Operations & updates
Updates, security patches and documented maintenance of the agreed control-plane and relay components.
Backup & recovery
Regular backup of the agreed configuration and data. Retention and restore tests are defined in the operating scope.
Managed NetBird VPN for Businesses
A dedicated NetBird instance with SSO, policies, routing, monitoring and operations. No automatic WZ-IT billing per user or device.
- from €349.90 excl. VAT / month
- Dedicated instance
- 24/7 technical monitoring
- No automatic WZ-IT per-seat billing
Managed NetBird
A dedicated VPN platform for your business
You receive your own NetBird instance. WZ-IT designs the control plane, relays, identity integration, policies and routing as one coherent architecture and operates the agreed scope.
Central management of peers, groups, policies and routes
Integration with existing identity and network structures
Documented operations with monitoring, updates and backups
Securely connect sites, Kubernetes and private services
Site connectivity
Connect offices, branches, plants and private subnets through controlled network routes and routing peers.Kubernetes & private services
Give authorised users access to cluster APIs, internal applications and management endpoints. NetBird complements access; it does not replace the CNI or network policies.Administrator & contractor access
Implement time- and scope-limited access to servers, databases, Proxmox, back-office tools or customer systems.Hybrid cloud & on-premises
Connect Hetzner, AWS, Azure, private cloud and local networks through one documented access path.
Operating scope
What WZ-IT Managed NetBird includes
The specific setup depends on your network, sites, licence and service level. These building blocks form the typical scope.
Identity & policies
Integration with Entra ID, Okta, Google Workspace, Keycloak, Authentik or another suitable identity architecture.
Relay & traffic
5 TB of outbound relay traffic per month is included. Direct peer-to-peer traffic does not pass through the relay.
Capacity sized to requirements
No artificial WZ-IT limit per user or device. We size infrastructure and operating scope according to actual use.
Flexible hosting location
By default we design privacy-focused hosting in Germany. Other regions or on-premises operation are possible after technical and contractual assessment.
Migration & rollout
From Tailscale, OpenVPN or IPsec to NetBird
We plan parallel operation, client rollout, policies and routing so the transition can be controlled.
- 01
Parallel operation
The existing VPN and NetBird can run in parallel during the pilot and transition.
- 02
Client rollout
Deployment through existing MDM, installation packages or coordinated scripts.
- 03
Policies & routing
Access policies, network routes, DNS and relay fallback are verified before cutover.
Managed NetBird base package
NetBird platform and ongoing operations from one team
WZ-IT sizes the standard environment, operates the control plane and agreed relays, and handles monitoring, updates, backups and technical support. Essential is included; Business, Priority, Production and Critical can be added according to criticality.
Managed NetBird€349.90from, excluding VAT per month
Included
- Essential service level included
- No automatic WZ-IT per-seat billing
- Monitoring, updates & backups
- 5 TB relay traffic included
Straightforward provisioning within a few business days
Payment
- Bank transfer
Setup and onboarding depend on identity integration, networks and migration scope and are itemised separately in advance. Required NetBird vendor licences are not included in the base price. All prices are net and exclude statutory VAT. The offers are addressed to businesses.
Other routes
Clearly defined migrationReplace an existing VPN with tested parallel operation
WZ-IT builds the new secure-access path, migrates a pilot group and documents testing, rollback and the wider rollout.
View migration sprint →Assess firstReview access and define the target model
Inventory of all access paths, target model and migration path as a decision paper. Credited against the replacement.
View service →Editions & licensing
A NetBird licence matched to the target architecture
Community Edition, Commercial Starter and Enterprise differ in capabilities and vendor terms. We determine the required edition from high availability, identity, device count, approval processes and support needs. As an official NetBird Reseller Partner, we supply Commercial Starter or Enterprise directly where required.
Community Edition
- Self-hosted control plane
- SSO and access policies
- No vendor licence required
For self-hosted core capabilities such as peers, policies and routing. No automatic WZ-IT billing per user or device; infrastructure and operations are sized to fit.
