VPNs are one of those networking concepts that seem magical when working correctly. The fact that two systems on different networks can communicate with each other using a completely private tunnel is still something that blows my mind when it works correctly. When it doesn’t, I want to tear out the little hair I still have left on my head.
The tunnel leading to my home lab collapsed while I was on vacation, and the worst part wasn’t losing access, but the fact that I had no idea why it happened. I had built it myself – a WireGuard setup that funnels every remote connection through a VPS in Toronto – and it had been largely reliable up to that point. That interruption was the push I needed to implement a proper overlapsomething I had wanted to do for a while. I replaced my self-configured system with NetBird, a completely self-hosted secure access platform that was everything I wanted in a VPN and more.
My WireGuard tunnel was reliable until it wasn’t
I still don’t fully understand why it fell.
A handwritten WireGuard configuration gives you a lot: a fast tunnel, strong cryptography, and a configuration you can understand line by line. What it doesn’t give you is a feedback loop. When my link went down, my entire diagnostic toolset was “wg show” and inference. Was it a failure at the handshake level? A routing issue on my part? As a new parent with more things on my plate than ever, I simply didn’t have time to spend hours tracking down the point of failure and decided to ditch minimalism and its benefits for a more feature-rich platform.
NetBird places a control plane in front of those same WireGuard tunnels. The actual VPN below is exactly the same, but now I have a way to monitor each peer, connection status, link, and everything else I need to debug an issue. And this control plane is hosted on my VPS, the same hub used for my original WireGuard setup.
The amenities are very real and appreciated.
I love a CLI but a GUI is very welcome
Part of my motivation for switching to an overlay like NetBird was simplicity. Using a GUI to manage pairs instead of manually editing configuration files every time I add a device is something WireGuard can’t do and has saved me a lot of time over the past few weeks. Managing peers and access from a dashboard made it possible to add a device or change who can access what with a few clicks instead of meticulously changing configuration files and restarting interfaces. Convenient, yes, but fundamentally it’s still a better wrapper for the things WireGuard already did.
What attracted me to NetBird specifically over something like Tailscale self-hosted with Headscale was the reverse proxy features. Having a GUI configurator to configure a reverse proxy with Traefik is already a plus, but what specifically sets NetBird apart is the additional authentication you can add. You expose an internal service to the web with proper TLS, but the real reward was the ability to add things like SSO, a password, PIN verification, or restrict access to other NetBird peers. This differs from running Tailscale in that you don’t need to use the Tailscale Funnel or use your own authentication measures. It’s all under one roof with NetBird, and that’s something I really appreciate. It’s technically still in beta, but it’s worked perfectly for me so far.
I didn’t really get rid of WireGuard
I just put more moving parts on top of it.
The whole appeal of WireGuard is that it has almost no moving parts. One kernel module, one flat configuration file that can audit, version control and backup in seconds, and nothing that needs to keep running. Basically, I’m incorporating a management service, a signaling service, a relay, a Traefik reverse proxy, and an identity layer. They are all under a Docker Compose command, but they are still individual services stacked on top.
And if all you really wanted was to stop manually editing settings, you didn’t need any of that. wg-easy would have been a good choice for a clean web interface for my existing WireGuard server, complete with key management, QR codes for phones, and easy client creation. For a solo trader, this might make a little more sense and is definitely the lighter answer.
There are many more features here than just a GUI
While wg-easy adds the GUI element, it doesn’t change the topology you were already working with. It doesn’t give me true peer-to-peer connectivity, where NetBird uses ICE and STUN to establish a direct path between devices and only resorts to a relay when a direct connection is impossible. And it doesn’t have a reverse proxy, which is fine, but NetBird has added some special sauce on top of what I already mentioned that made it at least worth a try.
The reverse proxy started with HTTP only in version 0.65, which covers web panels and APIs, but skips everything that doesn’t speak HTTP. NetBird has since extended it to Layer 4 in v0.67, so passing through TCP, UDP and TLS is processed the same, without the proxy inspecting or terminating what’s inside. This is what would allow you, in theory, to publish something like a gaming server or a VoIP server. Having access to features like this is what made it worth the complete switch.
A hand-built tunnel is good for a couple of colleagues, but NetBird is better for accessing the entire lab
So no, I In fact did not abandon WireGuard. I just left out the song and dance of having to manage it through configuration files and troubleshooting with a CLI, which is not what I want to do when all I want is access. It’s more complex, has more points of failure, and some parts are still in beta, but so far it’s been virtually flawless.
