Skip to main content
VPNnet

How VPNnet works

A private path to the things that matter.

Your home server. Your team’s tools. Your own internet gateway. Connect the devices you trust, then decide what they can reach.

First, the important distinction

The controller coordinates. Your devices communicate.

NetBird connects authorized peers with encrypted WireGuard tunnels. The management and signaling services help devices find each other and apply access policy. They are separate from the payload path.

Coordination, direct traffic and fallback relayA company controller exchanges identity and policy with peers. Payload traffic prefers a direct encrypted connection. A separate fallback relay forwards encrypted packets when direct connectivity is unavailable. Preferred: direct encrypted traffic Company controllerIdentity, devices and policyYour laptopNetBird peerYour serverNetBird peerFallback relayForwards encrypted packets Coordination, direct traffic and fallback relayA company controller exchanges identity and policy with peers. Payload traffic prefers a direct encrypted connection. A separate fallback relay forwards encrypted packets when direct connectivity is unavailable. Preferred: direct encrypted traffic Company controllerIdentity and policyYour laptopPeerYour serverPeerFallback relayEncrypted forwarding
Dashed gray lines: coordination. Solid green: preferred direct traffic. Dotted green: fallback encrypted relay path.

Direct when possible

Peers prefer a direct connection. Your file transfer normally travels between your devices, rather than through the company controller. Device and network connectivity still affect the route.

Relay when needed

Restrictive networks can prevent a direct path. A relay then forwards encrypted traffic between peers. It is a fallback traffic service, not the management service, even when they share a server.

VPNnet’s design gives each company a separate controller VM and control plane. A dedicated virtual instance does not mean dedicated physical hardware.
01

Home & hobbyist

Your homelab, even when you are not home.

Reach a NAS, development machine or home service from an authorized computer. You do not need to publish that application to the open internet just to use it remotely.

Remote access to a home networkA remote laptop connects through an encrypted mesh tunnel to a home routing peer, which provides authorized access to a NAS or homelab on the local network. Encrypted meshLocal LAN You, away from homeLaptop or phoneHome routing peerA device you ownNAS or homelabApproved LAN resources Remote access to a home networkA remote laptop connects through an encrypted mesh tunnel to a home routing peer, which provides authorized access to a NAS or homelab on the local network. Encrypted meshLocal LAN You, away from homeLaptop or phoneHome routing peerA device you ownNAS or homelabApproved LAN resources
A routing peer can reach permitted LAN devices without installing a VPN client on each one. The local LAN segment needs its own security controls.

Choose the path that fits

Install a peer on a supported server, or use a routing peer to reach selected LAN resources that cannot run the client themselves. The diagram shows the routing-peer option.

Keep the permissions small

Allow the devices and services you need. Network access does not replace your NAS password, application authentication, updates or home firewall.

02

Business & branches

Connect people and places, without an open door to everything.

Give employees access to the applications they need, and connect selected office or branch networks through routing peers. Policy controls which paths are allowed.

Follow the actual connections

The same 12 employee computers. Three different topologies.

Lines show permitted connections, not a measurement of active tunnels. Connections may be established on demand; direct connectivity is preferred, with encrypted relay fallback when needed. These are illustrations, not live policy changes.

1. Full mesh

12 employee computers · 66 employee-to-employee links

Every employee computer has a permitted link to each of the other eleven. All 66 unique links are drawn. No HQ gateway is included in this diagram.

1. Full meshEvery employee computer has a permitted link to each of the other eleven. All 66 unique links are drawn. No HQ gateway is included in this diagram. PC 01PC 02PC 03PC 04PC 05PC 06PC 07PC 08PC 09PC 10PC 11PC 12

Solid green: employee mesh linksDashed charcoal: explicit HQ links

Each employee: 11 other employee peers. Total enrolled peers shown: 12.

2. Point to point, back to HQ

12 employee computers + 1 HQ gateway · 12 HQ links

Each employee computer has one permitted link to the additional HQ gateway. There are no employee-to-employee links. Traffic for HQ resources follows the gateway path.

2. Point to point, back to HQEach employee computer has one permitted link to the additional HQ gateway. There are no employee-to-employee links. Traffic for HQ resources follows the gateway path. PC 01PC 02PC 03PC 04PC 05PC 06PC 07PC 08PC 09PC 10PC 11PC 12 HQ gatewayAdditional peer

Solid green: employee mesh linksDashed charcoal: explicit HQ links

Each employee: 1 HQ peer. HQ: 12 employee peers. Total enrolled peers shown: 13.

