I've been running Tailscale for two years across my Proxmox cluster, a couple of cloud VMs, and my laptop. It's genuinely good software — effortless peer-to-peer connectivity, solid ACLs, the Funnel feature. But the control plane lives in Tailscale's cloud, and after digging into NetBird earlier this year, I can't unsee that gap. NetBird gives you the same WireGuard-based mesh VPN experience with a self-hosted control plane you actually own. Here's how to run it on Proxmox LXC.

What NetBird Is and Why It's Different from Tailscale and Headscale

NetBird is an open-source mesh VPN platform built on WireGuard. Unlike Tailscale, both the client and the control server are fully self-hostable. Unlike Headscale (Tailscale's community control plane replacement), NetBird ships its own management server, signal server, TURN relay, and dashboard — all in one Docker Compose stack — so you're not patching together community forks.

Key differences that matter in 2026:

vs Tailscale: Tailscale's control plane is proprietary and cloud-only. You get great UX but your network topology, ACLs, and device metadata live on Tailscale's servers. NetBird self-hosted means zero external dependencies — nothing leaves your network unless you want it to.

vs Headscale: Headscale is a community reimplementation of the Tailscale coordination server. It works, but it's always playing catch-up with upstream Tailscale features and doesn't ship its own relay or signal server. NetBird is a complete, independently-developed stack.

vs raw WireGuard: NetBird handles the hard parts — key distribution, NAT traversal, peer discovery, ACLs — that you'd build yourself on top of raw WireGuard. You keep WireGuard's performance without the manual key management headache.

As of NetBird v0.72 (June 2026), the platform also ships a built-in reverse proxy, putting it directly in competition with Tailscale Funnel for exposing internal services.

Prerequisites

Step 1: Create the LXC Container

In the Proxmox shell, use the community script for a one-liner install:

bash -c "$(wget -qLO - https://github.com/community-scripts/ProxmoxVE/raw/main/ct/netbird.sh)"

The script creates an Ubuntu 22.04 LXC, installs Docker, and drops a docker-compose.yml in /opt/netbird. If you prefer manual control, create the LXC yourself — use Ubuntu 22.04, 2 vCPUs, 2GB RAM, 8GB disk.

Critical: TUN device for unprivileged containers. NetBird's WireGuard kernel module needs /dev/net/tun. In your Proxmox host shell, add this to /etc/pve/lxc/.conf:

lxc.cgroup2.devices.allow: c 10:200 rwm
lxc.mount.entry: /dev/net/tun dev/net/tun none bind,create=file

Then restart the container:

pct restart <CTID>

Verify inside the container:

ls -la /dev/net/tun
Should show: crw-rw-rw- 1 root root 10, 200 ...

Step 2: Configure the Self-Hosted Management Stack

Inside the LXC, run the NetBird setup script which generates a complete docker-compose.yml with Traefik, Let's Encrypt, the management API, signal server, and TURN relay:

cd /opt/netbird
export NETBIRD_DOMAIN="netbird.yourdomain.com"
export NETBIRD_LETSENCRYPT_EMAIL="you@yourdomain.com"
curl -fsSL https://github.com/netbirdio/netbird/releases/latest/download/setup.sh | bash

This generates a setup.env and a fully configured docker-compose.yml. Review setup.env before continuing — the defaults are production-ready but you'll want to set NETBIRD_RELAY_AUTH_SECRET to something strong.

Start the stack:

docker compose up -d

Check that all services came up:

docker compose ps
You should see: dashboard, management, signal, relay (coturn), traefik — all Up

The dashboard will be live at https://netbird.yourdomain.com. On first load, you'll create the first admin user.

Step 3: Install the NetBird Client on Each Peer

On any Linux machine (including other Proxmox LXCs or VMs):

curl -fsSL https://pkgs.netbird.io/install.sh | sh

Then connect to your self-hosted instance instead of the public one:

netbird up   --management-url https://netbird.yourdomain.com:443   --admin-url https://netbird.yourdomain.com:443

You'll get a browser link to authenticate. Log in with your dashboard credentials and the device appears in the Peers list. Repeat for every machine you want in the mesh.

