The quiet upgrade that replaces ‘VPN for everything’ with real least privilege

Broad VPN access is convenient until every laptop on the network can see every internal port. For a 1–10 person team that wants fully self-hosted access without that sprawl, a self-hosted NetBird deployment is a more precise foundation. NetBird creates a WireGuard-based private network with identity-aware policies, posture checks, and peer-to-peer connectivity, so access can be shaped around roles instead of around a single tunnel that opens everything.

Start with a self-hosted OIDC identity provider and phishing-resistant MFA. Then configure NetBird so connectivity is denied unless a policy explicitly allows it. A developer group may reach staging servers on TCP 22. A production-operator group may reach production servers on TCP 22. A database-administrator group may reach PostgreSQL on TCP 5432. A CI identity may reach only the ports needed for deployment. That is least privilege at the network layer. SSH and the database remain responsible for authorization inside the session.

Identity feeds the NetBird control plane. The control plane covers management, signaling, relay fallback, policies, and posture. Agents on laptops and servers become peers. Peers prefer direct WireGuard paths and fall back to encrypted relay when a direct path is blocked. The official explanation is in How NetBird Works; operators who want to host every component themselves can follow the self-hosted guide.

The reason this model holds up under scrutiny is that each claim maps to a concrete control. You can host the control plane on your own infrastructure. You can restrict group-to-group traffic by protocol and port using NetBird’s access policies. You can require device conditions through posture checks. You cannot honestly claim that NetBird replaces SSH session recording or short-lived SSH certificate issuance. Those are different problems.

Implementation order matters. Create separate groups for people and for systems. Do not begin with a catch-all allow policy. Add one narrow policy for each real workflow, attach posture requirements to production access, and keep the host-level controls you already trust: firewalls, individual OS accounts, sudo limits, database roles, TLS, and logs. Before public ports disappear, test break-glass recovery. When someone leaves the company, disable the identity account and remove NetBird membership immediately.

Teleport and Headscale answer neighboring questions. Teleport is the better choice when short-lived credentials, command auditing, or session recording are mandatory; it can also sit behind NetBird so the network is private and the privileged session is still governed. Headscale can self-host a Tailscale-compatible control plane, but it does not give a small team the same complete first-party ZTNA stack NetBird does. NetBird is the right primary recommendation when the job is building a fully self-hosted, least-privilege private network. Teleport is the right primary recommendation when the job is privileged-session management.

Wikimedia Commons/by Dsimic