NetBird Reverse
netbird.io · 2 records in Egress and tunnels · JSON
Records 2
- caveatNetBird
Egress and tunnelsfree tieridentity emailno cardlimit per-ip-shapingevidence documentedstale on 2026-11-23
- caveatNetBird Reverse Proxy
Egress and tunnelsfree tieridentity emailno cardevidence unverifiedstale on 2026-11-19
NetBird
Egress and tunnels- Free allowance
- 100 machines on the cloud plan
- Verdict
- caveatusable, with a named limit or an unprobed read path
- Cost
- free tier
- Identity
- emailno card, no phone
- Binding limit
- per-ip-shapingno number: the cloud-hosted Reverse Proxy is 'shared, best-effort'; 'High-volume or sustained data transfers may be subject to bandwidth limits, rate limiting, and fair-use policies'
- Evidence
- documented3 sources; a first-party page was read and the sentence quoted
- Freshness
- stale on 2026-11-23checked 2026-10-23 (live); stale on 2026-11-23
| Free tier | 100 machines on the cloud plan unit users; metered on identity-count |
|---|---|
| Price | none stated |
| Limits |
counts of things, not rates, so no vocabulary kind names them: 100 machines plus 10 per user |
| Binding | per-ip-shaping No byte figure exists for the cloud Reverse Proxy, so 1 TiB/month is planned against a sentence rather than a number. The L4 mode accepts TCP and UDP, so the transport test passes, and the reverse proxy is free to use; what fails first is the unwritten fair-use clause, with self-hosting named by the vendor as the way the restrictions do not apply. |
| Identity | email a NetBird account |
| Egress | direct WireGuard where possible; the cloud relay otherwise, at an unpublished rate |
| Interface | cli netbird up |
| Tooling | part of the text of Interface, above |
| Composes with | signalling with a relay fallback; self-hosting removes the machine cap and adds a server to run. |
| Reliability | The cloud Reverse Proxy is beta, is shared and best-effort, and carries a named but unnumbered bandwidth and rate-limit clause; L4 services support TCP and UDP, and HTTP services do not. |
| Notes | 2026-10-23: the cloud plan has a public ingress with UDP. NetBird Reverse Proxy offers L4 'TCP', 'UDP' and 'TLS' service modes, and a UDP service is 'a UDP relay with session tracking. The proxy accepts UDP packets on the service's listen port and forwards them to your backend. Sessions are reaped after an idle timeout'. Cloud domains are free and appear 'with a Free badge'. The meter is discretionary: 'NetBird's cloud-hosted Reverse Proxy is provided on a shared, best-effort basis. High-volume or sustained data transfers may be subject to bandwidth limits, rate limiting, and fair-use policies', and 'These restrictions do not apply if you self-host NetBird'. Whether the Free plan is entitled to the feature is not stated on either the pricing page or the docs page. |
| Parsed numbers |
|
Evidence 3
| date | source | what it proved |
|---|---|---|
| 2026-10-22 | netbird.io/pricing | 100 machines on the free tier |
| 2026-10-23 | docs.netbird.io/manage/reverse-proxy | 'UDP | L4 | UDP relay with session tracking. The proxy accepts UDP packets on the service's listen port and forwards them to your backend.' |
| 2026-10-23 | docs.netbird.io/manage/reverse-proxy/service-configuration | 'Cloud-hosted usage limits: NetBird's cloud-hosted Reverse Proxy is provided on a shared, best-effort basis. High-volume or sustained data transfers may be subject to bandwidth limits, rate limiting, and fair-use policies' |
More fields 3
| stale after days | 180 |
|---|---|
| bytes transit | conditional |
| transit note | peers negotiate a direct WireGuard path; the operator's relay carries bytes only when that fails, at an unpublished rate |
NetBird Reverse Proxy
Egress and tunnels- Free allowance
- NetBird Free is 0 EUR, 'up to 5 users', '100 machines'; the pricing page lists P2P connections, Networks, SSO, access controls, Private DNS, Network Routes and NetBird SSH, and does not list Reverse Proxy on any plan.