On macOS or Windows, download the desktop client from netbird.io/download — in Settings, point it to your management URL before logging in. On iOS and Android, same pattern via the mobile app.

Step 4: Configure ACLs (Network Policies)

This is where NetBird beats Headscale hard. The dashboard has a full ACL editor — create groups, assign peers to groups, and write allow/deny policies between groups. Example policy to let your laptop reach only the home lab management VLAN:

{
  "rules": [
    {
      "name": "laptop-to-homelab",
      "action": "accept",
      "sources": ["group:laptops"],
      "destinations": ["group:homelab"],
      "protocol": "all"
    }
  ]
}

You can also define Routes — tell NetBird to advertise a subnet (e.g., 192.168.0.0/24) through a specific peer that acts as a router. This lets all your NetBird peers reach your home LAN without installing NetBird on every device.

To enable subnet routing, mark a peer as a router in the dashboard, then on that peer:

netbird routes add 192.168.0.0/24 --peer-id <PEER_ID>

Step 5: Verify Connectivity and DNS

NetBird registers each peer's hostname in its internal DNS resolver. Test from any connected peer:

ping proxmox.netbird.cloud   # or whatever your domain suffix is
netbird status

The netbird status output shows all peers, their IPs (from the 100.64.x.x CGNAT range by default), and latency. Direct connections show P2P, relayed ones show relayed — P2P is almost always used once NAT traversal succeeds.

For the management UI specifically, install the NetBird browser extension or access the dashboard directly from a peer on the mesh.

Performance: NetBird vs Tailscale in Practice

On my setup (Proxmox host on a Beelink GTi13 Ultra, laptop on WiFi 6, TURN relay on a $6/month Hetzner VPS), I see:

Compared to Tailscale on the same hardware: essentially identical on direct connections. Tailscale wins slightly on relay speed because their DERP relay infrastructure is globally distributed — your single self-hosted TURN is one location. If you have users across continents, run multiple TURN instances in different regions.

Hardware You'll Want on Each Node

A few products I use across this setup:

Caveats and Gotchas

Cert renewal: Traefik handles Let's Encrypt renewal automatically, but your NetBird domain needs a valid cert or mobile clients will reject the management API. Make sure port 443 is reachable from the internet, or use Cloudflare DNS challenge instead of HTTP challenge.

Upgrades: docker compose pull && docker compose up -d in /opt/netbird. NetBird releases fairly frequently (v0.72 in June 2026) — subscribe to their GitHub releases to stay current.

Backup: The only stateful piece is the management database at /var/lib/docker/volumes/netbird_management_data. Back it up with your regular Proxmox backup job or a cron that copies it to your NAS.

Mobile clients and custom management URL: If you're setting up the iOS or Android app, enter the management URL before logging in — there's a gear icon on the login screen. Easy to miss.

Self-signed certs won't work for mobile: The iOS and Android NetBird clients validate TLS strictly. Use a real domain with Let's Encrypt or Cloudflare-proxied certs.

Should You Switch from Tailscale or Headscale?

If you're already on Headscale, the migration case for NetBird is strong — you get a native dashboard, proper TURN relay, and ACL management that doesn't require editing a config file. The operational overhead is similar.

If you're on Tailscale and have a larger setup (multiple users, SSO, audit logs), Tailscale's polish is still ahead. NetBird's dashboard is good but Tailscale's UX remains the gold standard. That said, for a solo home lab operator who just wants their machines connected without cloud dependency, NetBird self-hosted is the better long-term choice.

The real win is data sovereignty — your network topology, ACLs, and device keys never leave your infrastructure. For anything touching internal infrastructure or client work, that's worth the extra ten minutes of setup.

---

Disclosure: This post contains affiliate links. If you purchase through these links, I may earn a small commission at no extra cost to you.