NetBird Review Questions

ChicagoMed · May 4, 2024, 4:18am

Hi Tom,

Happy to see your Netbird review came out today. I had a couple questions:

How would you compare the relative security/performance capability between Netbird and Nebula, Tailscale and others you have mentioned before? Tailscale is also on the Wireguard protocol, right? So would you expect similar speeds?
How secure is the coordination server if self-hosted. I know in the case of Nebula because it is certificate based, the Lighthouses can be compromised without any harm coming to the overlay. Here it seems all of the user data, routing, configs are all being stored on a public facing server with a FQDN to boot. That seems like a bit of a vulnerability! Or am I missing something?

Thanks as always!

LTS_Tom · May 4, 2024, 9:14am

Performance should be similar to Tailscale. Also similar to Tailscale is that the public server would be the attack point that would allow the attacker to add nodes to your network. Tailscale has their “Tail Lock” feature to mitigate this and there is a currently not such a feature in Netbird but there is a request for one here:

github.com/netbirdio/netbird

Implementation of Enhanced Node Authorisation Features for Increased Security Across All User Tiers

opened 06:53PM - 14 Apr 24 UTC

Ezirius

feature-request

**Is your feature request related to a problem? Please describe.** The current …NetBird setup potentially allows insiders or compromised accounts to add unauthorised nodes to networks. This issue raises serious concerns not only for organisations but also for personal users who might store sensitive data or operate home-based IoT setups needing secure, controlled access. For instance, significant breaches in 2023, including those impacting large organisations like T-Mobile and Twitter, highlight the urgent need for enhanced security features to prevent unauthorised access ([The Independent](https://www.independent.co.uk/advisor/vpn/live-data-breaches-and-stats)) ([NordLayer](https://nordlayer.com/blog/data-breaches-in-2023/)) ([IdentityIQ](https://www.identityiq.com/data-breaches/2023-a-year-of-record-breaking-data-breaches/)). **Describe the solution you'd like** I propose the introduction of a feature similar to Tailscale's "tailnet lock," but tailored to NetBird's system architecture. This feature would involve a robust node authorisation mechanism requiring explicit approval for each new node's integration into the network through a secure and verifiable process. Ideally, this would use cryptographic signatures verified against a list of pre-approved signatories within the user's network—ensuring no node joins without proper authorisation from a trusted entity. It's crucial that this feature operates independently of the central coordination server, which could be a vulnerability if compromised. **Describe alternatives you've considered** While a two-factor authentication system for adding new nodes, requiring secondary admin confirmation, could be an alternative, this system might still depend on the security of the central coordination server, posing a risk if compromised. This method could potentially be less secure than a decentralised signature verification system. **Additional context** The necessity for this feature goes beyond enterprise applications and is critical for personal users. The record-breaking number of breaches in 2023, along with the evolution of cyber threats from ransomware to data theft and extortion, shows the urgency of fortifying personal information. By implementing such security measures, NetBird would significantly enhance trust in its platform, ensuring that users at all levels—whether large enterprises or individual users—can maintain control over their networks without fear of internal threats or breaches. This feature is vital for upholding the integrity and security of private networks, protecting them against both external attacks and internal vulnerabilities ([CRN](https://www.crn.com/news/security/the-10-biggest-data-breaches-of-2023-so-far)).

liquidjoe · May 5, 2024, 1:56pm

Good instinct. Also think about where you run this. Isolate services - especially public facing ones.

If you run this on your router (when the pfsense package drops) you expanded this risk to your whole network. This goes for a lot of the packages avail in pfsense.

Don’t treat your router like a server.

ChicagoMed · May 5, 2024, 2:35pm

I will look into the Tail Lock feature, but while I would agree the UI on NetBird is really slick, I don’t think Nebula (https://www.defined.net/) gets enough love.

It’s secure enough for Slack to trust and is all certificate based (which is the basis of trust for OpenVPN). It still allows the UDP punching via a “Control Server” but you can hack it, take it down, do whatever you want and you still can’t access the network.

Perhaps someone in the Open Source community should consider creating an Open Source UI for Nebula the way Defined Networking has for their pay version. Not sure I am the right person to start that effort (from a developer strength standpoint) but would be happy to contribute if others are interested in exploring.