NetBird Reverse
netbird.io · Egress and tunnels · 2 records · JSON
- NetBird Egress and tunnelscaveatemailno cardDper-ip-shaping
- NetBird Reverse Proxy Egress and tunnelscaveatemailno cardU
NetBird Egress and tunnels
caveatemailno cardDper-ip-shaping
| Free tier | 100 machines on the cloud plan unit users; metered on identity-count |
|---|---|
| Price | none stated |
| Per-object cap | not applicable |
| Retention | not applicable |
| Egress | direct WireGuard where possible; the cloud relay otherwise, at an unpublished rate |
| Identity | email a NetBird account |
| Limits |
counts of things, not rates, so no vocabulary kind names them: 100 machines plus 10 per user |
| Binding | per-ip-shaping No byte figure exists for the cloud Reverse Proxy, so 1 TiB/month is planned against a sentence rather than a number. The L4 mode accepts TCP and UDP, so the transport test passes, and the reverse proxy is free to use; what fails first is the unwritten fair-use clause, with self-hosting named by the vendor as the way the restrictions do not apply. |
| Interface | cli netbird up |
| Tooling | netbird |
| Composes with | signalling with a relay fallback; self-hosting removes the machine cap and adds a server to run. |
| Reliability | The cloud Reverse Proxy is beta, is shared and best-effort, and carries a named but unnumbered bandwidth and rate-limit clause; L4 services support TCP and UDP, and HTTP services do not. |
| Notes | 2026-10-23: the cloud plan has a public ingress with UDP. NetBird Reverse Proxy offers L4 'TCP', 'UDP' and 'TLS' service modes, and a UDP service is 'a UDP relay with session tracking. The proxy accepts UDP packets on the service's listen port and forwards them to your backend. Sessions are reaped after an idle timeout'. Cloud domains are free and appear 'with a Free badge'. The meter is discretionary: 'NetBird's cloud-hosted Reverse Proxy is provided on a shared, best-effort basis. High-volume or sustained data transfers may be subject to bandwidth limits, rate limiting, and fair-use policies', and 'These restrictions do not apply if you self-host NetBird'. Whether the Free plan is entitled to the feature is not stated on either the pricing page or the docs page. |
| Evidence rung | documented |
| Checked | 2026-10-23 (live); stale on 2026-11-22 |
Evidence (3)
| date | source | what it proved |
|---|---|---|
| 2026-10-22 | netbird.io/pricing | 100 machines on the free tier |
| 2026-10-23 | docs.netbird.io/manage/reverse-proxy | 'UDP | L4 | UDP relay with session tracking. The proxy accepts UDP packets on the service's listen port and forwards them to your backend.' |
| 2026-10-23 | docs.netbird.io/manage/reverse-proxy/service-configuration | 'Cloud-hosted usage limits: NetBird's cloud-hosted Reverse Proxy is provided on a shared, best-effort basis. High-volume or sustained data transfers may be subject to bandwidth limits, rate limiting, and fair-use policies' |
More fields (3)
{
"stale_after_days": 180,
"bytes_transit": "conditional",
"transit_note": "peers negotiate a direct WireGuard path; the operator's relay carries bytes only when that fails, at an unpublished rate"
}NetBird Reverse Proxy Egress and tunnels
caveatemailno cardU
| Free tier | NetBird Free is 0 EUR, 'up to 5 users', '100 machines'; the pricing page lists P2P connections, Networks, SSO, access controls, Private DNS, Network Routes and NetBird SSH, and does not list Reverse Proxy on any plan. unit users; metered on identity-count |
|---|---|
| Price | EUR 0 on Free, subject to whether the feature is included |
| Per-object cap | not applicable |
| Retention | not applicable |
| Egress | none published: the pricing page charges per active user and machine and states no byte allowance; ingress: tcp+udp free_allowance: none published |
| Identity | email 'No credit card is required.' A NetBird account, which on Free is up to 5 users, with social SSO available. |
| Limits |
|
| Binding | none No byte quota and no rate is published, so nothing in the vocabulary fails at 1 TiB/month. Whether the feature is available on the free plan at all is the open question, and that is a plan gate rather than a limit kind. |
| Interface | cli, rest 'The netbird expose command lets peers expose local services to the public internet through the NetBird reverse proxy' |
| Tooling | netbird CLI or the dashboard; no WireGuard client needed |
| Composes with | turns a free VM running only the NetBird agent into a host with a public TCP or UDP port on a NetBird domain, which removes the need for a tunnel broker prefix |
| Reliability | UDP sessions are reaped after an idle timeout; ephemeral expose sessions die 90 seconds after the daemon stops renewing; Rosenpass is not supported with the reverse proxy. |
| Notes | This is the only free-plan path found where a WireGuard peer gets a public TCP and UDP listener with no card and no account review, provided the feature is not gated. L4 services listen on a port on the proxy cluster and several services can share a port; custom ports depend on a cluster flag. A self-hosted deployment needs Traefik. The alternative reading, that Reverse Proxy is paid, cannot be excluded from the pages read, which is why the rung is unverified rather than documented. L4 services carry no browser SSO, only IP and country restrictions. Re-read 2026-10-23: the docs open with 'Availability: Reverse Proxy is currently in beta', and netbird expose needs an account administrator to enable Peer Expose and name allowed peer groups. |
| Evidence rung | unverified The L4 TCP and UDP capability is documented in the vendor's docs. Whether the free plan includes Reverse Proxy is not: it is absent from every plan list on the pricing page. One sentence naming the plan that includes it would raise this to documented. |
| Checked | 2026-10-23 (live); stale on 2026-11-06 |
| Parsed numbers |
|
Evidence (3)
| date | source | what it proved |
|---|---|---|
| 2026-10-23 | docs.netbird.io/manage/reverse-proxy | HTTP and L4 modes, the UDP relay with session tracking, the public domain with automatic TLS, and the WireGuard tunnel to the peer |
| 2026-10-23 | netbird.io/pricing | Free is 0 EUR with up to 5 users and 100 machines, and Reverse Proxy appears in no plan list |
| 2026-10-23 | docs.netbird.io/manage/reverse-proxy/expose-from-cli | 'This supports both HTTP and L4 (TCP, UDP, TLS) protocols' and the ephemeral session model |
More fields (7)
{
"wg_path": "inside-udp",
"wg_detail": "'Incoming traffic to that domain is received at the NetBird proxy cluster, then forwarded through an encrypted NetBird tunnel to the target peer.' The diagram is labelled 'through WireGuard tunnel', so the WireGuard datagram rides NetBird's own transport rather than a .conf the client holds.",
"ingress": "tcp+udp",
"volume_tib_month": null,
"volume_stated": "none published: the pricing page charges per active user and machine and states no byte allowance",
"bytes_transit": "yes",
"transit_note": "NetBird's proxy cluster terminates the public side and forwards over its WireGuard mesh"
}Unknown or withheld values (2)
$.per_object_cap.statednot-applicable$.retention.statednot-applicable