NetBird
Berlin-based zero trust network built on WireGuard, with a free cloud plan, published prices and self-hosting
Quick Overview
| Company | NetBird GmbH |
|---|---|
| Category | SASE and Zero Trust Network Access |
| Headquarters | Berlin, Germany |
| Founded | Not stated |
| EU Presence | Yes - Germany (EU) |
| Data Location | Your own infrastructure when self-hosted; cloud hosting region not stated on the pricing page |
| Open Source | BSD-3-Clause, with AGPLv3 for management, signal and relay |
| GDPR Compliant | Yes |
| Self-Hosting | Yes - Docker Compose quickstart |
| Main Features | Peer-to-peer WireGuard connections, SSO and MFA, group access rules, device posture checks, traffic event logging, private DNS, SCIM provisioning, SSH access |
| Pricing | Free EUR 0 (up to 5 users, 100 machines); Team EUR 6 and Business EUR 12 per user per month; Enterprise on request |
| Best For | Teams retiring a classic VPN who want to start free and keep the option to self-host |
| Replaces | Netskope Private Access, Zscaler Private Access, Tailscale |
Detailed Review
NetBird connects devices into one private network using direct WireGuard tunnels, with a central policy deciding which groups may talk to which resources. It targets the part of Netskope that lets staff reach internal systems, and it does not try to inspect web traffic.
The company is NetBird GmbH in Berlin, registered at the Amtsgericht Charlottenburg (HRB 237529 B), and its terms follow German law. The pricing page also shows a "GDPR, ISO 27001, DORA" banner, which is the vendor's own claim.
Prices you can read before a call
Where Netskope asks you to talk to sales, NetBird lists Free at EUR 0, Team at EUR 6 and Business at EUR 12 per user a month, and bills only for users and machines that connected in the period. Extra machines cost EUR 0.50 a month on the two paid plans.
The step from Team to Business matters, because device approvals, MDM and EDR controls, posture checks and connection traffic logging only start there.
Open code, two ways to run it
Most of the repository is BSD-3-Clause and the management, signal and relay components are AGPLv3, so a team with spare engineering time can host the whole control plane itself. The alternative is the cloud plan, where NetBird runs it.
Self-hosting keeps connection metadata on your servers, at the cost of patching and monitoring them yourself.
Where it stops
NetBird is a network, not a gateway. It has no secure web gateway, no CASB and no inline data loss prevention, so a company using Netskope mainly for web filtering would still need another tool for that half.
Limitations to Consider
NetBird covers private access only, with no web gateway, CASB or inline DLP. Posture checks and traffic logging require the Business plan, and a self-hosted setup leaves operations with you. It is a much smaller vendor than Netskope. For a managed web-plus-access service look at Open Systems.
Who Should Use NetBird
Small and mid-sized European teams, and engineering-led companies, that want identity-based access instead of a VPN and value being able to read both the code and the price list.
Pros and Cons
Pros
- Free plan and public per-user prices
- Source code you can read and host
- German company under German law
- Group-based access with posture checks on Business
- Billing only for active users
Cons
- No web gateway, CASB or DLP
- Posture checks only on the EUR 12 plan
- Self-hosting means running it yourself
- Smaller than the US platforms
Alternatives to NetBird
Other European sase and zero trust network access worth comparing before you decide:
Defguard
Poland · Self-hosted WireGuard platform that asks for MFA on each connection
Systancia
France · Zero trust access and privileged access for IT and industrial systems
Open Systems
Switzerland · Zurich operator running SASE as a managed service with a 24 by 7 team
Cato Networks
Israel · Single-platform SASE with SD-WAN, firewall, web gateway and ZTNA
See all European sase and zero trust network access or compare them directly against Netskope Private Access on our alternatives page.
Frequently Asked Questions
Only the private access part. NetBird connects users to internal resources but does not filter web traffic or scan SaaS usage.
The management, signal and relay services run on your own servers, so connection metadata stays there. You are then responsible for updates and availability.
Per active user per month on Team and Business, counting only users and machines that connected or logged in at least once in the billing period.