tag: #netbird

Part four of the NetBird series. The mesh only covers machines running the agent, but plenty of things cannot run it - a NAS, a printer, a legacy appliance, a whole cloud subnet. A routing peer bridges them in. The important 2026 change is that Networks replaced the old Network Routes and fixed the ACL caveat from part three by making access per-resource policy. Plus high availability, source-IP preservation, and exit nodes.

Part three of the NetBird series. A fresh mesh is flat - every peer reaches every other peer on every port, which is wrong to depend on. Access policies fix it, and the model is RBAC for your network - deny by default once you delete the starter policy, allow-only rules, groups as the unit of access with users as source and infrastructure as destination, and setup keys that auto-assign groups. Plus the two sharp edges (same-group peers always reach each other; subnet routes can bypass access control) and posture checks for real zero trust.

Part two of the NetBird series. What the self-hosted control plane is actually made of - management as the brain, signal as the introducer, relay as the NAT fallback, a dashboard, and an identity provider. The big 2026 change is that NetBird now ships an embedded IdP, so you no longer have to stand up Zitadel just to get started. Plus what you have to provide, why the relay is what breaks, and how peers join with setup keys.