Install the NetBird Linux client on the VPS, enroll it with a headless-machine setup key, and then choose whether the VPS is an ordinary peer or a routing peer. A peer hosts services that run NetBird themselves; a routing peer forwards encrypted overlay traffic to private addresses or domains behind the VPS. The installation is usually outbound-only, but routing requires forwarding, a deliberate policy, and correctly configured firewalls and return paths.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What you are building
NetBird uses a management service to authenticate peers, retain network state, and distribute peer public keys and configuration. Once authorized, clients establish encrypted point-to-point WireGuard tunnels. The VPS therefore does not become publicly reachable merely because the client is installed: it joins an authenticated overlay and communicates with other authorized peers.
As an Amazon Associate I earn from qualifying purchases.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →There are two materially different designs:
| Design | Where the destination runs | What the VPS does | Extra networking work | Failure impact |
|---|---|---|---|---|
| Ordinary peer | The service is on the VPS itself and the VPS runs NetBird. | It is an endpoint in the overlay. | No subnet forwarding is needed for services hosted on that VPS. | Services on the VPS disappear from the overlay if the VPS or client is unavailable. |
| Routing peer | The destination is a private host, subnet, or resource that does not run NetBird. | It bridges the NetBird overlay to the reachable private network. | Forwarding, resource assignment, policy, firewall rules, and NAT or return routes are required. | All resources reached through that peer become unavailable when the peer or its path fails. |
NetBird’s documentation defines the latter precisely: “A routing peer is a NetBird peer whose client bridges your overlay network to private networks and resources that do not run the client.” The routing VPS must have direct network reachability to every resource it is expected to serve; NetBird cannot repair a missing route, an isolated provider network, or a host firewall that rejects the forwarded packet.
Choose managed NetBird Cloud or self-hosting first
The client setup is similar in both cases, but the control plane is not. Managed NetBird Cloud removes the need to operate management, signal, relay, identity, TLS, and control-plane firewall services. Self-hosting gives you control over the management environment and data location, while making you responsible for keeping those components reachable, patched, authenticated, and backed up.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
| Decision point | Managed NetBird Cloud | Self-hosted NetBird |
|---|---|---|
| Control-plane maintenance | NetBird operates the management service. | You operate management and the supporting signal, relay, identity, TLS, and firewall responsibilities. |
| Public endpoint and TLS | Provided as part of the managed service. | You must provide the documented public endpoints, DNS or addressing, certificates, and port mappings. |
| Data residency | Governed by the cloud service’s deployment and account arrangements. | You choose where the control plane runs and must secure that environment. |
| Upgrades | Control-plane upgrades are managed for you; clients still need an upgrade plan. | You schedule and test control-plane and client upgrades. |
| Cost model | Service-plan terms apply; the VPS remains a separate infrastructure cost. | You pay for the VPS and operational resources; no specific total cost is established here. |
The official self-hosting guide uses an Ubuntu 22.04 machine hosted at Hetzner as its tutorial VPS example and documents the routing endpoints and port mappings required for that deployment. That example describes one deployment pattern, not a requirement to use that operating system or provider. Follow the self-hosting guide’s current endpoint and mapping requirements if you choose to run the control plane yourself.
Prerequisites before you touch the VPS
- A NetBird account and administrative access to its dashboard, or a reachable self-hosted control plane.
- SSH access to the VPS with permission to install packages and change kernel networking settings.
- A supported Linux environment on the VPS. The official self-hosting tutorial uses Ubuntu 22.04, while the client installation command is supplied by NetBird for Linux.
- A clear design decision: host services directly on this peer, or route to an address, range, or domain behind it.
- For routing, a private-side interface or path from the VPS to the destination. Test that the VPS itself can reach the destination before involving NetBird.
- Permission to change the VPS provider’s security group and the host firewall if either restricts forwarding or outbound traffic.
- A list of source peer groups, destination resource groups, and ports that should be allowed. Write the narrowest policy you can before creating it.
Do not treat a setup key as a permanent administrator credential. Generate a key intended for the headless machine, protect it while it is being used over SSH, and apply the account’s normal key-lifecycle controls after enrollment.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Install and enroll the NetBird client over SSH
The official getting-started flow is designed for a headless Linux machine. Keep the SSH session open until enrollment has completed and the dashboard shows the VPS as connected.
