OpenVPN Access Server vs. NetBird: Which Fits Your Team

The short answer:

Access Server is a self-hosted VPN concentrator: all client traffic terminates on a server you run, which enforces access rules and routes traffic. NetBird is a self-hosted-or-cloud WireGuard mesh: peers build direct encrypted tunnels to each other, and the server only coordinates. Choose Access Server for SAML/LDAP/RADIUS-based identity, TCP tunnel mode, offline or airgapped deployment, and flat per-connection pricing with no feature gating. Choose NetBird for automated SCIM/IdP provisioning, turnkey device posture checks, and peer-to-peer performance across a distributed, heterogeneous fleet.

Technology

Standalone or clustered software VPN server. Self-hosted; control plane and data plane both on customer infrastructure

Overlay mesh with control-plane/data-plane split. Self-hosted components: Management service (peer registration, network map, WireGuard key distribution, IP assignment from 100.64.0.0/10, policy, DNS, users), Signal service (peer discovery and ICE candidate exchange; stores no data and forwards no traffic once peers connect), Relay service, Coturn (STUN/TURN), Dashboard, IdP, database

Tunneling protocols

OpenVPN over TCP and UDP. Data channel AES-256-GCM by default, ChaCha20-Poly1305 configurable; control channel TLS-Crypt v2 by default

WireGuard only. No IPsec, no OpenVPN, no SSL/TCP tunnel mode. TCP appears only as relay transport — the relay is WebSocket over TLS.

NAT traversal / relay

Not applicable — clients connect inbound to the server

Direct peer-to-peer via Pion ICE (WebRTC) with STUN; falls back to Coturn TURN or the WebSocket relay. Relayed traffic remains end-to-end encrypted. Self-hosters must run their own relay and STUN/TURN fleet — no documented option to use NetBird-operated relays from a self-hosted deployment. Cloud provides globally distributed relays; self-hosted is single-instance or DIY geo-distribution

IPv6 support

Not for the server's listening side. Access Server is primarily an IPv4 system and requires an IPv4 address for its OpenVPN daemons to process incoming connections. The tunnels themselves can transport IPv6 packets

IPv6 overlay addressing since v0.71.0, on by default for new accounts: dual-stack peers receive both address families, DNS returns A and AAAA, policies apply to both, and 0.0.0.0/0 exit routes auto-create ::/0. Overlay IPv6 addresses are not publicly routable. IPv6 for underlay peer connectivity (ICE candidates) is not documented.

Open source

Partially — the OpenVPN protocol core is open source and auditable; the Access Server management layer is proprietary

Dual-licensed: BSD-3-Clause for most of the repository, AGPLv3 for management/, signal/, relay/, and combined/. Enterprise capabilities (active-active HA, SCIM, EDR/MDM, flow logging) are license-gated; whether that code is closed-source or license-key-gated open code is not stated.

Supported OS for server install

Ubuntu LTS, Debian, Red Hat Enterprise Linux, CentOS

"Any Linux OS" via Docker Compose.

Virtual appliances

VMware ESXi, Microsoft Hyper-V, Docker

None found

Cloud marketplaces

AWS, Microsoft Azure, Google Cloud, DigitalOcean, Oracle Cloud, IBM Cloud, Vultr

Vultr Marketplace listing exists for self-hosted deployment.

Offline / airgapped install

Supported — offline activation via OpenVPN Support with a fixed license key

Not documented.

Client availability

OpenVPN Connect app on Windows, macOS, iOS, Android, ChromeOS. Linux is not served by the Connect app — Linux uses the OpenVPN 3 Linux client, the open-source openvpn CLI package, or the NetworkManager-openvpn plugin

All OpenVPN-protocol compatible clients, routers, NAS, and other devices can be used.

Official GUI and CLI clients for Windows, macOS, Linux; mobile apps for iOS and Android; packaged support for Docker, Kubernetes, Synology, TrueNAS, pfSense, OPNsense, OpenWrt, MikroTik, Raspberry Pi, Proxmox VE, tvOS, Android TV. Browser-based client for SSH and RDP with no local install.

Profile distribution / enrollment

Connection profile distributed by file, by server URL, by custom token URL, from the Client Web UI self-service portal, or bundled into a pre-configured OpenVPN Connect installer (Windows and macOS). Global configuration file (.ocfg) predefines profiles, proxies, and preferences for MDM-style mass deployment.

No client profile file concept. Enrollment is either interactive SSO or setup keys, supporting one-off or reusable use. User invites are cloud-only

Router / gateway device support

OpenVPN-compatible routers are supported, and such a device can act as a gateway client for site-to-site or point-to-site routing

Client packages for OpenWrt, MikroTik, pfSense, OPNsense (vendor-documented OPNsense plugin). Any such device can act as a routing peer

Database

SQLite by default; MySQL supported

SQLite by default; PostgreSQL for scaled deployments. MySQL not mentioned

Deployment convenience option

Access Server Link — browser-based deployment to AWS, Azure, or GCP with automatic DNS and TLS certificate provisioning, managed from Access Server Hub. The admin web interface is proxied through OpenVPN's infrastructure while VPN tunnel traffic continues to flow directly between users and the customer's own server

Cloud-managed control plane as the alternative to self-hosting

Pricing model

Based on number of connections. Free tier for a small number of simultaneous connections, a time-limited trial at higher connection counts, incremental add-on connections as usage grows, and a custom price at high connection counts. Single product — no feature tiers; no capability is withheld at a lower price point

Per-user subscription tiers in cloud (Free, Team, Business, Enterprise); self-hosted is free open-source Community Edition or self-hosted plus Enterprise Commercial License. Feature availability varies substantially by tier.