Commercial Starter
- High availability
- SCIM provisioning
- Device approval
- Licence through WZ-IT
The current self-hosted entry tier for additional production capabilities. The separate vendor licence can be purchased directly through WZ-IT and is intended for up to 50 users and 500 devices.
Enterprise
- Individual requirements
- Vendor coordination
- Licence directly through WZ-IT
For larger or individual environments with extended integration, contractual or support requirements. As an official Reseller Partner, we clarify and supply the appropriate vendor scope for the project.
Vendor licence, infrastructure and WZ-IT services are itemised separately and traceably in the quote.
Service levels
Five service levels for different operating requirements
Response target = initial technical response to critical incidents (P1) · Price and flexible operations allowance per customer environment and month
Essential
Next business dayby end of dayInitial technical response to critical incidents (P1) by the end of the next business day
includedin the base operations price
no allowanceFor less time-critical systems, staging and internal applications.
Business
Popular4 hwithin service hoursInitial technical response to critical incidents (P1) within 4 service hours
+€99.90
0.5 h allowanceFor production systems without contractual night and weekend on-call coverage.
Priority
1 hwithin service hoursInitial technical response to critical incidents (P1) within 1 service hour
+€199.90
1 h allowanceFor business-critical systems requiring a fast response during the service window.
Production
60 minnights and weekends includedInitial technical response to critical incidents (P1) within 60 minutes, 24/7
+€349.90
1 h allowance24/7 P1 on-call coverage for business-critical production environments.
Critical
after audit30 minnights and weekends includedInitial technical response to critical incidents (P1) within 30 minutes, 24/7
+€549.90
2 h allowanceAvailable after audit, runbook and capacity approval.
Business, Priority, Production and Critical include the first covered workload in a customer environment. Further covered workloads cost €29.90, €39.90, €49.90 and €59.90 per month respectively. For monitoring-only servers, we notify within the level's window for €14.90, €19.90, €24.90 and €29.90 per server and month respectively; without a service level, during service hours.
The flexible operations allowance applies to planned work during regular service hours and expires at month end. Operations, monitoring, backups, maintenance and updates within the agreed scope do not reduce it. Additional and incident work costs €120 net per hour during regular service hours and €240 net per hour outside them. All prices are net and exclude statutory VAT. The offers are addressed to businesses.
SLA & Service Levels →Frequently Asked Questions
General
- For companies that need to connect employees, sites, cloud resources or customer systems through a centrally managed VPN platform. WZ-IT designs the architecture, integrates identities and access policies and can take over ongoing operations.
- NetBird establishes encrypted WireGuard connections between authorised devices. Connections run directly where possible and otherwise through a relay service; central policies govern access. The guide What is NetBird? explains the technical foundations.
- We operate the agreed NetBird infrastructure including control plane and relays, monitor it around the clock and handle updates, backups and incidents according to the selected service level. Approvals for identities, devices and policies remain your responsibility unless explicitly delegated to us.
- No. You get your own fully isolated NetBird instance - hosted on dedicated resources. No shared databases, no shared logs, no neighbors. Your data, your rules, your infrastructure.
- No. This is B2B infrastructure: Identity/SSO, policies, rollout, site-to-site/routes, operations/monitoring - for enterprise networks, not consumer privacy VPN.
- Remote work & home office, site-to-site connectivity, hybrid cloud (AWS/Azure/GCP + on-prem), partner/contractor access with granular rules, admin access to servers/DB/backoffice without VPN gateway sprawl.
Pricing & Contract
- WZ-IT does not apply an automatic per-user or per-device fee to the managed service. For Community Edition deployments, we size infrastructure and operating scope according to devices, sites, routes and relay traffic. Commercial NetBird licences may contain their own contractual limits; Commercial Starter currently covers up to 50 users and 500 devices.
- The 5 TB refer to included monthly outbound relay traffic. Direct peer-to-peer connections do not pass through the relay. If more relay traffic is required on a sustained basis, we adjust infrastructure and scope in a controlled manner.
- Term and notice period are defined in the proposal. Architecture, configuration and handover are documented so that a provider change remains technically manageable.
