Category: Networking and VPN
Private network with NetBird or Tailscale: zero trust access without opening ports
A private network where every laptop, server and office connects with the company sign-in, and the rules decide who reaches what, with no servers exposing open ports to the internet.
- Where it runs
- In your account, in your name
- Backups
- With tested restores
- Updates
- Planned and documented
- Licence
- NetBird: BSD-3 clients and AGPLv3 server; Headscale: BSD-3; Tailscale: proprietary service with open source clients
In short
NetBird and Tailscale build a private mesh network on top of WireGuard: each device connects directly to the others and access is decided per person and per group. Tailscale is a cloud service; NetBird and Headscale can be hosted in your account. We set it up, connect it to your single sign-on, write the access rules, back up the configuration and keep it up to date.
What do we take care of?
Installing the client on a laptop takes a minute. What needs looking after is everything around it: that the rules do not let everyone reach everything, that leavers are removed, that the coordination server is backed up and that devices are up to date. This is what we keep under control:
Coordination server
NetBird or Headscale in your account, with HTTPS, a database and backups; or your Tailscale network properly configured.
Single sign-on
Each person signs in with the company account and, if your provider requires it, with two-factor authentication.
Access rules
Groups by team and by role, and rules that only open what is needed, stored as code.
Routes to internal networks
Routers into the office or the cloud to reach machines where nothing is installed.
Devices
New devices, removals, lost devices and machines that should no longer be on the network.
Monitoring
Server down, devices not connecting, relayed traffic and outdated clients.
How does a mesh network work?
All three options use WireGuard to encrypt traffic between devices. The difference from a classic VPN is who coordinates and where that piece lives:
| Option | Coordination server | When we propose it |
|---|---|---|
| Tailscale | The vendor’s cloud service | You want the simplest option and do not mind coordination being outside |
| NetBird | In your account or in its cloud | You want everything on your infrastructure, with a web dashboard and per-group rules |
| Headscale | In your account, with the Tailscale clients | A single network, a technical team and no third-party services |
The coordination server hands out the public keys and the rules, but traffic goes directly between devices whenever the network allows it. That is why the servers need no open ports and nobody outside can see them.
What problems do we come across most often?
- The default rule that lets everyone reach everything, which nobody changed after installation.
- Devices belonging to people who have left, because leavers were not tied to the directory.
- Server keys that expire and a server that becomes unreachable on some random day.
- A self-hosted server with no backup, with the whole network configuration on a single machine.
- Rules made by hand in the dashboard that nobody knows why they exist or who asked for them.
- Lots of relayed traffic because a firewall blocks direct connections and everything is slow.
How do we handle backups, upgrades and restores?
With self-hosted NetBird or Headscale, we back up the coordination server’s database and configuration off the machine, and keep the access rules in a repository so they can be reviewed and applied again. Every so often we restore onto another machine and check that the devices reconnect using the same domain name. With Tailscale there is no server to back up, but the access policy also goes into the repository.
Before upgrading the server we read the release notes, take a backup and test in a separate environment when the change is a big one. The clients on the laptops update themselves or through your device management tool, and we keep an eye on the ones that fall behind.
Who is it for?
- A software company with servers across several clouds that wants the team to reach databases and internal dashboards with their company account, without bastion hosts or open administration ports.
- An accountancy or law firm with remote working that wants each person to reach the file server or the office software from home with the Microsoft or Google account they already use, and wants a leaver’s access cut on all their devices.
- A team spread across the office, home and clients that needs different rules for technical staff, administration and external collaborators.
How do we protect the network?
We start by removing the rule that lets everyone reach everything and open only what each group needs. Sign-in goes through your identity provider with two-factor authentication, whether Google, Microsoft or your own Keycloak, and servers are enrolled with single-use keys or tags, not with a person’s account. The NetBird dashboard and the Headscale API are not left open to anyone, and the server is kept up to date with security patches. Access events can go to Wazuh, and we monitor the coordination server from monitoring with Grafana and Prometheus.
