Sold by: Lynxroute
Deployed on AWS
Free Trial
This product has charges associated with it for hardening, security configuration, and support.
NetBird is an open-source overlay network that connects your machines into a private WireGuard mesh. Peers build encrypted point-to-point tunnels wherever the network allows and fall back to a relay when it does not, so laptops, servers, containers and cloud VMs reach each other by a stable private address regardless of NAT or firewalls, with access governed centrally by groups and policies. This Lynxroute build runs the complete control plane on one instance - management, signal, relay, STUN and an embedded identity provider - so there is no external identity provider to register, no SaaS account, and no separate coturn container to operate. The administrator credential is generated at first boot, the dashboard and API sit behind an nginx TLS perimeter, and the certificate is issued for the instance address so peers can validate it immediately. On CIS Level 1 hardened Ubuntu 24.04 LTS.
Overview
This is a repackaged software product wherein additional charges apply for hardening, security configuration, and support.
WHAT IS NETBIRD
NetBird is an open-source overlay network that connects your machines into a private WireGuard mesh. Peers discover each other and build encrypted point-to-point tunnels wherever the network allows it, falling back to a relay when it does not, so laptops, servers, containers and cloud VMs reach each other by a stable private address regardless of NAT, firewalls or which network they are on. Access is governed centrally by groups and policies rather than by per-host firewall rules.
This image runs the complete NetBird control plane on a single instance: the management service, the signal service, the relay, a STUN server and an EMBEDDED identity provider, all from one upstream binary. There is no external identity provider to register, no SaaS account, and no separate coturn container to operate. The server components are AGPL-3.0 and fully auditable; the corresponding source is offered in writing inside the image.
WHY SELF-HOST
Running the control plane yourself means the map of your network - every machine, user, group and access policy - stays inside your own account. Peer traffic is end-to-end encrypted by WireGuard and never traverses a third party. Self-hosting suits teams with data residency requirements, organisations under GDPR, HIPAA or ISO 27001, and anyone who would rather not price a VPN per user per month.
WHAT THIS AMI ADDS
Complete control plane, no external dependencies:
- Embedded identity provider - create the first administrator and invite users directly, with no third-party IdP to configure
- Management, signal, relay and STUN all served from this instance, multiplexed behind one TLS port
- Peers, groups and policies in a local SQLite datastore on the persistent volume; PostgreSQL and MySQL supported for larger deployments
Security hardening:
- nginx TLS perimeter - dashboard, REST API, gRPC and relay all reached through port 443; the container ports stay bound to the instance
- No baked administrator password - the credential is generated at first boot into /root/netbird-credentials.txt (mode 600) and stored as a bcrypt hash
- The TLS certificate is issued at first boot for this instance's address, so peers can validate it immediately; certbot is pre-installed to swap in a CA-signed certificate
- Anonymous telemetry disabled by default
- UFW firewall pre-configured (only ports 22, 80, 443 and UDP 3478 open)
- CVE scan - every image is scanned for vulnerabilities before release
OS hardening (CIS Level 1):
- CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown
- auditd, fail2ban, AppArmor, SSH key-only, kernel hardening, IMDSv2 enforced
Compliance artifacts:
- SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json
- CIS Conformance Report at /etc/lynxroute/cis-report.html
- CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md
- Licences and written source offer at /usr/share/doc/lynxroute/LICENSES.txt
Highlights
- The whole control plane on one instance: management, signal, relay, STUN and an embedded identity provider from a single binary - no external identity provider to register, no SaaS account, and no separate coturn container to operate. Peers, groups and access policies stay in a local datastore inside your own account.
- CIS Level 1 hardened Ubuntu 24.04 LTS: auditd, fail2ban, AppArmor, SSH key-only, IMDSv2 enforced. CVE-scanned before every release. SBOM (CycloneDX) and CIS Conformance Report included.
- Secure defaults: the administrator credential is generated at first boot and stored as a bcrypt hash, the TLS certificate is issued for the instance address so peers can validate it immediately, anonymous telemetry is off, and the dashboard, API, gRPC and relay are all reached through one nginx TLS perimeter.
Details
Sold by
Categories
Delivery method
Delivery option
64-bit (x86) Amazon Machine Image (AMI)
Latest version
Operating system
Ubuntu 24.04
Deployed on AWS
New
Introducing multi-product solutions
You can now purchase comprehensive solutions tailored to use cases and industries.
Features and programs
Financing for AWS Marketplace purchases
AWS Marketplace now accepts line of credit payments through the PNC Vendor Finance program. This program is available to select AWS customers in the US, excluding NV, NC, ND, TN, & VT.
Pricing
Free trial
Try this product free for 5 days according to the free trial terms set by the vendor. Usage-based pricing is in effect for usage beyond the free trial terms. Your free trial gets automatically converted to a paid subscription when the trial ends, but may be canceled any time before that.
Pricing is based on actual usage, with charges varying according to how much you consume. Subscriptions have no end date and may be canceled any time.
Additional AWS infrastructure costs may apply. Use the AWS Pricing Calculator to estimate your infrastructure costs.
Dimension | Cost/hour |
|---|---|
t3.medium Recommended | $0.05 |
t3.large | $0.05 |
t3.small | $0.03 |
m6i.large | $0.05 |
Dimensions summary
You pay by the hour based on the EC2 instance size you run this self-hosted mesh VPN software on. Four instance options are available: t3.small, t3.medium, t3.large, and m6i.large. These are not feature tiers. Each option reflects a different balance of compute and memory for the machine hosting your deployment. The t3 sizes step up in capacity from small to large. The m6i.large offers a compute-optimized alternative. Choose the instance that fits your expected network size and workload. Billing accrues only for the hours each instance runs.
