
You own the control plane	✅	❌	✅
Moving parts to run	More	None (managed)	Fewer

For the two Tailscale-side options in depth, see Tailscale vs Headscale self-host and our Headscale self-host guide.

Verdict

NetBird is the strongest choice when you want a mesh VPN you fully own, end to end, with integrated SSO and ACLs, and you accept running a handful of containers. If you want the absolute lightest self-hosted path and are happy with the official Tailscale clients, Headscale is leaner. If you don't want to self-host at all, Tailscale's SaaS is easiest - but then you don't own the coordinator. For sovereignty-minded teams, NetBird on a Contabo VPS is the most complete open-source answer in 2026.

Editorial comparison based on NetBird's documented open-source architecture (WireGuard data plane, self-hostable management/signal servers, OIDC SSO, TURN relay fallback) and the documented models of Tailscale and Headscale. Costs are indicative VPS pricing, not guarantees. Commercial links carry the rel="sponsored nofollow" attribute; an affiliate commission may apply at no extra cost to you.

★ Nuremberg GDPR datacenter · ✓ Dedicated IPv4 included · 200+ Mbps guaranteed

Self-host your VPN on your own VPS → ContaboFull root access · public IPv4 · pick your region→

Frequently asked questions

Is NetBird really fully open-source, including the server?

Yes - and this is its main differentiator versus Tailscale. NetBird (github.com/netbirdio/netbird) is open-source for the whole stack: the agent, the management server, the signal server and the dashboard. Tailscale's clients are open but its coordination server is proprietary, which is why a separate project (Headscale) exists to reimplement it. With NetBird you can self-host the official server itself, so there is no reverse-engineered coordinator to maintain.

How is NetBird different from Tailscale and Headscale?

All three give you a WireGuard-based mesh with NAT traversal. Tailscale is the managed SaaS with a proprietary coordinator - easiest, but you don't own the control plane. Headscale is a community reimplementation of the Tailscale coordinator you self-host, paired with the official Tailscale clients. NetBird is its own end-to-end open-source stack - its own agents plus a self-hostable management/signal server with a built-in dashboard and SSO. NetBird trades a slightly larger moving-parts footprint for owning the entire system officially.

What does it take to self-host NetBird on a VPS?

A small VPS, a domain name, and a few containers. The standard install runs the management server, signal server, dashboard and a TURN relay (coturn) via Docker Compose, plus an identity provider for SSO - NetBird can bundle Zitadel or connect to an external OIDC provider (Authentik, Keycloak, Google, etc.). You need a domain with TLS (Let's Encrypt). A Contabo Cloud VPS 10 handles a small-to-medium mesh comfortably; the relay's bandwidth is the main thing to size for NAT-restricted peers.

Does NetBird need a relay server, and why?

It uses one as a fallback. NetBird tries to connect peers directly (peer-to-peer) using WireGuard with NAT traversal via the signal server. When two peers are behind restrictive NATs or firewalls that block direct connections, traffic falls back through a TURN relay (coturn). Direct connections are the norm and are fast; the relay only carries traffic for peers that cannot connect directly, so plan relay bandwidth for the worst-case minority, not the whole fleet.

When should I choose NetBird over Headscale?

Choose NetBird if you want a single, officially supported open-source product with an integrated dashboard and SSO/IdP out of the box, and you accept running a few more components. Choose Headscale if you want the lightest possible self-hosted coordinator and prefer to keep using the polished official Tailscale clients. Both are excellent; NetBird is the more complete self-contained platform, Headscale is the leaner coordinator-only option.