- Our price is based on architecture, infrastructure, operating scope and service level rather than automatically on every individual user. If Commercial Starter or Enterprise is required, we show the vendor licence separately and transparently.
- Yes. In a short call we show you the setup, clarify your requirements and put together a fitting offer - non-binding and with no credit card.
- We need an approximate number of users and devices, the existing identity provider, sites and private networks, required site-to-site or subnet routes, and requirements for hosting, availability and response times.
Operations & Privacy
- By default at an agreed location in Germany. Other regions or on-premises operation are possible depending on requirements; providers, certifications and data flows are identified in the proposal.
- The solution can be designed around privacy requirements and operated under a DPA. Whether the specific use complies with the GDPR also depends on location, identity provider, clients, logging, administration and actual data flows.
- Yes - standard for B2B and included by default. This is often a decisive point in the procurement process.
- No. With WireGuard-based setups, traffic remains end-to-end encrypted. Private keys stay on devices. Even relay servers can only forward traffic, not decrypt it.
- Yes. The agreed components are monitored around the clock. Whether WZ-IT only forwards an alert or responds directly depends on the selected operating model and service level.
- Regular and predictable - including maintenance window logic when required. Critical security patches are applied promptly.
- Yes. You work with our technical team. The ticket system is the binding reporting channel for support and incidents; for agreed critical incidents we also contact you by phone.
SSO & Identity
- NetBird can integrate with common identity providers such as Entra ID, Okta, Google Workspace, Keycloak or Authentik. We assess the specific OIDC or SAML path, MFA, group mapping and offboarding before implementation. If no IdP exists yet, we can include a suitable identity solution in the architecture.
- Yes. For self-hosting, NetBird currently includes SCIM in its Commercial Starter offering together with device approval and high-availability capabilities. This tier covers up to 50 users and 500 devices. For larger or different requirements we assess the Enterprise licence. WZ-IT supports selection, procurement and technical integration; vendor licences are shown separately.
- Policies control who can access which resources (principle: least privilege). This is the difference between "VPN on/off" and real access control - essential for B2B compliance and security.
- With IdP Sync, permissions are automatically revoked as soon as the account is deactivated in the identity provider. No manual cleanup needed - important for offboarding compliance.
Technology
- No. NetBird uses NAT traversal and UDP hole punching - works behind most firewalls and NATs without port forwarding. In rare cases (e.g., carrier-grade NAT), the relay automatically kicks in.
- No! Most traffic runs peer-to-peer (P2P), directly between devices - encrypted with WireGuard. Only signaling (connection setup) goes through our servers. The relay is only used when direct P2P traffic isn't possible.
- Yes. With NetBird you can route entire subnets - ideal for connecting offices, datacenters, or cloud VPCs. A router peer forwards traffic to the local network.
- Windows, macOS, Linux, iOS, Android - plus Docker and Kubernetes. The clients are open source and easy to deploy (MSI, PKG, APT, etc.).
- Yes - hybrid is a standard scenario. Routing peers in the cloud and on-prem enable seamless connections between all environments (admin access, internal services, private subnets).
- Peer-to-peer connections avoid the detour through a central gateway. A relay takes over when no direct path is available. Actual performance depends on endpoints, internet connections, firewalls, NAT and routing and is considered in the target design.
Migration & Rollout
- Often just a few days - depending on SSO integration, routing/site-to-site requirements, and internal approvals. A pilot with 10-20 users is usually live in 1-2 days.
- Yes. Since client version 0.73, NetBird takes settings from the MDM and locks them on the device. We deploy the client via Intune, Jamf Pro, Kandji, Group Policy or your existing MDM, define a baseline policy with a fixed management URL and locked profiles, and roll out in waves. Linux devices are connected via configuration management, because NetBird has no MDM channel there.