- Verdict
- caveatusable, with a named limit or an unprobed read path
- Cost
- free tier
- Identity
- emailno card, no phone
- Binding limit
- noneno named constraint binds
- Evidence
- unverified9 sources; asserted and not checked
- Freshness
- stale on 2026-11-19checked 2026-11-04 (live); stale on 2026-11-19
| Free tier | NetBird Free is 0 EUR, 'up to 5 users', '100 machines'; the pricing page lists P2P connections, Networks, SSO, access controls, Private DNS, Network Routes and NetBird SSH, and does not list Reverse Proxy on any plan. unit users; metered on identity-count |
|---|---|
| Price | EUR 0 on Free, subject to whether the feature is included |
| Limits |
On NetBird's shared cloud proxy clusters the proxy assigns the listen port of each TCP and UDP service automatically, so the user cannot choose it. The idle timeout after which a UDP session is reaped defaults to 30 seconds. |
| Binding | none No byte quota and no rate is published, so nothing in the vocabulary fails at 1 TiB/month. Whether the feature is available on the free plan at all is the open question, and that is a plan gate rather than a limit kind. |
| Identity | email 'No credit card is required.' A NetBird account, which on Free is up to 5 users, with social SSO available. |
| Egress | none published: the pricing page charges per active user and machine and states no byte allowance; ingress: tcp+udp free allowance: none published |
| Interface | cli, rest 'The netbird expose command lets peers expose local services to the public internet through the NetBird reverse proxy' |
| Tooling | netbird CLI or the dashboard; no WireGuard client needed |
| Composes with | turns a free VM running only the NetBird agent into a host with a public TCP or UDP port on a NetBird domain, which removes the need for a tunnel broker prefix |
| Reliability | UDP sessions are reaped after an idle timeout; ephemeral expose sessions die 90 seconds after the daemon stops renewing; Rosenpass is not supported with the reverse proxy. |
| Notes | This is the only free-plan path found where a WireGuard peer gets a public TCP and UDP listener with no card and no account review, provided the feature is not gated. L4 services listen on a port on the proxy cluster and several services can share a port; custom ports depend on a cluster flag. A self-hosted deployment needs Traefik. The alternative reading, that Reverse Proxy is paid, cannot be excluded from the pages read, which is why the rung is unverified rather than documented. L4 services carry no browser SSO, only IP and country restrictions. Re-read 2026-10-23: the docs open with 'Availability: Reverse Proxy is currently in beta', and netbird expose needs an account administrator to enable Peer Expose and name allowed peer groups. |
| Evidence note | unverified The L4 TCP and UDP capability is documented in the vendor's docs. Whether the free plan includes Reverse Proxy is not: it is absent from every plan list on the pricing page. One sentence naming the plan that includes it would raise this to documented. |
| Parsed numbers |
|
Evidence 9
| date | source | what it proved |
|---|---|---|
| 2026-10-23 | docs.netbird.io/manage/reverse-proxy | HTTP and L4 modes, the UDP relay with session tracking, the public domain with automatic TLS, and the WireGuard tunnel to the peer |
| 2026-10-23 | netbird.io/pricing | Free is 0 EUR with up to 5 users and 100 machines, and Reverse Proxy appears in no plan list |
| 2026-10-23 | docs.netbird.io/manage/reverse-proxy/expose-from-cli | 'This supports both HTTP and L4 (TCP, UDP, TLS) protocols' and the ephemeral session model |
| 2026-11-03 | docs.netbird.io/manage/reverse-proxy | the shared cloud proxy clusters allocate TCP and UDP ports automatically |
| 2026-11-03 | netbird.io/pricing | the Free plan lists up to 5 users and 100 machines, and no plan list names Reverse Proxy |
| 2026-11-03 | docs.netbird.io/manage/reverse-proxy | the UDP session idle timeout is configurable per service and defaults to 30 seconds |
| 2026-11-03 | docs.netbird.io/manage/reverse-proxy | the docs page updated 2026-11-03 states that Reverse Proxy is in beta and names no plan that includes it |
| 2026-11-03 | docs.netbird.io/manage/reverse-proxy/expose-from-cli | one peer can hold at most 10 active ephemeral expose sessions |
| 2026-11-04 | netbird.io/pricing | the free plan is limited to 5 users |
More fields 6
| wg path | inside-udp |
|---|---|
| wg detail | 'Incoming traffic to that domain is received at the NetBird proxy cluster, then forwarded through an encrypted NetBird tunnel to the target peer.' The diagram is labelled 'through WireGuard tunnel', so the WireGuard datagram rides NetBird's own transport rather than a .conf a user holds. |
| ingress | tcp+udp |
| volume stated | none published: the pricing page charges per active user and machine and states no byte allowance |
| bytes transit | yes |
| transit note | NetBird's proxy cluster terminates the public side and forwards over its WireGuard mesh |
Unknown values 2
- per object cap stated: the field does not apply to this kind of offer
- retention stated: the field does not apply to this kind of offer