NetBird - Hardened Self-Hosted Mesh VPN

What is NetBird

NetBird is an open-source overlay network that connects your machines into a private WireGuard mesh. Peers build encrypted point-to-point tunnels wherever the network allows it and fall back to a relay when it does not, so laptops, servers, containers and cloud VMs reach each other by a stable private address regardless of NAT or firewalls. Access is governed centrally by groups and policies rather than per-host firewall rules.

This image runs the complete NetBird control plane on a single VM: the management service, the signal service, the relay, a STUN server and an embedded identity provider, all from one upstream binary. There is no external identity provider to register, no SaaS account, and no separate coturn container to operate.

Why self-host NetBird

Running the control plane yourself means the map of your network - every machine, user, group and access policy - stays inside your own tenant. Peer traffic is end-to-end encrypted by WireGuard and never traverses a third party. Self-hosting suits teams with data residency requirements and organisations under GDPR, HIPAA or ISO 27001. The server components are AGPL-3.0 and fully auditable; the corresponding source is offered in writing inside the image.

What this VM image adds

Complete control plane, no external dependencies:

• Embedded identity provider - create the first administrator and invite users directly, with no third-party IdP to configure
• Management, signal, relay and STUN all served from this instance, multiplexed behind one TLS port
• Local datastore - peers, groups and policies in SQLite on the persistent volume; PostgreSQL and MySQL supported for larger deployments

Security hardening:

• nginx TLS perimeter - dashboard, REST API, gRPC and relay all reached through port 443; container ports stay bound to the instance
• No baked administrator password - generated on first boot into /root/netbird-credentials.txt (mode 0600) and stored as a bcrypt hash; nothing sensitive is in the image
• Certificate issued on first boot for this instance's address so peers can validate it immediately; certbot pre-installed to swap in a CA-signed one
• Anonymous telemetry disabled by default
• UFW firewall - TCP 443, TCP 80 and UDP 3478 open for buyer use, TCP 22 for SSH; all other inbound dropped; Azure IMDS and WireServer egress configured
• fail2ban - SSH brute-force protection
• AppArmor - mandatory access control
• CVE scan - every image is scanned with Trivy before release

OS hardening (CIS Level 1):

• CIS Ubuntu 24.04 LTS Level 1 Benchmark via ansible-lockdown
• auditd for system call auditing of critical paths
• SSH hardening - PasswordAuthentication disabled, key-only access, PermitRootLogin no, LoginGraceTime 60
• Kernel hardening - SYN cookies, ASLR, rp_filter, kexec disabled
• /tmp as tmpfs with nosuid, nodev, noexec

Compliance artifacts (inside the VM):

• SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json
• CIS Conformance Report at /etc/lynxroute/cis-report.html (OpenSCAP, Azure tailoring profile, 0 FAIL rules)
• Tailored CIS profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md
• Licences and written source offer at /usr/share/doc/lynxroute/LICENSES.txt (AGPL-3.0 components)

Quick Start

1. Deploy VM from Azure Marketplace (Standard_D2s_v3 recommended)
2. Open NSG: TCP 443 and TCP 80, plus UDP 3478 for NAT traversal, from the networks your peers connect from; TCP 22 from your management IPs only
3. SSH: ssh -i key.pem azureuser@<PUBLIC_IP>, then sudo cat /root/netbird-credentials.txt
4. Open https://<PUBLIC_IP>/, accept the self-signed certificate warning, and sign in with the administrator e-mail and generated password
5. Create a setup key (Setup Keys, Add key), then on each machine: curl -fsSL https://pkgs.netbird.io/install.sh | sh and netbird up --setup-key KEY --management-url https://<PUBLIC_IP>

First boot downloads the geolocation databases the management service needs before serving, taking 2-4 minutes; a loading page is served on 443 until it is ready. Peers validate this server's TLS certificate, so point a DNS name at the instance and run certbot before enrolling peers you cannot easily re-enrol.