sendnrw/netbird-docs
2
0
Fork 0
mirror of https://github.com/netbirdio/docs.git synced 2026-08-25 01:01:27 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merged WireGuard page into VPN comparison, added Self-Hosted tile (#788)

Browse Source
This commit is contained in:
Brandon Hopkins
2026-06-11 04:08:49 -07:00
committed by GitHub
parent abb000575d
commit 3d4f037c89
6 changed files with 48 additions and 47 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
next.config.mjs
View File

@@ -102,6 +102,11 @@ const nextConfig = {
destination: '/about-netbird/self-hosted-vs-cloud',
permanent: true,
},
{
source: '/about-netbird/why-wireguard-with-netbird',
destination: '/about-netbird/netbird-vs-traditional-vpn',
permanent: true,
},
{
source: '/about-netbird/other',
destination: '/introduction',

4
src/components/NavigationDocs.jsx
View File

@@ -36,10 +36,6 @@ export const docsNavigation = [
title: 'Ports & Firewalls',
href: '/about-netbird/ports-and-firewalls',
},
{
title: 'Why WireGuard with NetBird',
href: '/about-netbird/why-wireguard-with-netbird',
},
{
title: 'Browser Client Architecture',
href: '/about-netbird/browser-client-architecture',

40
src/pages/about-netbird/netbird-vs-traditional-vpn.mdx
View File

@@ -1,4 +1,6 @@
export const description = 'How NetBird compares to traditional centralized VPNs, and why it builds on WireGuard to create fast, secure peer-to-peer networks.'
# NetBird vs. Traditional VPN
## Traditional VPN challenges
@@ -23,9 +25,43 @@ To achieve this, NetBird client applications employ signalling servers to find o
These are similar to the signaling servers used in [WebRTC](https://developer.mozilla.org/en-US/docs/Web/API/WebRTC_API/Signaling_and_video_calling#the_signaling_server)
Thanks to [NAT traversal techniques](https://en.wikipedia.org/wiki/NAT_traversal),
outlined in the [Why Wireguard with NetBird](/about-netbird/why-wireguard-with-netbird) section,
outlined in the [Why WireGuard with NetBird](#why-wireguard-with-netbird) section below,
NetBird installation doesn't require complex network and firewall configuration.
It just works, minimising the maintenance effort.
Finally, each machine or device in the NetBird network verifies incoming connections accepting only the trusted ones.
This is ensured by Wireguard's [Crypto Routing concept](https://www.wireguard.com/#cryptokey-routing).
This is ensured by WireGuard's [Crypto Routing concept](https://www.wireguard.com/#cryptokey-routing).
## Why WireGuard with NetBird
WireGuard is a modern and extremely fast VPN tunnel utilizing state-of-the-art [cryptography](https://www.wireguard.com/protocol/)
and NetBird uses WireGuard to establish a secure tunnel between machines.
Built with simplicity in mind, WireGuard ensures that traffic between two machines is encrypted and flowing, however, it requires a few things to be done beforehand.
First, in order to connect, the machines have to be configured.
On each machine, you need to generate private and public keys and prepare a WireGuard configuration file.
The configuration also includes a private IP address that should be unique per machine.
Secondly, to accept the incoming traffic, the machines have to trust each other.
The generated public keys have to be pre-shared on the machines.
This works similarly to SSH with its authorised_keys file.
Lastly, the connectivity between the machines has to be ensured.
To make machines reach one another, you are required to set a WireGuard endpoint property which indicates the IP address and port of the remote machine to connect to.
On many occasions, machines are hidden behind firewalls and NAT devices,
meaning that you may need to configure a port forwarding or open holes in your firewall to ensure the machines are reachable.
The undertakings mentioned above might not be complicated if you have just a few machines, but the complexity grows as the number of machines increases.
NetBird simplifies the setup by automatically generating private and public keys, assigning unique private IP addresses, and takes care of sharing public keys between the machines.
It is worth mentioning that the private key never leaves the machine.
So only the machine that owns the key can decrypt traffic addressed to it.
The same applies also to the relayed traffic mentioned below.
Furthermore, NetBird ensures connectivity by leveraging advanced [NAT traversal techniques](https://en.wikipedia.org/wiki/NAT_traversal)
and removing the necessity of port forwarding, opening holes in the firewall, and having a public static IP address.
In cases when a direct peer-to-peer connection isn't possible, all traffic is relayed securely between peers.
NetBird also monitors the connection health and restarts broken connections.
Check out the WireGuard [Quick Start](https://www.wireguard.com/quickstart/) guide to learn more about configuring "plain" WireGuard without NetBird.

