{"eid":"netbird","name":"NetBird Reverse","domain":"netbird.io","resolved_by":"domain","topics":["egress"],"n_records":2,"best_vorder":1,"review":null,"aliases":["NetBird","NetBird Reverse","NetBird Reverse Proxy","netbird.io"],"records":[{"rid":"egress/netbird-free","card":{"rid":"egress/netbird-free","eid":"netbird","topic":"egress","slug":"netbird-free","provider":"NetBird","url":"https://netbird.io/pricing","domain":"netbird.io","category":"mesh network","tier":null,"verdict":"qualifies-with-caveat","vorder":1,"grp":"usable","confidence":"documented","binding":"per-ip-shaping","identity_kind":"email","identity_basis":"stated","needs_card":0,"needs_phone":0,"needs_id":0,"needs_institution":0,"country":null,"crypto":null,"interfaces":"cli","egress_metered":0,"per_object_bytes":null,"retention_days":null,"verified_at":"2026-10-23T00:00:00.000Z","verified_basis":"live","checked_on":"2026-10-23","stale_on":"2026-11-22","n_evidence":3,"usd_month":null,"usd_per_tb_month":null,"summary":"100 machines on the cloud plan","duplicate_of":null,"n_unknown":0},"record":{"topic":"egress","slug":"netbird-free","provider":"NetBird","url":"https://netbird.io/pricing","category":"mesh network","free_tier":{"stated":"100 machines on the cloud plan","unit":"users","metered_on":"identity-count","source_url":"https://netbird.io/pricing","read_on":"2026-10-22","notes":""},"per_object_cap":{"stated":"not applicable","bytes":null,"notes":""},"retention":{"stated":"not applicable","days":null,"notes":"","source_url":"https://netbird.io/pricing"},"egress":{"terms":"direct WireGuard where possible; the cloud relay otherwise, at an unpublished rate","metered":false,"free_allowance":null,"price_per_tb":null,"source_url":"https://netbird.io/pricing"},"interface":["cli"],"tooling":"netbird","chaining":"signalling with a relay fallback; self-hosting removes the machine cap and adds a server to run.","limits":[{"kind":"per-ip-shaping","value":"no number: the cloud-hosted Reverse Proxy is 'shared, best-effort'; 'High-volume or sustained data transfers may be subject to bandwidth limits, rate limiting, and fair-use policies'","source":"https://docs.netbird.io/manage/reverse-proxy/service-configuration"}],"identity_cost":{"kind":"email","detail":"a NetBird account","country":null},"reliability_note":"The cloud Reverse Proxy is beta, is shared and best-effort, and carries a named but unnumbered bandwidth and rate-limit clause; L4 services support TCP and UDP, and HTTP services do not.","confidence":"documented","evidence":[{"url":"https://netbird.io/pricing","date":"2026-10-22","proved":"100 machines on the free tier"},{"url":"https://docs.netbird.io/manage/reverse-proxy","date":"2026-10-23","proved":"'UDP | L4 | UDP relay with session tracking. The proxy accepts UDP packets on the service's listen port and forwards them to your backend.'"},{"url":"https://docs.netbird.io/manage/reverse-proxy/service-configuration","date":"2026-10-23","proved":"'Cloud-hosted usage limits: NetBird's cloud-hosted Reverse Proxy is provided on a shared, best-effort basis. High-volume or sustained data transfers may be subject to bandwidth limits, rate limiting, and fair-use policies'"}],"verdict":"qualifies-with-caveat","verified_at":"2026-10-23T00:00:00.000Z","notes":"2026-10-23: the cloud plan has a public ingress with UDP. NetBird Reverse Proxy offers L4 'TCP', 'UDP' and 'TLS' service modes, and a UDP service is 'a UDP relay with session tracking. The proxy accepts UDP packets on the service's listen port and forwards them to your backend. Sessions are reaped after an idle timeout'. Cloud domains are free and appear 'with a Free badge'. The meter is discretionary: 'NetBird's cloud-hosted Reverse Proxy is provided on a shared, best-effort basis. High-volume or sustained data transfers may be subject to