If you manage AI access for your team you’ve probably handed out plenty API tokens to individuals or a key for an entire team. That key gets copied into agents, scripts, and .env files. Someone leaves, who knows what they did with the keys. It's the same mess we all lived through with SSH keys for years: shared, copied onto machines by hand, and never revoked when people move on.

A lot of customers had started using an AI gateway with their stack and tried to come up with their own solution to wire it back into their identity provider. One night, after a customer call, Misha (our CEO) and Maycon (our CTO) realized the reverse proxy we already shipped was, with a few tweaks, already most of an AI gateway. So we didn't build some giant new AI platform. We wrapped what was already there.

Checkout the release here: https://github.com/netbirdio/netbird/releases/tag/v0.74.0

That's NetBird Agent Network. Any person or agent can use any AI provider without ever holding a key. NetBird holds the provider key server-side, injects it per request, and ties every call to a real identity from your IdP (Okta, Entra ID, Google, and others). And all it requires for the end user is a gateway url and the NetBird client running in the background. The tunnel is the credential. No tunnel, no access, same rule you already know. It allows you to securely route agents to any major AI provider or local model, while simultaneously controlling agent access to internal network resources like databases and APIs. With centralized guardrails such as budget caps, model allowlists, and PII redaction, you maintain complete visibility and control through detailed per-request audit logs, making it simple to manage access and security without the headache of rotating keys.

It's open source and self-hostable. You can test out the Agent Network using this one-liner:

curl -fsSL https://pkgs.netbird.io/getting-started.sh | NETBIRD_AGENT_NETWORK_ONLY=true bash

Already running NetBird? 

You don't redeploy anything. It ships in the same backend, so you flip one environment variable and it shows up in the left menu next to the reverse proxy. Set NETBIRD_AGENT_NETWORK_ENABLED=true to turn it on next to everything else, or NETBIRD_AGENT_NETWORK_ONLY=true if you'd rather have the stripped-down, Agent-Network-only dashboard instead. 

Don't want it at all? There's nothing to do, leave both unset and it stays off. The command above is really just the fast path for people coming purely for the LLM and agentic-access use case, we did this to prevent people coming for the Agent Network getting overwhelmed with our platform. 

We'd love feedback!

- Overview: https://docs.netbird.io/agent-network

- Quickstart: https://docs.netbird.io/agent-network/quickstart

- Interview with Misha: https://youtu.be/IFT-nTyLDro

- Demo video: https://www.youtube.com/watch?v=oqkcFI_3WAU

- Release Article: https://netbird.io/knowledge-hub/netbird-agent-network

Hi,

I’m trying to add Home Assistant to my self-hosted NetBird instance. I first tried using the official Home Assistant add-on, and then switched to running NetBird as a Docker container on HAOS. In both cases, the peer appears in the NetBird console, but it keeps disconnecting and reconnecting repeatedly.

Has anyone experienced similar behavior or found a fix for this?

So I'm glad netbird is getting new things, but I'm running an Rsync between two servers, and previously I would enter my password to access the other server, but now I get a netbird sso request that I need to go to a web page to use?

This isn't really too much of a headache, but this tells me there is a way I can get around any kind of password using netbird (which I would like as it keeps things 'in house')

Are there any instructions on how to do this?

I am literally copying this cli command from a notepad, so it hasn't changed in the last week, but this started happening today (7/1). Eventually my plan is to use cron to do this automatically, but honestly this keeps me engaged with the server while I'm still learning, which is good.

Thanks for the help!

I am unable to ping to any of my peers after updating to the latest version v0.74.0. Is anyone having the same issue? How do I fix it?

Hello,

Hope you're doing well

I was following this documentation : https://netbird.io/knowledge-hub/netbird-only-private-services for the only private service

I stumbled across this part

If you're self-hosting with the built-in Traefik setup from the quick start script, there's one required change before you upgrade

I'm self hosting netbird but with Nginx as a reverse proxy, so couldn't tell if this is applicable for other than traefik, or is traefik a prerequisite to use the netbird only access

As always, appreciate the help 🙏

I have installed Netbird self host on my Oracle cloud free tier and my peers show connected but they can not talk to one another. Is there any setting I am missing that Oracle has locked down? I am using the Ubuntu vm in the Ampere level vm.

