Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteTo connect a VPS to NetBird, install the Linux client, enroll the machine with a setup key, and confirm it appears in your NetBird account. Use the VPS as a normal peer when applications run on the VPS itself. Use it as a routing peer when it must reach a private subnet or another device that cannot run NetBird. The routing design additionally needs IP forwarding, a Networks resource definition, an allow policy, and working return traffic.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What this setup gives you
NetBird combines a management service with encrypted peer connections. The management service authenticates peers, stores network state, and distributes peer public keys and configuration. After authorization, clients establish encrypted point-to-point WireGuard tunnels. The VPS receives its own NetBird identity and address, so authorized peers can reach services on that VPS without exposing those services directly to the public internet.
As an Amazon Associate I earn from qualifying purchases.
A VPS can also bridge the overlay to equipment that does not run the NetBird client. NetBird defines this role as follows: “A routing peer is a NetBird peer whose client bridges your overlay network to private networks and resources that do not run the client.” That distinction determines almost every configuration decision that follows.
Choose the correct VPS role before installing anything
| Question | Normal peer | Routing peer |
|---|---|---|
| Where does the destination run? | The service runs on the VPS, and the VPS itself runs NetBird. | The destination is on a private LAN, subnet, appliance, database network, or other resource behind the VPS. |
| Does the destination need a NetBird client? | Yes, for direct overlay access from another NetBird peer. | No. The routing peer forwards traffic on its behalf. |
| Forwarding configuration | Not required merely to reach services on the VPS. | Required for traffic to pass between the NetBird interface and the reachable private network. |
| Dashboard configuration | Enroll the peer and apply peer-to-peer policy. | Define a Network resource, assign the routing peer and resource groups, and create an allow policy. |
| NAT and return paths | Usually irrelevant to services bound to the VPS. | Masquerade is enabled by default; disabling it requires return routes for original NetBird addresses. |
| Failure impact | Only services hosted on that VPS lose overlay reachability. | Every private resource that depends on the VPS loses the routed path while it is unavailable. |
If you only need SSH, an internal web application, or an API that runs on the VPS, start with the normal-peer design. If the VPS must provide access to a private address range or a device without a NetBird client, plan for the routing-peer design from the beginning.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Prerequisites and planning checklist
- A NetBird account with permission to create a setup key and manage peers, groups, resources, and policies.
- A supported Linux VPS that you can administer over SSH with root or
sudoaccess. - For a routing peer, direct IP connectivity from the VPS to every private resource or subnet it will serve. NetBird cannot route to a network the VPS itself cannot reach.
- Outbound connectivity from the VPS. The client normally initiates its connections, so an inbound listener on the VPS is not normally required for enrollment.
- A plan for groups: one group for the source peers that should connect and one or more groups for routing peers and resources.
- The destination addresses, ranges, or domains you intend to publish through the VPS, plus the ports that should be allowed.
- Access to both firewall layers: the VPS provider’s security group or network firewall and the operating-system firewall inside the VPS.
Record whether the private network uses IPv4, IPv6, or both. IPv4 forwarding and IPv6 forwarding are separate kernel settings, and a design that uses IPv6 needs the latter enabled as well.
Step 1: Create a setup key for the headless VPS
Open the NetBird management dashboard and create a setup key intended for a headless machine. Treat the key like a credential: copy it only into the SSH session or a protected secret-management workflow, do not commit it to a repository, and revoke or replace it if it is exposed. Use a key with the narrowest practical scope and lifetime supported by your account.
Free tools Windows power users keep installed
One-click scans. No signup required.
The key is used during enrollment; it is not a replacement for your NetBird account password. Once the peer is registered, manage its groups and access through the dashboard’s policy model rather than distributing the key to other administrators.
Step 2: Install and enroll the Linux client
Connect to the VPS over SSH and run the official Linux installation command:
curl -fsSL https://pkgs.netbird.io/install.sh | shThe command installs the client package and its command-line interface. When installation finishes, enroll the machine with the setup key:
netbird up --setup-key <YOUR_SETUP_KEY>Replace <YOUR_SETUP_KEY> with the key you created. Do not include the angle brackets. Run the command in the same administrative context that will operate the client, normally with sudo available if the installer or service manager requests it.
Recommended Free Tools
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Enrollment is successful when the client authenticates and the VPS appears as a connected peer in the dashboard. If the command returns an authentication or connectivity error, keep the SSH session open and check outbound filtering before repeatedly creating new keys.
Step 3: Confirm the peer in the dashboard and on the VPS
Check the peer list immediately after enrollment. Verify the machine name, online status, assigned groups, and the NetBird address shown for the VPS. The dashboard is the authoritative place to confirm that management accepted the peer; a running local service alone does not prove that policy or routing is correct.
On the VPS, use the NetBird command-line status and diagnostic commands available in your installed client to confirm that the daemon is running and that the peer has a NetBird address. Keep the distinction between these checks clear:
- Peer enrollment: the VPS is authenticated and visible.
- Peer authorization: policy permits a particular source peer to contact a destination.
- Reachability: the operating-system and provider firewalls pass the packet.
