NetBird - FOSS noconf Mesh VPN using Wireguard, alternative to ZeroTier, Tailscale, OmniEdge, Netmaker etc
-
AI's reply. Not tested, but seems good:
@timconsidine @sponch thanks for investigating and documenting the transport issue.
I’ve now published v2.0.16, which adopts the dedicated native-client transport model:
- Dashboard, API and OIDC remain on normal Cloudron HTTPS/443.
- NetBird management, signal and relay traffic use a dedicated TLS/HTTP2 TCP port.
- The default external port is 33073, but use whichever TCP port is configured in Cloudron.
Client example:
sudo netbird up
--management-url https://netbird.example.com:33073
--setup-key YOUR_SETUP_KEYThe selected TCP port must be reachable through the server firewall. NetBird’s own configurable UDP STUN port is also retained. I did not use Cloudron’s TURN addon because its relay credential model is incompatible with NetBird’s built-in relay.
Internally, the native listener maps to container port 33074, because current NetBird releases reserve 33073 for their legacy gRPC listener.
Reverse Proxy clusters are still not included. That feature requires raw TLS passthrough on public port 443, which Cloudron does not currently provide per app. The dedicated client port fixes peer registration but does not remove that separate platform constraint.
Release: https://github.com/marcusquinn/cloudron-netbird-app/releases/tag/v2.0.16
Community app: https://ca.cloudron.io/app/netbirdLocal runtime tests passed first-run setup, TLS validation, HTTP/2 negotiation, restart and persistence checks. I still need confirmation from a real Cloudron installation, so please let me know whether a native client now registers successfully.
@marcusquinn thank you !
Will test tomorrow. -
Sorry @marcusquinn, gone down multiple rabbit-holes on other projects, so not fully tested yet, but looks to me like your solution will work.
I've been researching the NetBird reverse proxy feature, which currently isn't viable behind Cloudron's nginx. Given Cloudron team's workload, TLS passthrough is unlikely soon (unless they say otherwise).
But it looks like there might be a path with no Cloudron modifications:
- Get a 2nd public IP on the same VPS (usually cheap — less than a separate VPS)
- iptables DNAT: redirect IP2:443 → 127.0.0.1:8443
- Expose 8443 via tcpPorts in the NetBird app manifest — this bypasses Cloudron's nginx entirely (raw TCP, no TLS termination)
- Run netbird-proxy as an additional supervisord process inside the existing NetBird app; it connects to the management server at localhost
- DNS: netbird.domain.tld → IP1 (Cloudron), netbirdRP.domain.tld + *.netbirdRP.domain.tld → IP2 (DNAT to proxy)
- Survives Cloudron upgrades and restarts — iptables rules are kernel-level
This might be a solution for @sponch (and everyone).
Untested — I don't have a 2nd IP (yet !). But it would be a simple addition: no changes to Cloudron, minimal changes to the NetBird app.
Indie app dev, scratching my itches : communityapps.appx.uk, portfolio at myca.appx.uk
-
Sorry @marcusquinn, gone down multiple rabbit-holes on other projects, so not fully tested yet, but looks to me like your solution will work.
I've been researching the NetBird reverse proxy feature, which currently isn't viable behind Cloudron's nginx. Given Cloudron team's workload, TLS passthrough is unlikely soon (unless they say otherwise).
But it looks like there might be a path with no Cloudron modifications:
- Get a 2nd public IP on the same VPS (usually cheap — less than a separate VPS)
- iptables DNAT: redirect IP2:443 → 127.0.0.1:8443
- Expose 8443 via tcpPorts in the NetBird app manifest — this bypasses Cloudron's nginx entirely (raw TCP, no TLS termination)
- Run netbird-proxy as an additional supervisord process inside the existing NetBird app; it connects to the management server at localhost
- DNS: netbird.domain.tld → IP1 (Cloudron), netbirdRP.domain.tld + *.netbirdRP.domain.tld → IP2 (DNAT to proxy)
- Survives Cloudron upgrades and restarts — iptables rules are kernel-level
This might be a solution for @sponch (and everyone).
Untested — I don't have a 2nd IP (yet !). But it would be a simple addition: no changes to Cloudron, minimal changes to the NetBird app.
@timconsidine clever, i like the thinking! investigating...
-
An update on the NetBird Cloudron package—the single-VPS reverse-proxy candidate is now merged and available to build from source:
https://github.com/marcusquinn/cloudron-netbird-app- One Cloudron app packages NetBird management, dashboard, embedded login, native client transport and relay/STUN. Ordinary private mesh access does not need a second IP or the optional public proxy.
- The 2.1.0 candidate adds the optional NetBird reverse proxy inside that same app. This exposes selected HTTP services on mesh peers through public HTTPS, without requiring visitors to install NetBird.
- The single-VPS setup requires a second public IPv4 and documented root-admin host configuration. No second VPS or replacement of Cloudron’s managed nginx is required. This is an opt-in administrator-managed integration, not a built-in Cloudron feature.
- A controlled live deployment has exercised native peer registration, public ACME TLS, traffic to a remote WireGuard peer, header authentication and forwarded-IP spoof rejection.