- Single sign-onGoogle, Microsoft or Keycloak
- NetBirdCoordination and rules
- DevicesLaptops, servers and phones
- WireGuardDirect tunnels between them
- Internal networksOffice and cloud via routes
Where do we set it up?
In your account, with the provider you already use or the one that fits best. If the data has to stay in the EU, Hetzner and OVHcloud are the European options.
Providers we set it up on
- Hetzner
- AWS
- Google Cloud
- Azure
- DigitalOcean
- OVH
- Own server
| Provider | How we set it up | Things to bear in mind |
|---|---|---|
| Hetzner | A small cloud server running the NetBird or Headscale server, its database and backups in Object Storage. | With Tailscale there is nothing to host: just the clients and, if needed, a subnet router. |
| AWS | NetBird or Headscale server on EC2, and a router node inside the VPC to reach RDS and private servers. | The subnet router saves installing the client on every instance. |
| Google Cloud | Coordination server on Compute Engine and a router into the VPC network. | |
| Azure | Coordination server on a virtual machine, with Microsoft Entra ID sign-in. | A good fit if the company already works with Microsoft 365. |
| DigitalOcean | A Droplet with the coordination server and a router into your VPC. | |
| OVH | Public Cloud instance with the coordination server and backups in OVHcloud Object Storage. | |
| Own server | A client on a machine in the office acting as a router into the local network. | The coordination server is best kept outside the office: if the power goes there, everyone else can still connect. |
What is included
- Private network with NetBird or Tailscale, or with Headscale if you want the coordination server in your account.
- Self-hosted NetBird or Headscale server in your account, with its database and HTTPS certificate.
- Sign-in with the company account: Google, Microsoft, Keycloak or another OpenID Connect provider.
- Groups and access rules per person, per team and per server, stored as code and open to review.
- Routes to the office network or your cloud network to reach printers, NAS devices or databases without installing anything on them.
- Joiners and leavers tied to the directory: whoever leaves the company loses access on all their devices.
- Backups of the server database and the access policy, with a tested restore.
- Monitoring of disconnected devices, relayed connections and client versions.
Frequently asked questions
NetBird, Tailscale or Headscale?
Tailscale is the most polished and there is nothing to maintain, but the coordination server belongs to the vendor and business plans are paid per user. NetBird is open source and can be hosted entirely in your account, with a web dashboard, single sign-on and per-group rules. Headscale is a free coordination server that uses the official Tailscale clients, designed for a single network and with no official web dashboard. If you want everything to be yours, we usually propose NetBird.
Why is there no need to open ports on the servers?
Each device starts the connection outwards and the coordination server helps them find each other, so the servers do not need any port open to the internet for the team to reach them. When a network does not allow a direct connection, the traffic goes through a relay, encrypted end to end with WireGuard.
Does it connect to our single sign-on?
Yes. Tailscale supports Google, Microsoft, GitHub, Okta and other OpenID Connect providers. Self-hosted NetBird and Headscale connect to any OpenID Connect provider, such as Google, Microsoft Entra ID or your own Keycloak. That way, whoever signs in with the company account gets into the network, and whoever leaves the directory no longer does.
What is the advantage over a classic VPN?
In a classic VPN everything goes through a central server and, once inside, people can usually reach the whole network. In a mesh network each device connects directly to what it needs and the rules limit access per person. For a few people and one office, a VPN with WireGuard or OpenVPN is still simpler.
What happens if the coordination server goes down?
Connections that are already established keep working for a while, but you cannot add devices or apply rule changes until it is back. That is why we back up its database off the server, monitor it and have rehearsed bringing it up on another machine.
Tell us about your case
In a free 20-minute call we look at where you are and where to start. No commitment.
Official documentation consulted
The technical details on this page are based on:
Reviewed on