- Application availability: the destination service is listening on the expected address and port.
A failure at one layer can look like a failure at another, so test them in that order.
Using the VPS as a normal NetBird peer
Bind services to the address clients will use
For services hosted directly on the VPS, configure the application to listen on the NetBird interface or on an address that accepts traffic from it. Then create a policy allowing the intended source group to the VPS peer and only the required service ports. A peer policy that allows no ports will leave the machine enrolled but unreachable for the application.
Keep public exposure independent from overlay access
NetBird access does not automatically change public listeners. You can leave an administrative or application port closed in the provider firewall while allowing the same service through the NetBird interface and host firewall. Conversely, enrolling the VPS does not make an insecure service safe; authentication and application-level authorization still belong in the service itself.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Using the VPS as a routing peer
Prefer Networks for ordinary private-resource access
For ordinary access to a private network, use the dashboard’s newer Networks model. Add each destination as an IP address, an IP range, or a domain, then assign the routing peer and the groups that represent the resources. Finally, create a policy that allows the intended source group to the intended resource and ports.
Legacy Routes remain mainly relevant to exit-node configurations. Do not create a legacy route simply because the VPS happens to be a gateway; first determine whether the destination is a specific private resource that belongs in a Network definition.
Assign the routing peer only where it has reachability
The selected routing peer must have a usable route to the destination through its normal VPS networking. For example, if a private database is reachable only through an interface or local gateway on the VPS, verify that path from the VPS before assigning it in NetBird. NetBird can encrypt and authorize the overlay packet, but it cannot repair an absent route, an unreachable gateway, or a destination firewall that rejects the packet.
Create a narrowly scoped policy
Use separate groups for users or source peers, routing peers, and resources where practical. A policy should identify the source group, the resource group, and the ports that are actually needed. Avoid an unrestricted source-to-resource rule when the requirement is only HTTPS to one application or a database connection from one administration group. Add additional rules deliberately when a second team or service needs access.
Enable forwarding on a routing peer
NetBird enables Linux IP forwarding automatically when it can. If it cannot, enable IPv4 forwarding manually:
sudo sysctl -w net.ipv4.ip_forward=1The command changes the running kernel setting. Persist it so a reboot does not silently disable routing:
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
sudo sh -c 'printf "net.ipv4.ip_forward=1n" > /etc/sysctl.d/99-netbird.conf'
sudo sysctl --systemThe first command writes the setting to /etc/sysctl.d/99-netbird.conf; the second reloads settings from the sysctl directories. If your routed design carries IPv6, enable and persist IPv6 forwarding as well:
sudo sysctl -w net.ipv6.conf.all.forwarding=1
sudo sh -c 'printf "net.ipv6.conf.all.forwarding=1n" >> /etc/sysctl.d/99-netbird.conf'
sudo sysctl --systemUse the IPv6 setting only when IPv6 is part of the design. Enabling forwarding does not by itself grant access; NetBird policy, host firewall rules, provider rules, and the destination’s own firewall still apply.
Configure both firewall layers
Provider security group
Review the VPS provider’s security group or network firewall first. NetBird clients normally need no inbound port opened solely for enrollment because connections begin outbound from the client. A provider policy that blocks outbound traffic can still prevent the control-plane connection or direct peer establishment.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Operating-system firewall
Next inspect the host firewall, such as the distribution’s packet-filter rules. Permit forwarding between the NetBird interface and the private interface for the resource and ports covered by your policy. Permit the application’s NetBird-side traffic for a normal peer. Avoid broad “allow all forwarding” rules when a narrow interface, source, destination, and port rule will work.
Outbound requirements
Restrictive egress rules can block UDP needed for direct peer connections or TCP port 443 needed by the NetBird control plane. If a peer remains offline or direct connections never form, check egress logs at the provider and host layers. Do not open random inbound ports as a substitute for fixing blocked outbound traffic.
Understand NAT and return routes
Masquerade is enabled by default for routed traffic. The private destination therefore sees the routing peer’s LAN-side address rather than the original NetBird source address. This usually simplifies return traffic because the destination replies to an address already known on its local network.
Turn masquerade off only when you can add return routes for the original NetBird addresses on the private network. Without those routes, replies follow the wrong gateway or disappear, producing a one-way connection that can be mistaken for a policy failure. Document the route on the private gateway, any intermediate firewall, and the destination host when host routes are required.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11| Design choice | What the destination sees | Additional requirement |
|---|---|---|
| Masquerade enabled | The routing peer’s LAN-side address. | Usually no route for individual NetBird source addresses is needed. |
| Masquerade disabled | The original NetBird source address. | Every relevant private gateway must know how to return traffic to the NetBird address space. |
Test the complete path
- From an authorized NetBird client, test the VPS’s NetBird address if the VPS hosts the service directly.
- For a routed resource, test its published IP, range member, or domain from the same authorized client.
- Test the exact application port rather than relying only on ICMP or a generic ping. A successful ping does not prove that the service port is allowed.
- Check the dashboard for the source peer, routing peer, resource assignment, and policy match.