- The latest integrated source passes local build/runtime checks covering initial setup, restart persistence, unprivileged services, native-port browser redirects and native OAuth continuity. Host-ingress tests include port-collision rejection and fail-closed checks.
- Setup, rollback and qualification documentation are included. The proxy is disabled by default, and its public ingress does not automatically inherit Cloudron’s normal HTTP protections.
- This is ready for experienced source-build testers, not a production-certification or App Store announcement. Full restore, renewal, reboot/platform upgrade and broader isolation/load qualification remain open. Optional Cloudron SSO onboarding is a separate follow-up.
- Feedback on fresh installations, desktop/mobile clients, custom ports and the documented single-VPS setup would be useful. Please use an isolated test environment and retain recovery access before changing host networking.
Implementation and verification details:
https://github.com/marcusquinn/cloudron-netbird-app/pull/141
Web Design & Development: https://www.evergreen.je
Technology & Apps: https://www.marcusquinn.com -
An update on the NetBird Cloudron package—the single-VPS reverse-proxy candidate is now merged and available to build from source:
https://github.com/marcusquinn/cloudron-netbird-app- One Cloudron app packages NetBird management, dashboard, embedded login, native client transport and relay/STUN. Ordinary private mesh access does not need a second IP or the optional public proxy.
- The 2.1.0 candidate adds the optional NetBird reverse proxy inside that same app. This exposes selected HTTP services on mesh peers through public HTTPS, without requiring visitors to install NetBird.
- The single-VPS setup requires a second public IPv4 and documented root-admin host configuration. No second VPS or replacement of Cloudron’s managed nginx is required. This is an opt-in administrator-managed integration, not a built-in Cloudron feature.
- A controlled live deployment has exercised native peer registration, public ACME TLS, traffic to a remote WireGuard peer, header authentication and forwarded-IP spoof rejection.
- The latest integrated source passes local build/runtime checks covering initial setup, restart persistence, unprivileged services, native-port browser redirects and native OAuth continuity. Host-ingress tests include port-collision rejection and fail-closed checks.
- Setup, rollback and qualification documentation are included. The proxy is disabled by default, and its public ingress does not automatically inherit Cloudron’s normal HTTP protections.
- This is ready for experienced source-build testers, not a production-certification or App Store announcement. Full restore, renewal, reboot/platform upgrade and broader isolation/load qualification remain open. Optional Cloudron SSO onboarding is a separate follow-up.
- Feedback on fresh installations, desktop/mobile clients, custom ports and the documented single-VPS setup would be useful. Please use an isolated test environment and retain recovery access before changing host networking.
Implementation and verification details:
https://github.com/marcusquinn/cloudron-netbird-app/pull/141
@marcusquinn wow, that's massive ! Congratulations and thank you.
Sadly I have some boring admin days before I can test this out. But I look forward to doing so.
Indie app dev, scratching my itches : communityapps.appx.uk, portfolio at myca.appx.uk
-
@marcusquinn wow, that's massive ! Congratulations and thank you.
Sadly I have some boring admin days before I can test this out. But I look forward to doing so.
@timconsidine credit to you for the idea, sir!
in my quick tests it seemed to work fine, serving a page from a mac mini.
there should be enough .md info in the package to help any AI understand it all to help with setup and testing
as always, aidevops.sh has subagents for cloudron app packaging, netbird setup and use, etc
-
@marcusquinn wow, that's massive ! Congratulations and thank you.
Sadly I have some boring admin days before I can test this out. But I look forward to doing so.
@timconsidine and the approach might open up similar being possible for other cloudron apps needing tls passthrough
-
NetBird author is here.
Thanks, @marcusquinn, for posting about NetBird!
Thank you, @privsec, for the kind feedback.
I see that there is quite an interest. Feel free to ask me any questions
@braginini take a look at the latest version of the cloudron-netbird-app package — might help you get more people trying and adopting it (and hopefully nullifying all the tailscale-only options i see, that i was aggrieved enough with to work on this
fan of your work, very impressive ux!
-
cloudron SSO should be working now, available for testing in the latest release
and got a new session working on syncing users with app visibility permissions, and seeing if we can integrate this with the new cloudron vpn protection features as a potentially easier way to give users vpn gated access to private wan apps
-
@girish cloudron-netbird-app seems to be working nicely, now
any chance of making it a recognised app option for the vpn-protection features now in cloudron?
https://github.com/marcusquinn/cloudron-netbird-app/issues/149
-
updated the screenshots in the original post to better show what it is now
great ux and community version capabilities imho
-
still all working well for me, but then i might not be touching all features important to everyone
keep any feedback coming, want this to be the perfect setup for anyone wanting a private mesh network — which is very handy for offloading ai work to various other machines in your world, regardless of where you are
exit-node feature is also handy, and nicely implemented — really impressed with their ease-of-use for clients
if we can get cloudron to allow this as one of the vpn-protection options, i can see this being ideal for making cloudron corporate-friendly for anyone offering those kinds of services or wanting for yours and your family's locked-down access to apps
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login