📡 Zero Trust VPN Setup – Access Your Home Network with NetBird

In this guide, we’ll set up NetBird so your phone, tablet, or laptop can securely connect to your Home Lab, Server, or ZimaOS NAS and access devices on your LAN. 🔒

1️⃣ Create a Setup Key

Log in to the NetBird Cloud Dashboard.

➡️ Go to Peers ➝ Setup Keys ➝ New Key

➡️ Name it: Netbird-Client-SetupKey-Change-Me

➡️ Set Reusable = Yes (valid 7 days)

Copy UUID ➝ Netbird-Client-SetupKeyUUID-Change-Me

2️⃣ Deploy NetBird Client in Portainer

Open Portainer → Stacks → Add stack and paste this YAML:

Give the container a name: netbird (all lowercase)

version: '3.8'
services:
  netbird-client:
    image: netbirdio/netbird:latest
    container_name: netbird-client
    restart: unless-stopped
    environment:
      - NB_SETUP_KEY=Netbird-Client-SetupKeyUUID-Change-Me
    volumes:
      - /DATA/AppData/netbird-client:/etc/netbird
    network_mode: "host"

Replace placeholders:

NB_SETUP_KEY → your setup key UUID from step 1
/DATA/AppData/netbird-client → persistent folder on your server

Click Deploy the stack. Check the logs → you should see: peer has been successfully registered ✅

3️⃣ Add a LAN Route

➡️ NetBird dashboard → Network Routes ➝ Add Route

➡️ Route: 192.168.1.0/24 (replace with your LAN subnet)

➡️ Assign to group: All

➡️ Enable Route Masquerade

➡️ Name: home-network → Add Route

4️⃣ Enable Exit Node

Go to Peers ➝ Select your server
Click Set up Exit Node
Assign to group: All
Enable Route and confirm

5️⃣ Install NetBird on Your Devices

Download and install the NetBird client:

⚠️ First-time setup requires being on the same LAN as your server (zero trust authorization step).

6️⃣ Authorize and Test

➡️ Open the NetBird app → Connect → Approve device in the dashboard → It will appear under Peers.

➡️ Now disconnect Wi-Fi and switch to LTE/5G.

➡️ Reconnect with NetBird → You should still reach your server, NAS, Nextcloud, or cameras as if you were local. 🎉

✨ You’re Done!

You now have a secure Zero Trust VPN powered by NetBird. Every device must be explicitly authorized, keeping AI-driven brute force bots and stolen credentials useless.

Access your files, dashboards, and apps (Nextcloud, Jellyfin, security cameras, etc.) remotely and securely. 🔒