Building a Self-Hosted Mesh VPN with Netbird: Serverless Architecture on Cloud VPS

Introduction to Modern Corporate Networking

In the era of distributed teams and hybrid cloud infrastructures, traditional hub-and-spoke VPN architectures are increasingly becoming a bottleneck. Conventional VPNs route all traffic through a single central gateway, resulting in increased latency, single points of failure, and inefficient bandwidth utilization. For businesses seeking a more resilient and performant alternative, Mesh VPN technology offers a paradigm shift.

By establishing direct peer-to-peer (P2P) connections between devices, a mesh network eliminates the middleman. This technical guide explores how to build an internal Mesh VPN network without relying on third-party SaaS providers by self-hosting Netbird on a Cloud VPS. This approach grants full data sovereignty, enhanced security, and predictable infrastructure costs.

Understanding Netbird and Mesh VPN Architecture

Netbird is an open-source private network platform built on top of WireGuard®. Unlike traditional WireGuard setups that require manual key management and static peer configurations, Netbird automates network management through a central coordination engine. However, the core advantage of Netbird lies in its architectural design:

Decentralized Data Plane: While a management server coordinates keys and connection states, the actual data traffic moves directly between nodes using STUN/TURN techniques for NAT traversal.
Zero-Trust Network Access (ZTNA): Security is enforced at the node level, allowing granular access control policies based on user identity and device posture.
Automated Routing: Netbird automatically negotiates the shortest and fastest path between two endpoints, drastically reducing latency compared to traditional routing models.

By self-hosting the Netbird management stack on your own Cloud VPS, you maintain absolute control over the signaling and authentication process, fulfilling stringent compliance and security requirements.

Prerequisites and Infrastructure Setup

Before initiating the deployment, ensure your environment meets the following baseline requirements:

Cloud VPS: A virtual private server running a clean installation of Ubuntu 22.04 LTS or Debian 12. A minimal configuration of 2 vCPUs and 4GB RAM is recommended for production environments.
Public IP & Domain: A static public IPv4 address with a fully qualified domain name (FQDN) pointing to your VPS (e.g., netbird.yourcompany.com).
Identity Provider (IdP): Netbird requires an external OIDC provider for user authentication. You can utilize open-source solutions like Keycloak, or cloud services such as Google Workspace, Okta, or Microsoft Entra ID.
SSL Certificates: Let's Encrypt certificates will be automatically managed to secure API endpoints and dashboard traffic.

Step-by-Step Deployment Guide

Step 1: System Preparation and Docker Installation

Log into your Cloud VPS via SSH and update the core system packages to their latest stable versions:

sudo apt update && sudo apt upgrade -y

Netbird provides an official docker-compose stack that streamlines the deployment of its management, orchestration, and dashboard components. Install Docker and Docker Compose with the following commands:

Ensure that necessary networking ports are open on your cloud provider's firewall and local ufw instance:

80/TCP & 443/TCP: For HTTP/HTTPS web UI access and Let's Encrypt validation.
33073/TCP: Management service gRPC API.
3478/UDP: STUN/TURN server for NAT traversal.
51820/UDP: WireGuard transport port (if direct connections require fallback).

Step 2: Configuring the Netbird Setup Script

Netbird offers an automated installation script that generates the complex configuration files needed for Docker Compose and Identity Provider integration. Download and execute the initialization script:

During the interactive prompt, you will be required to input your configuration parameters:

Management URL: Your FQDN (e.g., [https://netbird.yourcompany.com](https://netbird.yourcompany.com)).
OIDC Provider Configuration: Input your Client ID, Authority URL, and Audience keys derived from your identity management console.

The script generates a docker-compose.yml file along with an integrated management.json configuration. Review these files closely to verify that persistent volume paths and environmental variables are aligned with your server's architecture.

Step 3: Orchestrating the Containers

Launch the self-hosted infrastructure in detached mode:

docker compose up -d

Verify that all containers—including the dashboard, management platform, signal service, and Coturn routing engine—are operating smoothly by executing docker compose ps.

Connecting Clients and Configuring Access Control

With the backend infrastructure operational, you can now provision endpoints across your enterprise network. Netbird supports Linux, Windows, macOS, iOS, and Android platforms.

Installing the Netbird Client Agent

For Linux-based servers or developer workstations, run the official installation script:

curl -FSsl [https://pkgs.netbird.io/install.sh](https://pkgs.netbird.io/install.sh) | sh

Once installed, establish the initial handshake to your self-hosted instance using the configuration flag:

netbird up --url [https://netbird.yourcompany.com](https://netbird.yourcompany.com)

The CLI will output an authentication URL. Open this link in your browser, authenticate via your company's Identity Provider, and the node will instantly join the secure mesh network.

Defining Network Access Control Lists (ACLs)

By default, Netbird creates a full-mesh configuration where every connected device can communicate with every other device. In a corporate environment, this violates the principle of least privilege. Navigate to your self-hosted Netbird Dashboard to segment traffic:

Create Groups: Segment nodes into distinct categories, such as Dev-Servers, Production-DB, and Remote-Employees.
Establish Access Rules: Authorize explicit point-to-point connections. For example, permit Remote-Employees to communicate with Dev-Servers only on specific ports, while strictly blocking direct visibility to the Production-DB group unless routed through a bastion host.

Security Best Practices for Self-Hosted Architecture

Maintaining a self-hosted infrastructure shifts security responsibilities to your internal operations team. Adhere to the following protocols to maintain integrity:

1. Implement Multi-Factor Authentication (MFA): Enforce rigid MFA policies directly at your OIDC provider. Because Netbird relies on this provider for node authorization, compromising a user password will not grant access to the network without secondary verification.

2. Continuous Container Updates: Set up automated pipelines or cron jobs utilizing tools like Watchtower to pull the latest security updates and patches for your Netbird containers.

3. Regular Backup Procedures: Ensure that the persistent volumes associated with the Netbird management configuration and the SQLite/PostgreSQL database are backed up daily to offsite, encrypted storage.

Conclusion

Transitioning from legacy VPNs to a self-hosted Netbird Mesh VPN enables businesses to reclaim control over their internal communication networks. By bypassing centralized servers for data routing, you eliminate structural performance bottlenecks and minimize data leakage risks. Through careful configuration of automated access control lists and robust identity provider integration, your organization can enjoy high-speed, secure, and low-latency peer-to-peer connectivity across global infrastructure deployments.