Set up an Overlay-VPN using a Netbird server

Overview

If you want to connect VMs in separate cloud environments, bare metal servers, kubernetes environments as well as workstations and mobile devices securely, it is sensible to use an overlay-vpn like Netbird.

Netbird uses Wireguard to create an encrypted peer-to-peer mesh network, which connects all members - restricted by configurable firewall rules.

Especially if you don’t want to rely on a cloud based solution from a solution provider, you can host an manage the required Netbird compontents yourself in a VM on pluscloudopen. To do so, you should consider a few points to achieve a high availability for you setup. This tutorial covers them.

Install the Netbird server

To install the Netbird server you should follow the Self-Hosting Quickstart Guide (5 min).

You basically need to create a small VM in pluscloudopen with one vCPU and two GB of memory (Flavor SCS-1V-2 or SCS-1V-2-5), create a security rule, which allows access to the ports 80/tcp, 443/tcp and 3478/udp and associate it to the new VM, attach a floating-IP address and create the DNS records mentioned in the quickstart guide at your trusted DNS hoster for this IP-address.

After that, you install Docker and missing software packets (like jq and curl) on the VM and after that start the install of the Netbird components. The result is a setup, which is managing all included containers by docker compose.

The above mentioned DNS records are needed in order to let the Netbird and proxy server create their own ssl certificates via Let’s Encrypt http-01 challenge.

Install Netbird external relay servers

After installing the Netbird server all of its compontents are running on our VM. Obviously one VM cannot be highly available - even though the infrastructure of pluscloudopen is designed for high availability. A crash of a single hypervisor can never be ruled out.

An outage of the just installed VM would lead to an outage of the management plane (dashboard and Netbird server) as well as the data plane (relay, STUN and signal server). In order to be able to even upgrade the Netbird server without interfering with the data plane of the overlay vpn, it is sensible to separate those components.

There are a few guides for that in the Netbird documentation: Splitting Your Self-Hosted Deployment.

First we should separate the relay component. It is completely independend from other components and authenticates with the Netbird server via a shared secret.

Thus it is an option to create several (at least two for high availability) relay servers and even distribute them over more than one availability zone (AZ) of pluscloudopen. If your Netbird server VM resides in the DE-WEST-1 AZ, you could create your relay servers in AZs DE-WEST-2 and DE-NORTH-1.

Doing that, problems that would impact a complete availability zone, would not necessarily have impact on your overlay vpn.

The installation of separate relay servers is covered in Netbirds documentation, too: Set Up External Relay Servers.

Like for the netbird server, small VMs with public IP addresses should be enough (flavors SCS-1V-1 or SCS-1V-1-10). The security group should allow access via ports 80/tcp, 443/tcp and 3478/udp.

DNS records are needed again to allow for automated creation of SSL certificates via Let’s Encrypt.

Install Netbird external signal server?

Currently the signal server can only exist as one instance and therefore not be scaled out in order to achieve a better availability. Seperating it from the Netbird server does not increase its availability either.

Generally it is possbile - like with the relay server - to seperate the signal server from the Netbird server and the procedure for that is covered in Set Up External Signal Server.

But as the availability is not increased, we do not recommend to seperate the signal server from the Netbird server, currently.

SQLite Backup/Replication

In order to be prepared for problems with the SQLite database, which is part of the Netbird server, you should execute your normal Backup routines. If you want to minimize the data loss, that can occur between two backups, you could consider a replication solution like Litestream, which replicates the SQLite database “permanently” to another location (like an S3-Bucket or just another directory on your VM). Litestreams documentation covers the Installation and e. g. the configuration of a replication into another directory in your VM or to S3 like e. g. the plusserver S3 Object Storage.

Tip

We recommend to have a look at the extensive Netbird Dokumentation, in order to learn more about use cases and scenarios for Netbird.