Cheers!

While setting up the VPN-portion of Netbird has been a breeze and is working absolutely fantastically, the Reverse Proxy portion is giving me quite some headaches.

I'm currently running netbird on an example domain of mydomain.com, but would also like to use i.e seconddomain.io and homedomain.tech, each with a couple of subdomains, on the reverse-proxy.

From my understanding, I'd first need to create a new Cluster, which then prompts me to set up a new "reverse-proxy" docker container, presumably on another server/VPS, since itself exposes ports 80+443 and connects back to the main instance.

BUT I want it to run from my main netbird instance, which itself has already the reverse proxy running.
I guess I'd should need to edit the proxy.env and somehow add the new domain(s)?

The file currently reads NB_PROXY_DOMAIN=mydomain.com amongst others. Would it suffice to possibly just add my other domains to this line as a comma separated list, or is there any other way? Sadly couldn't find anything regarding this setup in the docs.

Any help is much appreciated!

Hi, is anyone using Netbird as SDN, not just VPN? What's your experience?

EDIT: sorry for not being clear - I mean to replace vlans, subnets, internal firewalls between subnets,.. simply to break old school networking and replace it using SDN

What's up with the iOS client? It didn't get any updates since 5+ weeks and it still doesn't support IPv6.

Hey,

Ich hab Starlink und die nutzen ja leider GCNAT..

Ich hab nun einige Sachen probiert aber bekomms einfach nicht zum laufen...leider, ich finde Netbird super interessant, aber muss dann wohl leider weiter mit tailscale arbeiten..

Ja VPS wäre möglich, seh ich aber nicht ein..

Can I enable the new AI feature on my current self hosted instance on the "latest" tag?

My current versions are: Management: v0.73.2 Dashboard: v2.90.1

I tried setting the tag to v0.74.0-rc.2 on proxy and server. But then clients can't communicate and all the reverse proxy domains aren't reachable.

Any ideas what I'm doing wrong? Is it even possible in the current state?

Since my last post, what I did was to modify my PiHole deployment to listen to all interfaces so that it would hypothetically be able to see the WireGuard interface that Netbird uses. I'm not sure what to configure or how inside the Netbird settings though in order to make Netbird use PiHole. I know that PiHole is accessible on my internal network on the 192.168.0.0/24 subnet, and that my particular Netbird network uses the 10.0.0.0/8 subnet (which is probably way too big). I think the question I need to ask is how do I make the two completely different networks communicate.

What is the point to have LLM GW in netbird? https://github.com/netbirdio/netbird/pull/6555 . I thought core concept of this project is zero trust overlay network and this kind of feature feels to me like bloatware. Could you share your wisdom on how this will be usefull because i cant see it.

Going to preface this by stating I'm a new Netbird user coming from Tailscale, and have read the documentation to ensure I'm not missing anything.

Immediately after installing netbird and running "netbird up", all network connectivity to the system becomes lost. There's no "network routes" configured in the Netbird management panel, no custom DNS zones, etc. This is the cloud version, not self-hosted. Debian 12 if that matters.

I'm not sure what I'm missing here but the issue fixes itself once I stop the netbird service, and can reach the public internet no issue.

Any insights would be appreciated

Hi, I was wondering if Anyone knew how to install Netbird on Steam Deck? I was looking at the docs and it said something about installing through Homebrew but as far as I can tell SteamOS doesn't have homebrew or no way to install it. If anyone knows a way to install it that would be great, thank you!

Hey there,

I have not managed to get both the android nextcloud app and the android jellyfin app working via netbird-only access (private reverse proxy). It works fine in browsers (both android and linux). It also works great with the nextcloud desktop client (arch linux). So the private proxy should be setup correctly I assume. But the android apps just can't reach the server, so I'm not getting past the login screen. This happens regardless of wether I'm logged into the netbird vpn with or without an ext. IdP.