36
src/pages/about-netbird/why-wireguard-with-netbird.mdx
View File

@@ -1,36 +0,0 @@
# Why Wireguard with NetBird?
WireGuard is a modern and extremely fast VPN tunnel utilizing state-of-the-art [cryptography](https://www.wireguard.com/protocol/)
and NetBird uses Wireguard to establish a secure tunnel between machines.
Built with simplicity in mind, Wireguard ensures that traffic between two machines is encrypted and flowing, however, it requires a few things to be done beforehand.
First, in order to connect, the machines have to be configured.
On each machine, you need to generate private and public keys and prepare a WireGuard configuration file.
The configuration also includes a private IP address that should be unique per machine.
Secondly, to accept the incoming traffic, the machines have to trust each other.
The generated public keys have to be pre-shared on the machines.
This works similarly to SSH with its authorised_keys file.
Lastly, the connectivity between the machines has to be ensured.
To make machines reach one another, you are required to set a WireGuard endpoint property which indicates the IP address and port of the remote machine to connect to.
On many occasions, machines are hidden behind firewalls and NAT devices,
meaning that you may need to configure a port forwarding or open holes in your firewall to ensure the machines are reachable.
The undertakings mentioned above might not be complicated if you have just a few machines, but the complexity grows as the number of machines increases.
NetBird simplifies the setup by automatically generating private and public keys, assigning unique private IP addresses, and takes care of sharing public keys between the machines.
It is worth mentioning that the private key never leaves the machine.
So only the machine that owns the key can decrypt traffic addressed to it.
The same applies also to the relayed traffic mentioned below.
Furthermore, NetBird ensures connectivity by leveraging advanced [NAT traversal techniques](https://en.wikipedia.org/wiki/NAT_traversal)
and removing the necessity of port forwarding, opening holes in the firewall, and having a public static IP address.
In cases when a direct peer-to-peer connection isn't possible, all traffic is relayed securely between peers.
NetBird also monitors the connection health and restarts broken connections.
There are a few more things that we are working on to make secure private networks simple. A few examples are ACLs, MFA and activity monitoring.
Check out the WireGuard [Quick Start](https://www.wireguard.com/quickstart/) guide to learn more about configuring "plain" WireGuard without NetBird.

8
src/pages/introduction.mdx
View File

@@ -93,13 +93,13 @@ It literally takes less than 5 minutes to deploy a secure point-to-point VPN wit
href: '/about-netbird/netbird-vs-traditional-vpn',
name: 'NetBird vs. Traditional VPN',
description:
'Discover how NetBird compares to traditional VPNs and understand the advantages of Zero Trust networking.',
'Discover how NetBird compares to traditional VPNs, why it uses WireGuard, and the advantages of Zero Trust networking.',
},
{
href: '/about-netbird/why-wireguard-with-netbird',
name: 'Why WireGuard with NetBird',
href: '/about-netbird/self-hosted-vs-cloud',
name: 'Self-Hosted vs. Cloud',
description:
'Explore why NetBird uses WireGuard and how it provides fast, secure, and modern networking.',
'Compare NetBird Cloud with the self-hosted version and decide which deployment fits your needs.',
},
{
href: '/about-netbird/browser-client-architecture',

2
src/pages/manage/networks/index.mdx
View File

@@ -6,7 +6,7 @@ export const description = "Learn how NetBird Networks work: the four building b
# Networks
Every device that runs the NetBird client joins a single private **overlay network**, encrypted end to end with [WireGuard](/about-netbird/why-wireguard-with-netbird). Nothing is exposed to the public internet, and you never open an inbound port. Peers connect outbound and negotiate connectivity using ICE/STUN for NAT traversal. See [Ports & Firewalls](/about-netbird/ports-and-firewalls) for details.
Every device that runs the NetBird client joins a single private **overlay network**, encrypted end to end with [WireGuard](/about-netbird/netbird-vs-traditional-vpn#why-wireguard-with-netbird). Nothing is exposed to the public internet, and you never open an inbound port. Peers connect outbound and negotiate connectivity using ICE/STUN for NAT traversal. See [Ports & Firewalls](/about-netbird/ports-and-firewalls) for details.
But you can't run the client everywhere. Some devices can't run it at all, like printers, IoT sensors, and appliances you can't install software on. And installing it on every database and server is more overhead than most teams want. A **Network** fills that gap: a few clients become routing peers that open whole subnets, single hosts, and internal domains to your overlay network, with nothing reachable until a policy allows it.