Freedom251 › Business VPN Software
Nebula
What Nebula is
Nebula is a self-hosted overlay networking tool that connects hosts across IP networks through encrypted tunnels. It creates a mutually authenticated peer-to-peer layer 3 virtual network based on the Noise Protocol Framework. A TUN adapter carries TCP, UDP, and ICMP traffic, with split tunneling and a host firewall using group-based rules. Host certificates and a PKI model identify and authorize peers, while mutual validation and security groups control access. Discovery nodes help peers find routes and can use UDP hole punching through many firewalls or NATs. The default configuration uses elliptic-curve Diffie-Hellman key exchange and AES-256-GCM. Supported platforms are Linux, macOS, Windows, FreeBSD, iOS, and Android. Self-hosting requires at least one Lighthouse host for discovery and NAT traversal. Nebula is MIT-licensed open source. Managed Nebula adds certificate management, SSO, and web administration, with free, Pro, and custom Enterprise plans.
Who it suits
Nebula suits groups needing secure communication among hosts across the internet and teams comfortable operating networking infrastructure. Managed Nebula is intended for teams that prefer managed certificates, SSO, and web administration.
What it does well
- Encrypted peer-to-peer overlay networking
- Group-based host firewall rules
- UDP hole punching for many NATs
- Runs across six listed operating systems
- MIT-licensed open source
What to know first
- Self-hosting requires a Lighthouse host
- Infrastructure operation is required for self-hosted use
- Managed Enterprise pricing is custom
Plans
| Plan | Billed and limits | Price |
|---|---|---|
| Nebula (self-hosted open source) | Self-hosted overlay networking · connect any number of hosts | Free |
| Managed Nebula Free | per host · Up to 100 hosts · 2 routes for external hosts · managed lighthouse · SSO · web management interface | Free |
| Managed Nebula Pro | per host · Unlimited hosts · up to 100 routes · priority support · guaranteed uptime | $1 a month |
| Managed Nebula Enterprise | Custom pricing · Unlimited hosts · custom routes · dedicated Slack support channel · network design and setup · feature and integration requests | On request |
As github.com lists them, read 11 Oct 2026. The maker's own page has the final word.
Verdict
Nebula provides encrypted, certificate-authenticated overlay networking with routing and firewall controls. The self-hosted edition is free and open source, while Managed Nebula offers hosted administration with a free tier and paid Pro option.
Facts from Nebula's own pages
- Access model
- vpn · nebula.defined.net, 22 Sept 2026
- Admin control level
- standard · nebula.defined.net, 22 Sept 2026
- Compliance option
- Nebula can be built in Go FIPS 140-3 mode, and the project says deployments can use NIST P-256 certificates and handshakes for compliance requirements. · github.com, 11 Oct 2026
- Cryptography
- Its default configuration uses elliptic-curve Diffie-Hellman key exchange and AES-256-GCM. · nebula.defined.net, 11 Oct 2026
- Identity
- Nebula uses a PKI model and host certificates to identify and authorize peers, with mutual certificate validation and security-group firewall rules. · nebula.defined.net, 11 Oct 2026
- Integrations
- The official documentation describes SSO integration for Managed Nebula, and the pricing page lists feature and integration requests as an Enterprise offering. · defined.net, 11 Oct 2026
- Intended users
- The documentation presents Nebula as a way for groups of hosts to communicate securely across the internet, with firewall definitions similar to cloud security groups. · nebula.defined.net, 11 Oct 2026
- License
- The GitHub repository lists the MIT license. · github.com, 11 Oct 2026
- Managed alternative
- Managed Nebula adds automated certificate management, SSO integration, and a web UI for teams that do not want to run the infrastructure themselves. · nebula.defined.net, 11 Oct 2026
- Network model
- Nebula is a mutually authenticated peer-to-peer layer 3 virtual network based on the Noise Protocol Framework. · nebula.defined.net, 11 Oct 2026
- Peer discovery
- Discovery nodes help peers find routes and can use UDP hole punching to connect through many firewalls or NATs. · nebula.defined.net, 11 Oct 2026
- Platforms
- Nebula is packaged for Linux, macOS, Windows, iOS, Android, and FreeBSD, and runs on x86, ARM, MIPS, PPC, and RISC hardware. · nebula.defined.net, 11 Oct 2026
- Purpose
- Nebula is a self-hosted overlay networking tool for connecting hosts with on-demand encrypted tunnels across IP networks. · nebula.defined.net, 11 Oct 2026
- Self-hosting requirement
- An overlay network should have at least one Lighthouse host to help peers discover routes and assist with NAT traversal. · nebula.defined.net, 11 Oct 2026
- Support
- The repository security policy directs vulnerability reports to HackerOne and says the security team will investigate and respond. · github.com, 11 Oct 2026
- Supported platforms
- Linux,macOS,Windows,FreeBSD,iOS,Android · nebula.defined.net, 22 Sept 2026
- Traffic and firewall
- It supports TCP, UDP, and ICMP through a TUN adapter with split tunneling and a host firewall using group-based rules. · nebula.defined.net, 11 Oct 2026
Where Nebula stands on Freedom251
- Business VPN Software#31 of 94