bandwidth limits, rate limiting, and fair-use policies', and 'These restrictions do not apply if you self-host NetBird'. Whether the Free plan is entitled to the feature is not stated on either the pricing page or the docs page.","extras":{"stale_after_days":180,"bytes_transit":"conditional","transit_note":"peers negotiate a direct WireGuard path; the operator's relay carries bytes only when that fails, at an unpublished rate"},"binding":"per-ip-shaping","interface_detail":"netbird up","limits_note":"counts of things, not rates, so no vocabulary kind names them: 100 machines plus 10 per user","binding_note":"No byte figure exists for the cloud Reverse Proxy, so 1 TiB/month is planned against a sentence rather than a number. The L4 mode accepts TCP and UDP, so the transport test passes, and the reverse proxy is free to use; what fails first is the unwritten fair-use clause, with self-hosting named by the vendor as the way the restrictions do not apply."},"claims":[{"path":"$.free_tier.stated","kind":"free-quota","num":null,"unit":null,"per":null,"currency":null,"usd":null,"fx_date":null,"parse":"unparsed"},{"path":"$.limits[0].value","kind":"limit:per-ip-shaping","num":null,"unit":null,"per":null,"currency":null,"usd":null,"fx_date":null,"parse":"unparsed"}],"unknown":[],"history":[],"drift":[]},{"rid":"egress/netbird-reverse-proxy","card":{"rid":"egress/netbird-reverse-proxy","eid":"netbird","topic":"egress","slug":"netbird-reverse-proxy","provider":"NetBird Reverse Proxy","url":"https://docs.netbird.io/manage/reverse-proxy","domain":"netbird.io","category":"WireGuard overlay with public L4 proxy","tier":"free","verdict":"qualifies-with-caveat","vorder":1,"grp":"usable","confidence":"unverified","binding":"none","identity_kind":"email","identity_basis":"stated","needs_card":0,"needs_phone":0,"needs_id":0,"needs_institution":0,"country":null,"crypto":null,"interfaces":"cli,rest","egress_metered":0,"per_object_bytes":null,"retention_days":null,"verified_at":"2026-10-23T00:00:00.000Z","verified_basis":"live","checked_on":"2026-10-23","stale_on":"2026-11-06","n_evidence":3,"usd_month":null,"usd_per_tb_month":null,"summary":"NetBird Free is 0 EUR, 'up to 5 users', '100 machines'; the pricing page lists P2P connections, Networks, SSO, access controls, Private DNS, Network Routes a...","duplicate_of":null,"n_unknown":2},"record":{"topic":"egress","slug":"netbird-reverse-proxy","provider":"NetBird Reverse Proxy","url":"https://docs.netbird.io/manage/reverse-proxy","category":"WireGuard overlay with public L4 proxy","tier":"free","free_tier":{"stated":"NetBird Free is 0 EUR, 'up to 5 users', '100 machines'; the pricing page lists P2P connections, Networks, SSO, access controls, Private DNS, Network Routes and NetBird SSH, and does not list Reverse Proxy on any plan.","unit":"users","metered_on":"identity-count","source_url":"https://netbird.io/pricing","read_on":"2026-10-23","notes":""},"per_object_cap":{"stated":"not applicable","bytes":null,"source_url":"https://docs.netbird.io/manage/reverse-proxy","notes":""},"retention":{"stated":"not applicable","days":null,"source_url":"https://docs.netbird.io/manage/reverse-proxy","notes":""},"egress":{"terms":"none published: the pricing page charges per active user and machine and states no byte allowance; ingress: tcp+udp","metered":false,"free_allowance":"none published","price_per_tb":null,"source_url":"https://docs.netbird.io/manage/reverse-proxy"},"interface":["cli","rest"],"interface_detail":"'The netbird expose command lets peers expose local services to the public internet through the NetBird reverse proxy'","tooling":"netbird CLI or the dashboard; no WireGuard client needed","chaining":"turns a free VM running only the NetBird agent into a host with a public TCP or UDP port on a NetBird domain, which removes