I self-host my mesh VPN with NetBird instead of Tailscale — here's the one reason, and where Tailscale still wins

Описание и применение

NetBird позволяет создать полностью самодостаточную сеть WireGuard, интегрированную с существующим провайдером идентификации, устраняя необходимость второго контрольного плана и сохраняя все решения о доступе в одном месте.

Задача

Need a VPN that integrates with existing identity provider and keeps control plane self-hosted, avoiding a third‑party brain.

Результат

NetBird enabled a fully self‑hosted WireGuard mesh that integrates with the existing IdP, eliminating a second control plane and keeping all access decisions in one place. It required some configuration work (token format, split‑horizon DNS) but provided tighter security alignment.

Рабочий процесс

• 1. Install NetBird server and client on devices
• 2. Configure NetBird to use OIDC with existing IdP
• 3. Set dashboard to use ID token (JWT) instead of opaque access token
• 4. Verify peer connectivity and name resolution over mesh
• 5. Test split‑horizon DNS behavior and adjust resolvers
• 6. Monitor and back up NetBird control plane
• 7. Offboard devices/users via IdP to remove them from VPN

Доказательства

NetBird speaks OIDC to my existing self-hosted identity provider. So logging into the mesh is logging into everything else — same username, same 2FA, same place to revoke a person.

Источник

The token format gotcha. Wiring NetBird to my identity provider, the dashboard authenticated fine but API calls failed. The cause: my IdP was handing out opaque access tokens, and NetBird's dashboard needed a JWT it could actually read claims from.

Источник