Top-of-mind questions for buyers
Billing meters running hours only. When you stop the instance, the hourly software charge stops accruing. Underlying AWS storage or other resources tied to a stopped instance may still incur separate AWS fees, but the software rate meters running time.
Each option maps to an EC2 machine with a set balance of compute and memory. The t3 sizes cover general workloads at rising capacity. The m6i.large adds a compute-optimized profile. Pick the size that matches your expected network size and connection load.
No. You pay only for the hours the chosen EC2 instance runs, not per connected device or user. The software is self-hosted, so your network size affects which instance capacity you need, not the per-hour rate itself.
docs.netbird.io
Helpful?
Vendor refund policy
We do not offer refunds for this product. AWS infrastructure charges (EC2, EBS, data transfer) are billed separately by AWS and are not refundable by us.
Legal
Vendor terms and conditions
Upon subscribing to this product, you must acknowledge and agree to the terms and conditions outlined in the vendor's End User License Agreement (EULA) .
Content disclaimer
Vendors are responsible for their product descriptions and other product content. AWS does not warrant that vendors' product descriptions or other product content are accurate, complete, reliable, current, or error-free.
Delivery details
64-bit (x86) Amazon Machine Image (AMI)
Amazon Machine Image (AMI)
An AMI is a virtual image that provides the information required to launch an instance. Amazon EC2 (Elastic Compute Cloud) instances are virtual servers on which you can run your applications and workloads, offering varying combinations of CPU, memory, storage, and networking resources. You can launch as many instances from as many different AMIs as you need.
Version release notes
NetBird 0.76.3 - Initial release (August 2026)
- NetBird 0.76.3 server with dashboard v2.90.9 on Ubuntu 24.04 LTS
- Management, signal, relay, STUN and an embedded identity provider on one instance
- No external identity provider and no SaaS account required
- Administrator credential generated at first boot, stored as a bcrypt hash
- TLS certificate issued at first boot for the instance address so peers can validate it
- Dashboard, REST API, gRPC and relay behind an nginx TLS perimeter on 443
- Container ports bound to the instance, never exposed
- Peers, groups and policies in a local SQLite datastore on the persistent volume
- Anonymous telemetry disabled by default
- CIS Level 1 hardening applied (ansible-lockdown/UBUNTU24-CIS)
- CVE-scanned before every release
- certbot pre-installed for CA-signed TLS certificates
- UFW firewall pre-configured (ports 22, 80, 443 and UDP 3478 only)
- fail2ban, auditd, AppArmor pre-configured
- SBOM (CycloneDX 1.6) at /etc/lynxroute/sbom.json
- CIS Conformance Report (OpenSCAP) at /etc/lynxroute/cis-report.html
- Written source offer for the AGPL-3.0 components at /usr/share/doc/lynxroute/LICENSES.txt
- IMDSv2 enforced
Additional details
Usage instructions
- Launch instance (t3.medium recommended; t3.small minimum)
- Open Security Group - allow TCP 443 and TCP 80, plus UDP 3478 for NAT traversal, from the networks your peers connect from
- SSH: ssh -i key.pem ubuntu@<PUBLIC_IP>
- Read credentials: sudo cat /root/netbird-credentials.txt
- Open https://<PUBLIC_IP>/ in your browser - accept the self-signed certificate warning, then sign in with the administrator e-mail and the generated password. This account is the bootstrap administrator for the embedded identity provider; invite your real users from the dashboard afterwards.
- Create a setup key in the dashboard (Setup Keys, then Add key), then join a machine: curl -fsSL https://pkgs.netbird.io/install.sh | sh netbird up --setup-key <KEY> --management-url https://<PUBLIC_IP> Confirm with: netbird status
- Replace the self-signed TLS certificate with a CA-signed one for production: sudo certbot --nginx -d yourdomain.com
First boot downloads the geolocation databases the management service needs before it starts serving, which takes 2-4 minutes. A loading page is served on port 443 until it is ready.
IMPORTANT - peers validate this server's TLS certificate. The image issues a self-signed certificate for the instance's address so peers can enrol immediately, but if you intend to point a DNS name at this server, run certbot and update the address BEFORE enrolling peers you cannot easily re-enrol: sudo certbot --nginx -d yourdomain.com sudo sed -i 's|https://<PUBLIC_IP>|https://yourdomain.com |g' /etc/netbird/config.yaml sudo sed -i 's|https://<PUBLIC_IP>|https://yourdomain.com |g' /opt/netbird/dashboard.env sudo systemctl restart netbird
UDP 3478 must be open for NAT traversal. Without it peers still enrol and appear in the dashboard, but they cannot build direct tunnels and every connection falls back to the relay.
Resources
Vendor resources
Support
Vendor support
Visit us online: https://lynxroute.com
For NetBird documentation:
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Similar products
Private VPN Network Server powered by NetBird. Instantly create your own secure VPN to protect devices, hide your home IP, and control your private network with an easy web dashboard. No domain required for quick start. This product has charges associated with it for the provision and deployment of the application and AMI support.
NetBird combines a WireGuard®-based overlay network with Zero Trust Network Access, providing a unified open source platform for reliable and secure connectivity
Customer reviews
No customer reviews yet
Be the first to review this product . We've partnered with PeerSpot to gather customer feedback. You can share your experience by writing or recording a review, or scheduling a call with a PeerSpot analyst.