SaaSActive

NetBird

NetBird is a network connectivity platform that requires no inbound ports, using outbound connections and STUN/relay for NAT traversal.

Open source page ↗

Field note

What it does

NetBird is a network connectivity platform that enables secure peer-to-peer connections without inbound firewall ports. It uses outbound connections and STUN/relay services for NAT traversal. This page documents the required outbound endpoints and ports for NetBird Cloud, including management, signal, STUN, and relay services, and explains host-based firewall interactions.

Capabilities

Available capabilities

Peer-to-Peer VPN NAT Traversal Self-hosting Relay Host Firewall Management Relay Fallback DNS management Anonymous Metrics Collection Authentication Automated Key Management Traffic Relaying Encrypted Tunneling IP and DNS firewall management Peer-to-peer connectivity WireGuard Tunneling Access Control Zero Trust Security

Automatic Firewall Rules

NetBird automatically adds rules to allow traffic on the wt0 interface on Windows and Linux.

Connection Health Monitoring

Monitors connection health and restarts broken connections.

Installation ID

Each management service has a unique installation ID stored in the store database.

Metrics Disable Flag

Metrics collection can be disabled with --disable-anonymous-metrics=true.

Metrics Interval Configuration

The default metrics interval is 12 hours, adjustable via NETBIRD_METRICS_INTERVAL_IN_SECONDS.

NAT Hole Punching

Uses NAT hole punching to establish direct connections when possible.

No Inbound Ports Required

NetBird client does not require any inbound ports on network firewalls.

No Incoming Ports Required

The NetBird client doesn't require any incoming port to be open.

No Port Forwarding Required

Eliminates the need for port forwarding or firewall configuration.

Outbound Connection Initiation

Private IP Allocation

Each peer receives a unique private IP from the Carrier Grade NAT address space 100.64.0.0/10.

Relay Fallback

Falls back to relay servers when direct P2P is not possible.

Self-hosted Management

The Management service can be self-hosted.

Signaling Servers

Client applications use signaling servers to find other machines and negotiate connections.

WireGuard Tunnel

Uses WireGuard to establish secure encrypted tunnels between machines.