- The client is installed via Intune as a Win32 app or MSI, and settings are written to the registry under HKLM\Software\Policies\NetBird via NetBird's ADMX template or OMA-URI; for Macs, Intune distributes a configuration profile. Each user signs in once via SSO. NetBird can also tie access to the Intune compliance status so that only compliant Windows and macOS devices join the network; this requires the Business plan in NetBird Cloud or an Enterprise licence when self-hosting. Note: a policy pins the configuration but does not force a permanently active tunnel.
- Typical risks include unclear groups and policies, subnet routing without reliable network documentation, restrictive firewalls without a relay concept and missing offboarding processes. We assess these points before the pilot and rollout.
- With a prepared domain and clarified identity integration, a technical pilot can be built quickly. The production rollout schedule depends on policies, routing, endpoint deployment, approvals and, where applicable, the vendor licence.
Comparison & Editions
- NetBird uses WireGuard for encrypted connections and adds central management, identity integration, policies, routing and relay fallback. Whether NetBird, OpenVPN or IPsec is the better fit depends on existing networks, endpoints, compliance requirements and the desired operating model.
- Our offering combines a dedicated NetBird instance with architecture, identity integration, network planning and ongoing operations. WZ-IT does not automatically bill the managed service per user or device; required vendor licences and technical sizing are considered separately. Detailed product comparisons are available in the VPN hub.
- Yes, absolutely. NetBird can run alongside your existing VPN. You can migrate gradually - first individual teams or use cases, then the rest. No big-bang switch required.
- Not quite. Zero Trust is a security concept (identity, policies, least privilege). A mesh VPN can be part of it - but doesn't replace IAM or endpoint security. NetBird combines both: mesh architecture with zero-trust policies.
- Community Edition covers the core capabilities for peers, policies, routing and self-hosting. Commercial Starter adds capabilities including high availability, SCIM, device approval and email support for up to 50 users and 500 devices. Enterprise is intended for larger or more individual requirements. We assess edition and licence before implementation.
- Yes. WZ-IT is an official NetBird Reseller Partner. We first establish the required capabilities and only supply Commercial Starter or Enterprise where the architecture calls for that edition. Vendor licence, infrastructure and WZ-IT operations are clearly separated in the proposal.
Comparisons & assessment
NetBird compared with other VPN solutions
Architecture, self-hosting, licensing and operations differ by solution.
Read comparison
Reviews & projects
Client feedback on networking and secure access
From the NetBird setup with Kubernetes cluster connectivity to site networking in production.
Networking & Provisioning
WZ-IT moved our studio infrastructure from decentralised individual devices to a central platform: every site is securely connected via VPN, new devices are onboarded automatically and an entire site is provisioned from a template, without manual steps on location. What impressed me most is the breadth and depth of their knowledge: Timo and Robin are not a typical IT provider who sets up a server and leaves. The two of them think their way into highly complex infrastructure and software topics, work through every requirement we put in front of them, and build networking, provisioning and operations so that everything fits together in the end. WZ-IT is an excellent partner for complex software, network and architecture projects.
Steve KirchnerManaging Director, nextGYM GmbH
International
Built in Germany's Ruhr Valley. Running worldwide.
WZ-IT designs, develops and operates infrastructure and software for clients in Germany and internationally. We deliver projects remotely and continue supporting them in ongoing operations after go-live.
Selected projects
- LiveRemote access platform for distributed water treatment plantsABCO Water Systems · Australia · Secure Access & OT
- 81%AWS migration with substantially lower operating costsEVA Real Estate · UAE · Cloud exit & infrastructure
- 98%Provision new sites in minutes instead of hoursnextGYM GmbH · Germany · Automation & IoT
Read client reviews
Managed NetBird
Scope a managed NetBird deployment
Name users, devices, networks, and the required operational scope. We assess the architecture and required edition.
- Straight with Timo and Robin - no sales team, no pitch
- A professional assessment of your situation
- Concrete next steps for infrastructure, software or AI
The conversation is free and non-binding.
WZ-IT's advice on our Azure migration was technically sound and completely non-binding right from the intro call - we took away a great deal.
Jakob ÖschlbergerInno7 GmbH
WZ-IT's advice on our Azure migration was technically sound and completely non-binding right from the intro call - we took away a great deal.