A few weeks ago I wrote about netbird and their reverse proxy. In the weeks since then I gave it a proper test and even more. I also installed netbird server on my own infrastructure to test it.
Even though it’s still in beta, I’m impresed, how easy you can deploy your own proxy and how easy is to make services public.
But… in current state it lack some security measures. When you open your service to the internet over orpxy the good thing is - your ip stays hidden, but services exposed to the public internet are constantly scanned by both legitimate crawlers and malicious actors.
By default you can protect your apps with PIN, password, SSO, and more, and they also added Crowdsec support. NetBird currently supports CrowdSec’s IP blocking capabilities only, which is pretty small part of what is crowdsec cappable.
tl/dr
With all that said I rather stay on tradional proxy where CrowdSec can analyze logs, provide AppSec/WAF1 protection and leverage its full remediation capabilities, where I can add more middlewars for basic auth or even protect some most valued paths with mTLS, while keep using NetBird as a tunnel between networks and/or servers.
Web application firewall ↩︎