-
Create a setup key
Open the NetBird dashboard, create or open the account you will use for this network, and generate a setup key for a headless machine. Copy the key into a protected local clipboard or password manager. Do not paste it into a public ticket, shell history shared with other users, or an image.
-
Connect to the VPS
Use SSH with an account that can run commands with
sudo. Confirm that the machine has working DNS and outbound connectivity. If your provider applies egress filtering, resolve that before enrollment. -
Install the Linux client
Run the official installer:
curl -fsSL https://pkgs.netbird.io/install.sh | shThe command downloads and executes NetBird’s installation script. Review your organization’s software-supply policy before using any remote installer; if your process requires package pinning or an internal mirror, adapt the installation method while preserving the same client and version controls.
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy. -
Enroll the machine
Use the setup key with the client:
netbird up --setup-key <YOUR_SETUP_KEY>Replace the placeholder with the key you generated. Keep the angle-bracket placeholder out of the actual command. Successful enrollment authorizes the peer and lets the management service distribute its configuration.
Rank #2
Windex Gaming Cleaning Wipes, Pre-Moistened Wipes to Instantly Clean all Gaming Gear and Electronics, Resealable Packaging for a Freshness Lock, 25 count (Pack of 1)- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
-
Confirm the peer in the dashboard
Return to the dashboard and verify that the VPS appears as connected. If it does not, check the SSH terminal for the client’s error, confirm outbound DNS and HTTPS access, and verify that the key was copied exactly and has not expired or been revoked.
At this point the VPS is an overlay peer. You can use it for services that run on the VPS itself, subject to your policy and host firewall. Continue with the routing sections only if the destination lives elsewhere.
Configure the VPS as an ordinary peer
For the ordinary-peer design, install the client on every machine that needs to communicate with the VPS. Use dashboard groups and policies to define which source peers may reach which services and ports. The destination is the VPS’s NetBird address, while the application still listens on the VPS’s normal service interface.
Keep service exposure narrow
- Bind an application to the interface and port appropriate for your design rather than exposing an administrative service broadly.
- Use NetBird policy groups to separate administrators, application peers, and test machines.
- Allow only the required destination ports. A peer being connected does not, by itself, grant every other peer access.
- Keep the VPS provider security group and the host firewall consistent with the intended overlay-only access.
No subnet forwarding or masquerade decision is needed when the application and the NetBird client are on the same VPS. Those concerns become central only when traffic must leave the VPS for a private resource behind it.
Configure the VPS as a routing peer
A routing peer is appropriate when the target does not run NetBird: for example, a private service on a cloud network, a server on a LAN reachable from the VPS, or a resource represented by an IP range or domain. The routing VPS must be able to reach that target on its private side before you create the overlay policy.
1. Verify the private-side path
From the VPS, test the destination using the same address and port that the application will use. Confirm that the route leaves through the intended interface and that the destination’s own firewall permits the VPS’s traffic. If this local test fails, NetBird configuration will not fix it.
2. Add a resource in the Networks model
For ordinary private-network access, prefer NetBird’s newer Networks model. In the dashboard, add the resource as an IP address, IP range, or domain. Assign the routing peer that can reach it and select the relevant resource and peer groups.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
Use an exact host address when only one host is needed; use a range when several addresses share the same private route; use a domain when the design and your name-resolution behavior require domain-based access. Avoid adding a broad range merely because it is convenient: the resource definition is part of your security boundary.
3. Create the access policy
Create a policy that names the intended source group, the resource group, and the permitted ports. A connected peer that is not in the source group should not receive access simply because it belongs to the same account. Conversely, a source group should not be allowed to every port on a resource when only one application is required.
4. Treat legacy Routes as a specific tool
Legacy Routes remain mainly relevant to exit-node configurations. For a normal private resource or subnet, the Networks model provides the resource, routing-peer assignment, groups, and policy in one design. Do not create both a legacy route and a Networks resource for the same traffic unless you have a deliberate reason and understand which configuration should win.
