I self-host my mesh VPN with NetBird instead of Tailscale — here's the one reason, and where Tailscale still wins

Описание и применение

Автор заменил публичный VPN Tailscale на самодостаточный NetBird, интегрировав его с существующей системой аутентификации OIDC. Это позволило управлять доступом к сети и другим сервисам из одного места, но потребовало дополнительного обслуживания контрольного сервера.

Задача

Choosing a self‑hosted WireGuard mesh VPN that integrates with an existing identity provider while avoiding a third‑party control plane.

Результат

NetBird provides a self‑hosted, identity‑first VPN mesh that unifies access control with the existing IdP, eliminating a second control plane. It requires more setup and maintenance but offers full ownership of the coordination server.

Рабочий процесс

• 1. Deploy NetBird control plane on a self‑hosted server.
• 2. Configure NetBird to use the existing OIDC identity provider for authentication.
• 3. Adjust NetBird dashboard settings to use the ID token (JWT) instead of opaque access tokens.
• 4. Resolve split‑horizon DNS issues by ensuring consistent name resolution across home LAN and mesh.
• 5. Test connectivity and name resolution from all devices.
• 6. Monitor and maintain the control plane (patching, backups).

Доказательства

NetBird speaks OIDC to my existing self-hosted identity provider. So logging into the mesh is logging into everything else — same username, same 2FA, same place to revoke a person.

Источник

The token format gotcha. Wiring NetBird to my identity provider, the dashboard authenticated fine but API calls failed. The cause: my IdP was handing out opaque access tokens, and NetBird's dashboard needed a JWT it could actually read claims from.

Источник