Mesh VPN

$ project –show mesh-vpn

NetBird Mesh VPN

A private overlay network for connecting homelab infrastructure, remote systems, and trusted clients without exposing management services to the public internet. NetBird handles coordination and policy while WireGuard provides encrypted peer-to-peer tunnels.

netbird wireguard zero-trust automation

01.What it does

Automated enrollment

Requirement checks and repeatable installers prepare each host, install the client, and join it to the correct network group.

Encrypted connectivity

WireGuard tunnels connect peers directly whenever possible, keeping management traffic private and reducing unnecessary hops.

Policy-based access

Groups and access rules limit which users, devices, and services can communicate across the mesh.

Remote recovery path

Trusted administrative clients retain a secure route to homelab systems for maintenance and troubleshooting away from home.

02.Deployment flow

Validate the operating system, privileges, networking, and required packages.
Install the NetBird client using the appropriate platform workflow.
Enroll the peer with its assigned setup key and management endpoint.
Apply groups, routes, DNS settings, and least-privilege access policies.
Verify peer health, tunnel connectivity, and access to approved services.

03.Network model

$ mesh-vpn --topology

                         NetBird control plane
                                  |
                 identity · policy · peer discovery
                                  |
            +---------------------+---------------------+
            |                     |                     |
      homelab nodes       remote systems       admin clients
      Proxmox / Linux       servers / services      Windows / Linux
            \________________ WireGuard mesh ________________/

04.Target environments

  • Proxmox hosts, virtual machines, and Linux containers
  • Linux servers and self-hosted application nodes
  • Windows workstations and trusted administrative clients
  • Remote systems that need private access to approved homelab services

05.Operational priorities

Private by default

Administrative services stay off the public internet and are reached through authenticated peers.

Repeatable setup

Installer and validation workflows reduce configuration drift between nodes and client platforms.

Least privilege

Network access is segmented by peer role instead of granting every connected device unrestricted reachability.

Recoverable operations

Health checks and a known remote path make it easier to diagnose routing, DNS, and enrollment failures.

06.Status

Active homelab project. The mesh is used for remote administration and private service access while the installer and validation workflows continue to be refined.

← back to projects