5. Enable forwarding
NetBird enables Linux IP forwarding automatically when it can. If it cannot, enable IPv4 forwarding manually:
sudo sysctl -w net.ipv4.ip_forward=1Persist the setting so a reboot does not silently break the route:
sudo sh -c 'printf "%sn" "net.ipv4.ip_forward=1" > /etc/sysctl.d/99-netbird.conf'Apply or reload the persisted setting using your distribution’s normal sysctl procedure, then verify that the kernel reports forwarding enabled. The one-time command changes the running system; the file is what makes the setting survive a reboot.
6. Enable IPv6 forwarding when the design uses IPv6
IPv4 forwarding does not enable IPv6 forwarding. If the resource, source peers, and route use IPv6, enable and persist the corresponding IPv6 forwarding setting as well, and make sure the provider and host firewalls permit IPv6 forwarding. Do not enable IPv6 routing merely because the VPS has an IPv6 address; configure it only when the routed design actually uses IPv6.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
Understand NAT and return routes
Masquerade is enabled by default for routed traffic. With masquerade, the destination sees the routing peer’s LAN-side address rather than the original NetBird address. This often works without adding a route for every overlay address on the private network, because replies naturally return to the routing peer.
Free tools Windows power users keep installed
One-click scans. No signup required.
Disable masquerade only when you can install and maintain return routes for the original NetBird addresses. Without those return routes, the destination may receive a packet but send its reply to a router that has no path back through the overlay. The result looks like a one-way connection: SYN packets or requests leave the client, but responses never arrive.
| Choice | Destination sees | What you must provide | Typical reason to choose it |
|---|---|---|---|
| Masquerade enabled | The routing peer’s private-side address. | Correct forwarding and firewall rules; no separate return route for each NetBird address. | Simple private-resource access where source identity at the destination is not required. |
| Masquerade disabled | The original NetBird source address. | Return routes from the private network back through the routing peer, plus compatible firewall rules. | The destination must distinguish overlay clients by their original addresses or apply source-based controls. |
Record this choice as part of the network design. Changing it later can alter destination firewall rules, logs, audit assumptions, and the route required on upstream private routers.
Open the right firewall paths
Check both firewall layers: the VPS provider’s security group and the operating system’s host firewall. They solve different problems, and a permit in one does not override a deny in the other.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallInbound traffic to the client
NetBird normally does not require you to open an inbound port on the VPS client because connections begin outbound. Do not expose an arbitrary UDP listener simply because the VPS is a peer. The exact behavior can still depend on network restrictions and whether direct peer connectivity is possible.
Outbound traffic from the VPS
Restrictive egress rules can block UDP needed for direct peer connections or TCP port 443 needed to reach the control plane. Permit the outbound traffic required by your NetBird deployment and ensure DNS works. If outbound UDP is blocked, the client may remain enrolled while direct paths fail or communication falls back to a less efficient path, depending on the deployment.
Forwarded traffic to private resources
For a routing peer, allow forwarding between the overlay-facing and private-side interfaces for only the resource addresses and ports in your policy. Also check the destination host firewall and any intermediate network ACL. A policy can authorize traffic in NetBird while the Linux firewall, provider security group, or destination still rejects it.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
Test the complete path
- Start with an authorized source peer. Use a client that belongs to the source group in the policy, not an administrator’s machine that may have broader access.
- Test the VPS peer itself. Confirm that the source can reach a service intentionally hosted on the VPS, if one exists. This separates basic peer authorization from routing problems.
- Test the routed resource. Connect to the configured IP, range member, or domain and port. Test the application protocol, not only a generic ping, because firewalls often treat protocols differently.
- Check assignments. In the dashboard, verify that the routing peer is connected, the resource is assigned to it, and the source and resource groups match the policy.
- Check the two firewall logs. Look at the provider security-group events and the VPS or destination host firewall logs for drops at the time of the test.
- Use a policy trace for a non-invasive check. NetBird’s routing-peer documentation describes
netbird debug tracefor simulating a packet against policy rules without sending real traffic. Use it to determine whether the proposed source, destination, and port are authorized before changing firewall rules.
