Managed NetBird VPN for Businesses

For companies that need to connect employees, sites, cloud resources or customer systems through a centrally managed VPN platform. WZ-IT designs the architecture, integrates identities and access policies and can take over ongoing operations.

NetBird establishes encrypted WireGuard connections between authorised devices. Connections run directly where possible and otherwise through a relay service; central policies govern access. The guide What is NetBird? explains the technical foundations.

We operate the agreed NetBird infrastructure including control plane and relays, monitor it around the clock and handle updates, backups and incidents according to the selected service level. Approvals for identities, devices and policies remain your responsibility unless explicitly delegated to us.

No. You get your own fully isolated NetBird instance - hosted on dedicated resources. No shared databases, no shared logs, no neighbors. Your data, your rules, your infrastructure.

No. This is B2B infrastructure: Identity/SSO, policies, rollout, site-to-site/routes, operations/monitoring - for enterprise networks, not consumer privacy VPN.

Remote work & home office, site-to-site connectivity, hybrid cloud (AWS/Azure/GCP + on-prem), partner/contractor access with granular rules, admin access to servers/DB/backoffice without VPN gateway sprawl.

By default at an agreed location in Germany. Other regions or on-premises operation are possible depending on requirements; providers, certifications and data flows are identified in the proposal.

The solution can be designed around privacy requirements and operated under a DPA. Whether the specific use complies with the GDPR also depends on location, identity provider, clients, logging, administration and actual data flows.

Yes - standard for B2B and included by default. This is often a decisive point in the procurement process.

No. With WireGuard-based setups, traffic remains end-to-end encrypted. Private keys stay on devices. Even relay servers can only forward traffic, not decrypt it.

NetBird can integrate with common identity providers such as Entra ID, Okta, Google Workspace, Keycloak or Authentik. We assess the specific OIDC or SAML path, MFA, group mapping and offboarding before implementation. If no IdP exists yet, we can include a suitable identity solution in the architecture.

Yes. For self-hosting, NetBird currently includes SCIM in its Commercial Starter offering together with device approval and high-availability capabilities. This tier covers up to 50 users and 500 devices. For larger or different requirements we assess the Enterprise licence. WZ-IT supports selection, procurement and technical integration; vendor licences are shown separately.

Policies control who can access which resources (principle: least privilege). This is the difference between "VPN on/off" and real access control - essential for B2B compliance and security.

With IdP Sync, permissions are automatically revoked as soon as the account is deactivated in the identity provider. No manual cleanup needed - important for offboarding compliance.

No. NetBird uses NAT traversal and UDP hole punching - works behind most firewalls and NATs without port forwarding. In rare cases (e.g., carrier-grade NAT), the relay automatically kicks in.

No! Most traffic runs peer-to-peer (P2P), directly between devices - encrypted with WireGuard. Only signaling (connection setup) goes through our servers. The relay is only used when direct P2P traffic isn't possible.

Yes. With NetBird you can route entire subnets - ideal for connecting offices, datacenters, or cloud VPCs. A router peer forwards traffic to the local network.

Windows, macOS, Linux, iOS, Android - plus Docker and Kubernetes. The clients are open source and easy to deploy (MSI, PKG, APT, etc.).

Yes - hybrid is a standard scenario. Routing peers in the cloud and on-prem enable seamless connections between all environments (admin access, internal services, private subnets).

Peer-to-peer connections avoid the detour through a central gateway. A relay takes over when no direct path is available. Actual performance depends on endpoints, internet connections, firewalls, NAT and routing and is considered in the target design.

NetBird uses WireGuard for encrypted connections and adds central management, identity integration, policies, routing and relay fallback. Whether NetBird, OpenVPN or IPsec is the better fit depends on existing networks, endpoints, compliance requirements and the desired operating model.

Our offering combines a dedicated NetBird instance with architecture, identity integration, network planning and ongoing operations. WZ-IT does not automatically bill the managed service per user or device; required vendor licences and technical sizing are considered separately. Detailed product comparisons are available in the VPN hub.

Yes, absolutely. NetBird can run alongside your existing VPN. You can migrate gradually - first individual teams or use cases, then the rest. No big-bang switch required.

Not quite. Zero Trust is a security concept (identity, policies, least privilege). A mesh VPN can be part of it - but doesn't replace IAM or endpoint security. NetBird combines both: mesh architecture with zero-trust policies.

Often just a few days - depending on SSO integration, routing/site-to-site requirements, and internal approvals. A pilot with 10-20 users is usually live in 1-2 days.

Yes - we plan the rollout so IT doesn't have to manually touch each device. Deployment via MDM, install scripts, or manual as needed.

Typical risks include unclear groups and policies, subnet routing without reliable network documentation, restrictive firewalls without a relay concept and missing offboarding processes. We assess these points before the pilot and rollout.

Yes. The agreed components are monitored around the clock. Whether WZ-IT only forwards an alert or responds directly depends on the selected operating model and service level.

Regular and predictable - including maintenance window logic when required. Critical security patches are applied promptly.

Yes. You work with our technical team. The ticket system is the binding reporting channel for support and incidents; for agreed critical incidents we also contact you by phone.

WZ-IT does not apply an automatic per-user or per-device fee to the managed service. For Community Edition deployments, we size infrastructure and operating scope according to devices, sites, routes and relay traffic. Commercial NetBird licences may contain their own contractual limits; Commercial Starter currently covers up to 50 users and 500 devices.

The 20 TB refer to included monthly outbound relay traffic. Direct peer-to-peer connections do not pass through the relay. If more relay traffic is required on a sustained basis, we adjust infrastructure and scope in a controlled manner.

Term and notice period are defined in the proposal. Architecture, configuration and handover are documented so that a provider change remains technically manageable.

Our price is based on architecture, infrastructure, operating scope and service level rather than automatically on every individual user. If Commercial Starter or Enterprise is required, we show the vendor licence separately and transparently.

With a prepared domain and clarified identity integration, a technical pilot can be built quickly. The production rollout schedule depends on policies, routing, endpoint deployment, approvals and, where applicable, the vendor licence.

Community Edition covers the core capabilities for peers, policies, routing and self-hosting. Commercial Starter adds capabilities including high availability, SCIM, device approval and email support for up to 50 users and 500 devices. Enterprise is intended for larger or more individual requirements. We assess edition and licence before implementation.

Yes. In a short call we show you the setup, clarify your requirements and put together a fitting offer - non-binding and with no credit card.

Yes. WZ-IT is an official NetBird reseller. We first establish the required capabilities and only supply Commercial Starter or Enterprise where the architecture calls for that edition. Vendor licence, infrastructure and WZ-IT operations are clearly separated in the proposal.

We need an approximate number of users and devices, the existing identity provider, sites and private networks, required site-to-site or subnet routes, and requirements for hosting, availability and response times.