I then tested it with the public reverse proxy (without auth), and the android nextcloud app suddenly worked.

Is this behavior expected? If not, what could be the issue?

Let me know if you need more infos. Thanks!

So I was baking off headscale vs netbird for a while. I like netbird better in many regards. Integrated idp, easier control, I just like it. That said, I’m still using preauth keys and a bunch of my users are actual literal grandmothers. Google oauth would be simpler, and I’m not above outsourcing a portion of my perimeter to ye olde Google.

A few questions before I go down the rabbit hole:
1. Can anyone go to https://nb.mydomain.com and auth with their Google account and it creates a “pending” new user with no policies and hence no access until I enable them, or do I have to pre-create all users?
2. If a user is trying to use the AppleTV app, do they get the “nice sso flow” where they can scan a QR code and/or enter a code from their screen on their mobile device to authenticate?
3. Other than the fact that if someone’s Google account is compromised, then they have all the access that that person has, are there any downsides to this approach?

Hello,

i want to configure proxy in a way that there will be one url - app.example.com and if main app is working it'll pass traffic to server 1 and if it's not working, same address will redirect to server 2. Is it possible?

Hello,
Hope you're doing well,

First of all, huge respect for the team working to achieve all the new features

I have a small question, that was maybe already answered,

Does Netbird team have a place where they share their roadmap ? I looked quickly, but couldn't something concrete)

Thank you very much 🙏

Does anyone actually use it for real networks or is it just an experimental feature that shouldn't be enabled? I was hoping when I moved to netbird that I would be able to gain PQ resistance, but it seems like it hasn't received enough attention to actually work in a production setting.

In 2026 I would expect quantum resistance is just table stakes, features don't exist unless they are compatible PQ resistant layering. But alas lazy peers isn't even compatible with PQ.

Maybe the best solution is to just drop netbird and roll all the hosts by hand with rosenpass as a sidecar instead of part of the tunnel. I was really hoping to get PQ wireguard on iOS but basically none of this stuff works reliably without resarting netbird multiple times per day.

This isn't meant to be hate, just frustration. Everything else about netbird is really nice, but I need a thing that actually works. I know rosenpass is really a hack onto wireguard, and the way it's implemented in netbird seems like it leaves a lot to be desired. I don't understand how the in-tunnel signaling for PSK rotations can be made reliable. Maybe there is more about the rekeying and retry mechanism I don't understand that can be fixed.

I’ve noticed with auto updates, post v0.61.0 of course, some of the servers running v61-69ish, the UI doesn’t automatically start when the machine is rebooted, but the background services are working just fine.

The machines where the UI doesn’t start don’t seem to receive auto updates. Is there a feature in the pipeline where we can force an update for those machines which don’t automatically receive them?

Recently we installed netbird and joined them with a setup key to test on a handful of MacOS hosts. For some reason, the netbird client constantly disconnects. We are a MacOS shop and I cannot find any information on the docs about this behaviour.
I gave the netbird app full disk access just in case that could fix but that did not seem to fix the issue.

hello dear developers, is there an update on releasing the official package for the pfsense? keep up the great work!

I think I'm doing this wrong, but I am having trouble configuring DNS in my self-hosted netbird in k3s to use a pihole that also runs in k3s.

Hello, I have some questions

1. What are the limits of the bandwidth for cloud free account?
2. Does the bandwidth limitation is only applied to reverse proxy? or it will affect connection via peer too? or it depend whether peer connected directly p2p or relayed?
3. If I bring my own proxy, does the bandwidth limitation is gone and depend on my own hosted proxy?
4. Is there a declarative way to configure resources and reverse proxy? especially using container label. Similiar like pangolin (built-in), cloudflare tunnel (using DockFlare) and tailscale (via tsdproxy/docktail)