Test from more than one source group when the policy is intended to separate users. A successful administrator test does not prove that an ordinary application peer is correctly restricted.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesTroubleshoot by symptom
| Symptom | Likely layer | Checks and correction |
|---|---|---|
| The VPS never appears connected. | Enrollment or control-plane reachability. | Confirm the setup key, client installation result, DNS, outbound TCP/443, and any self-hosted endpoint or TLS requirement. Re-enroll only after checking whether the original key was revoked or expired. |
| The VPS is connected, but no peer can reach a service on it. | Peer policy or host firewall. | Confirm the source group and destination port in policy, then inspect the VPS service binding and host firewall. Subnet forwarding is not relevant when the service runs on the VPS itself. |
| The VPS can reach a private host, but an overlay client cannot. | Routing-peer assignment, policy, or forwarding. | Verify the Networks resource, routing-peer assignment, source group, allowed port, and IPv4 or IPv6 forwarding. Use netbird debug trace to test policy logic without generating live traffic. |
| The request leaves but replies never return. | NAT or return path. | With masquerade disabled, add a return route for NetBird addresses through the routing peer. With masquerade enabled, verify that the destination and its firewall permit the routing peer’s private-side address. |
| Only some destinations in a range work. | Resource definition or private network ACL. | Check that the configured IP range includes the failing address, that the route reaches the correct interface, and that intermediate ACLs allow that host and port. |
| Enrollment succeeds but direct connectivity is unreliable. | Egress filtering or path establishment. | Check outbound UDP restrictions at the provider and host firewall. TCP/443 to the control plane must also remain available. Do not solve this by opening unrelated inbound ports. |
| IPv4 works but IPv6 fails. | Separate IPv6 routing configuration. | Enable IPv6 forwarding for an IPv6 routed design and verify IPv6 firewall rules, resource definitions, and return routes independently of IPv4. |
Operational practices for a reliable routing VPS
Make the routing peer replaceable
Document the setup-key process, resource assignments, policy groups, forwarding settings, NAT choice, provider security-group rules, and destination return routes. A second routing peer can reduce the impact of one VPS failure, but it must itself have a valid path to the resource and be assigned deliberately; simply enrolling another machine does not create redundancy.
Separate administrative and application access
Use different peer groups for administrators, applications, and temporary test clients. Policies should name the smallest source group and the smallest destination port set that meets the requirement. Remove a peer from its group or revoke its enrollment when its role ends.
Persist and monitor kernel networking
Forwarding that works only until the next reboot is an outage waiting to happen. Keep the sysctl file under configuration management, monitor the client’s connected state and the private-side path, and alert on firewall drops that coincide with failed tests.
Plan upgrades and control-plane ownership
For managed service users, the provider operates the control plane, but your VPS client and routing policy remain your responsibility. For self-hosters, upgrades also include management, signal, relay, identity, TLS, and firewall components. Stage changes where possible and retain a recovery path that does not depend on the route you are modifying.
Review the security boundary
A routing peer can expose an entire private range if the resource and policy are broad. Review each IP, range, domain, source group, and port as an access grant. Keep masquerade enabled unless the visibility of original NetBird addresses is an explicit requirement supported by complete return routing.
Plain peer or routing peer: a practical decision
Choose an ordinary peer when the application can run the NetBird client directly and you want the simplest path: each destination is an authenticated endpoint, and there is no subnet-forwarding dependency. Choose a routing peer when installing the client on the destination is impossible or inappropriate, such as a device, appliance, or private service that only the VPS can reach.
The routing design buys access to non-client resources at the cost of another failure domain. You must maintain forwarding, a resource definition, group policy, firewall rules, and either masquerade behavior or return routes. The ordinary-peer design avoids those subnet concerns but requires a client on every destination that needs overlay access.
What success looks like
- The VPS is shown as connected in the NetBird dashboard after setup-key enrollment.
- Every routed resource is reachable from the VPS itself through the intended private-side interface.
- The Networks resource, routing peer, source group, resource group, and permitted ports agree with one another.
- Linux forwarding is enabled and persisted for every address family used by the design.
- The provider security group, VPS firewall, destination firewall, and any intermediate ACL permit only the required flows.
- NAT behavior is intentional, and return routes exist whenever masquerade is disabled.
- An authorized test client can reach the intended service, while an unauthorized group cannot.
The installation command gets the client onto the VPS; the reliable network comes from the choices after enrollment. Treat the VPS as an ordinary peer unless you have a real private resource to bridge, and when you do bridge one, design the route, policy, forwarding, firewall, and return path as one system.
Recommended Free Tools
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