the need for a tunnel broker prefix","limits":[{"kind":"volume-quota","value":"none stated; billing is per active user and machine","source":"https://netbird.io/pricing"}],"limits_note":"","binding":"none","binding_note":"No byte quota and no rate is published, so nothing in the vocabulary fails at 1 TiB/month. Whether the feature is available on the free plan at all is the open question, and that is a plan gate rather than a limit kind.","identity_cost":{"kind":"email","detail":"'No credit card is required.' A NetBird account, which on Free is up to 5 users, with social SSO available.","country":"None"},"reliability_note":"UDP sessions are reaped after an idle timeout; ephemeral expose sessions die 90 seconds after the daemon stops renewing; Rosenpass is not supported with the reverse proxy.","confidence":"unverified","confidence_note":"The L4 TCP and UDP capability is documented in the vendor's docs. Whether the free plan includes Reverse Proxy is not: it is absent from every plan list on the pricing page. One sentence naming the plan that includes it would raise this to documented.","evidence":[{"url":"https://docs.netbird.io/manage/reverse-proxy","date":"2026-10-23","proved":"HTTP and L4 modes, the UDP relay with session tracking, the public domain with automatic TLS, and the WireGuard tunnel to the peer"},{"url":"https://netbird.io/pricing","date":"2026-10-23","proved":"Free is 0 EUR with up to 5 users and 100 machines, and Reverse Proxy appears in no plan list"},{"url":"https://docs.netbird.io/manage/reverse-proxy/expose-from-cli","date":"2026-10-23","proved":"'This supports both HTTP and L4 (TCP, UDP, TLS) protocols' and the ephemeral session model"}],"verdict":"qualifies-with-caveat","verified_at":"2026-10-23T00:00:00.000Z","price_per_tb_month":"EUR 0 on Free, subject to whether the feature is included","notes":"This is the only free-plan path found where a WireGuard peer gets a public TCP and UDP listener with no card and no account review, provided the feature is not gated. L4 services listen on a port on the proxy cluster and several services can share a port; custom ports depend on a cluster flag. A self-hosted deployment needs Traefik. The alternative reading, that Reverse Proxy is paid, cannot be excluded from the pages read, which is why the rung is unverified rather than documented. L4 services carry no browser SSO, only IP and country restrictions. Re-read 2026-10-23: the docs open with 'Availability: Reverse Proxy is currently in beta', and netbird expose needs an account administrator to enable Peer Expose and name allowed peer groups.","extras":{"wg_path":"inside-udp","wg_detail":"'Incoming traffic to that domain is received at the NetBird proxy cluster, then forwarded through an encrypted NetBird tunnel to the target peer.' The diagram is labelled 'through WireGuard tunnel', so the WireGuard datagram rides NetBird's own transport rather than a .conf the client holds.","ingress":"tcp+udp","volume_tib_month":null,"volume_stated":"none published: the pricing page charges per active user and machine and states no byte allowance","bytes_transit":"yes","transit_note":"NetBird's proxy cluster terminates the public side and forwards over its WireGuard mesh"}},"claims":[{"path":"$.free_tier.stated","kind":"free-quota","num":null,"unit":null,"per":null,"currency":null,"usd":null,"fx_date":null,"parse":"unparsed"},{"path":"$.limits[0].value","kind":"limit:volume-quota","num":null,"unit":null,"per":null,"currency":null,"usd":null,"fx_date":null,"parse":"unparsed"},{"path":"$.price_per_tb_month","kind":"price-per-tb","num":0.0,"unit":"TB","per":"month","currency":"EUR","usd":0.0,"fx_date":"2026-10-23","parse":"ok"}],"unknown":[["$.per_object_cap.stated","not-applicable"],["$.retention.stated","not-applicable"]],"history":[],"drift":[]}]}