3. Multiple partial meshes

Three groups of 4 · 18 internal links + 12 HQ links · 30 total

Each four-computer group has all six internal links, for eighteen total. Every one of the twelve employee computers also has its own direct permitted link to the additional HQ gateway. There are twelve HQ links and thirty links overall. No employee-to-employee links connect different groups.

3. Multiple partial meshesEach four-computer group has all six internal links, for eighteen total. Every one of the twelve employee computers also has its own direct permitted link to the additional HQ gateway. There are twelve HQ links and thirty links overall. No employee-to-employee links connect different groups. PC 01PC 02PC 03PC 04PC 05PC 06PC 07PC 08PC 09PC 10PC 11PC 12 HQ gatewayAdditional peer

Solid green: employee mesh linksDashed charcoal: explicit HQ links

Each employee: 3 peers within its group + 1 HQ peer. HQ: 12 employee peers. Total enrolled peers shown: 13.

Services, support and AD are separate permission decisions.

Fred’s computer could reach accounting HTTPS on port 443; Bill’s could reach NMS HTTPS on port 443 and selected printing LAN resources using required printing protocols. These are more granular policy examples, not extra links silently added to the diagrams. A gateway can reach printers or an internal AD/domain controller without installing a client on each resource. AD needs appropriate DNS, routes and service ports; network access does not replace OS or application authentication.

A designated support group can have explicit permitted connections to employee computers. Such support peers may have many allowed peers. Relevant joins and policy changes are distributed through Management updates; permitted peers differ from active connections. This does not promise directory synchronization. Home full mesh remains a proposed preset, not a live enforced tier restriction.

References: NetBird access policies and allow-rule behavior.

People to applications

Use supported identity-provider sign-in and device policies to organize access. A contractor can be permitted to reach one service without being granted the rest of the network.

Sites to sites

Routing peers can connect approved LANs or cloud networks. Subnet overlaps, firewall rules and routing design still need attention; a mesh does not resolve those choices automatically.

03

Customer-owned exit gateways

Take your own route to the internet.

A suitable device on your network can act as an exit gateway. Devices assigned that exit route send configured internet traffic through it, using your internet connection and public IP.

Customer-owned exit gateway with optional filteringSelected internet traffic travels from a remote device through the mesh to a customer-owned exit gateway, then through a separately configured firewall or filter to the internet using the customer connection. Encrypted tunnelCustomer internet Remote deviceExit route selectedYour exit gatewayFirewall / DNS filter configuredInternetYour connection and public IP Customer-owned exit gateway with optional filteringSelected internet traffic travels from a remote device through the mesh to a customer-owned exit gateway, then through a separately configured firewall or filter to the internet using the customer connection. Encrypted tunnelYour internet Remote deviceExit route selectedYour exit gatewayFirewall / DNS filter configuredInternetYour connection and public IP
The gateway and filtering policy are yours. A fallback relay can still carry encrypted traffic on the way to the gateway.

Add the filtering you choose

You can pair a supported gateway with your existing firewall, DNS filtering or other security software. That software must be installed, configured and placed in the traffic path. Enabling an exit node alone does not add a content filter.

Understand the boundary

DNS filtering can block configured domains, but it does not inspect the contents of every connection. Inspecting HTTPS content needs additional proxy, certificate and endpoint setup, with privacy and compatibility implications.

Split tunnel

Private resources take the private path.

Route selected company or home networks through the mesh. Other internet traffic can keep using the device’s normal connection.

Full tunnel / exit route

Configured internet traffic takes the gateway path.

Use an exit route for the intended devices and traffic. Verify DNS, IPv4, IPv6 and failure behavior on the actual clients; do not assume every application or packet is covered.

Bandwidth still has a path and a cost. Exit traffic uses the customer’s internet connection. If the peer-to-gateway connection falls back to a hosted relay, that encrypted leg also uses hosting transfer and relay capacity.

Clear responsibilities

A platform to run. A network you control.

Self-service, with support

The intended service pairs a dedicated company control plane with guidance and support. You manage your enrolled devices, access policies, local networks and any filtering software you choose.

White-glove help is separate

Network design, migration and gateway configuration can be scoped separately. Automated company provisioning and a custom VPNnet appliance remain planned; neither is a generally available promise.

Start with your actual use case

What would you like to connect?

Tell us about your home setup, team or sites. We will discuss early-access fit and the deployment and support scope before you commit.

Request early access

Technical background: NetBird architecture, direct and relayed connectivity, and exit nodes. For a balanced architectural comparison, compare a traditional VPN with VPNnet.

For current Alpha scope and clearly marked future services, see VPNnet offerings and availability.