- Inspect provider and host firewall logs on the VPS, then inspect the destination firewall and service logs.
- Use
netbird debug traceto simulate a packet against policy rules without sending real traffic. This helps distinguish a policy decision from a routing or firewall problem.
Run tests from a client that is actually in the source group named by the policy. Testing from an unassigned peer can produce a clean denial even though the rule is correct for the intended users.
Troubleshooting by symptom
| Symptom | Likely layer | Checks and corrective action |
|---|---|---|
| The VPS never appears as connected. | Enrollment or egress | Verify the setup key, client service, system clock, DNS, and outbound TCP/443 access. Check provider and host egress logs. |
| The VPS is connected, but a client cannot reach a VPS-hosted service. | Policy, listener, or host firewall | Confirm the source-to-peer policy, the service’s listening address and port, and host-firewall rules on the NetBird interface. |
| The VPS is connected, but a private subnet is unreachable. | Routing peer configuration | Confirm the resource is defined in Networks, the routing peer is assigned, the source group is allowed, and the VPS can reach the private destination through its ordinary network. |
| Packets arrive at the private host, but replies never return. | NAT or return route | Keep masquerade enabled, or add routes for the original NetBird addresses before disabling masquerade. |
| One protocol works while another fails. | Port policy or firewall | Check the policy’s port list, provider security group, host forwarding rules, and destination firewall for the failing protocol. |
| Direct connections fail while enrollment works. | UDP egress or network path | Check whether restrictive egress blocks UDP needed for direct peer connections. The control plane can remain reachable while peer traffic is filtered. |
| Access stopped after a reboot. | Persistence | Verify the NetBird service starts, forwarding settings were written to /etc/sysctl.d/99-netbird.conf, and firewall rules load at boot. |
netbird debug trace denies the simulated packet. |
Policy or group assignment | Compare the simulated source, resource, and port with the policy, then verify that the real peer and resource are members of the expected groups. |
Security and operational practices
- Protect setup keys and revoke them when they are no longer needed or may have been disclosed.
- Use groups that reflect actual teams, environments, or services instead of placing every peer in one broad access group.
- Allow only the resource ports required by the application. A routed subnet is not a reason to expose every port on every host.
- Keep the VPS operating system, NetBird client, firewall rules, and private-resource software patched under your normal maintenance process.
- Monitor the routing peer because its outage affects every resource behind it. Consider a second routing peer when the private network and availability requirements justify redundancy.
- Document the private gateway, interface, NAT choice, resource definitions, groups, and policies. This record is essential when a route or firewall rule changes.
- Separate management access from application access. NetBird encryption protects the tunnel, but it does not replace SSH hardening, service authentication, or least-privilege administration.
Managed NetBird Cloud or self-hosted control plane?
| Consideration | Managed NetBird Cloud | Self-hosted NetBird |
|---|---|---|
| Control-plane maintenance | The service operator runs management components and their upgrades. | You operate management, signal, relay, identity, TLS, upgrades, and related firewall responsibilities. |
| Public endpoint and TLS | Provided as part of the managed service. | You must provide the public endpoint, certificates, routing, and documented endpoint mappings. |
| Data-residency control | Depends on the managed service’s operating regions and terms. | You choose the hosting location and retain operational responsibility for it. |
| Operational burden | Lower for a VPS peer or routing peer because the control plane is external. | Higher: an error or outage in your control plane can affect enrollment and coordination for all peers. |
| Cost model | Uses the service’s current account and usage terms. | Adds the cost and administration of the control-plane infrastructure. |
The NetBird self-hosting guide uses an Ubuntu 22.04 machine hosted at Hetzner as its tutorial VPS example and documents required routing endpoints and port mappings. Those mappings are part of the self-hosted control-plane deployment, not a reason to open arbitrary ports on a client-only VPS. If you self-host, follow the version-matched endpoint and TLS requirements for every component and plan upgrades before putting the control plane into production.
How the design fails and how to recover
The routing peer goes offline
Resources behind that peer become unreachable even if their own systems are healthy. Restore the VPS or move the Network resource assignment to another routing peer that has equivalent private reachability. If high availability matters, prepare the second peer and its policy before an outage rather than during one.
The private network changes its gateway or address range
Update the Network resource definition, the VPS’s ordinary route, forwarding and firewall rules, and any return routes if masquerade is disabled. Test from an authorized client after each change so a stale resource entry does not remain trusted.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →A policy was made too broad
Remove the broad rule, restore narrowly scoped source and resource groups, and review logs for connections made while it was active. Group membership is part of the security boundary, so remove peers from groups they no longer need rather than relying only on local firewall state.
Version and documentation context
NetBird’s Getting Started documentation was updated August 21, 2026; its “How Routing Peers Work” documentation was updated September 28, 2026; and “How NetBird Works” was updated October 5, 2026. Dashboard labels and capabilities can change, so use the labels shown in your account when applying these steps. The architectural distinction between a directly enrolled peer and a routing peer remains the key decision: enroll the VPS in both cases, but add forwarding, resource assignment, policy, and return-path planning only when the VPS is bridging traffic to destinations that do not run NetBird.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