Remote access

Yes, with user- and group-level access control rules

Yes — client-to-peer, or client-to-routing-peer for hosts without a client. All tiers

ZTNA (per-application access)

Yes — delivered by the Zero Trust Application Broker (domain routing). DNS queries for permitted domains resolve to a mapped address from an internal pool (100.64.0.0/10 by default) and Access Server DNAT-translates server-side to the real destination, so a client can only resolve and reach the domains its rules permit and never learns the address of anything else. Rules scope globally, per group, or per user, giving per-application grants rather than flat subnet access

Partial. Access policies are group-based at layer 3/4 (source group → destination group, protocol, ports) rather than per-application, so ZTNA is enforced at the network layer. NetBird SSH is the one layer-7 identity-aware exception, mapping IdP identities to local OS accounts. Device posture checks can gate policies (not available in all plans — Business+ in cloud)

Site-to-site with client as gateway

Yes — site-to-site and point-to-site routing are documented capabilities

Yes — routing peers forward between the overlay and LANs, VPCs, or datacenters.

IoT

Supported for devices able to run an OpenVPN-protocol client, or reached behind a gateway client

Supported where the device can run the client (Linux, OpenWrt, Raspberry Pi, MikroTik); otherwise reached behind a routing peer. No dedicated IoT provisioning product — setup keys with ephemeral mode are the documented pattern

User and user-group based granular access control

Yes — access rules per user and per group. Least privilege at protocol, subnet, IP, or port level, including application domain names. Per-user rules can be layered on top of group rules. Group membership is mapped from RADIUS, LDAP, and SAML during authentication.

Yes — group-based, where groups behave as tags and a peer can hold several. A policy names source group(s) → destination group(s), a protocol, and ports or port ranges, and is bidirectional or source-initiated only. Policies can require posture checks. Enforcement is distributed: each client enforces firewall policy locally. A permissive default all-to-all policy exists and must be removed to achieve least privilege. Layer 3/4 only, not per-application layer 7. All tiers

Device posture / context checks

Available, but implemented through post-authentication Python3 scripts rather than a turnkey UI — device registration by MAC address or UUID, application presence and version compliance, and IP allowlisting for location context

Turnkey checks configured in the dashboard: NetBird client version; country/region geolocation allow or block lists; peer network range (evaluated against local interfaces and public connection IP, IPv4 and IPv6); operating-system version (OS version on Android/macOS/iOS, kernel version on Linux/Windows); process check for specific binaries or services. A failing peer loses access to the policies and routes gated by that check. Mid-session re-evaluation requires server v0.74.0+. Not available in all plans — Business+ in cloud

Certificate and key management

Built-in X.509 certificate authority and PKI with a multi-CA management page in the Admin Web UI, or integration with an external PKI (e.g., SecureW2). Automatic annual CA renewal since Access Server 2.9. Manual CA generation supports cross-signing the previous CA so a server accepts both old and new certificates during a transition; secp384r1 is the default since 2.12.0

WireGuard public keys distributed by the Management service; no customer-facing certificate authority

Account lockout

Authentication failure lockout policy — default 3 consecutive failed attempts within 15 minutes, threshold and timeout configurable

Not documented as a NetBird-side control; brute-force protection would be enforced at the identity provider.

Published certifications

OpenVPN publishes SOC 2 Type 2, ISO/IEC 27001:2022, HIPAA, and GDPR compliance for its business. Access Server also supports running in FIPS mode on RHEL and Ubuntu — a configuration capability, not a CMVP cryptographic module validation

DORA compliance commitments are listed at Enterprise tier only.

API

XML-RPC and REST

REST

External systems integrations

Via post-authentication Python3 scripts, which can implement custom MFA, ZTNA checks, and automated group assignment. Documented MFA plug-in integrations include LastPass and Duo. Device registration by MAC address or UUID is available through the same scripting mechanism. YubiKey support is present in OpenVPN Connect v3 for Linux

CrowdStrike Falcon, SentinelOne Singularity, Microsoft Intune, Huntress, Not available in all plans. Duo is supported as an OIDC identity provider rather than a native integration, so hardware-token and MFA enforcement occur identity-provider-side

SAML

Yes — SAML SSO for VPN user authentication and for Admin Web UI login. Group mapping from the SAML assertion is performed by a post-authentication Python3 script executed during authentication, rather than by a built-in attribute-mapping UI. The script reads the assertion's group claim and assigns the user to the corresponding Access Server group, so IdP-driven group membership is applied at each login

No — NetBird is not a SAML service provider.

Other directory authentication

LDAP, RADIUS (PAP, CHAP, MS-CHAP v2), and PAM against local OS accounts. Local authentication uses SHA256 password hashes in the user properties database. Multiple authentication systems can run simultaneously — one default, with others configured per group or per user

Identity comes from a single configured OIDC provider

OAuth / OIDC

Not supported

Yes. No additional setup for Google Workspace, Microsoft Entra ID, and social logins. Not available in all plans — enterprise OIDC providers require Team+; Free supports only Google, Microsoft, and social logins

IdP-driven user and group provisioning — mechanism

Group membership is resolved at authentication time: LDAP and RADIUS group lookups, or SAML group claims read by a post-authentication script, with automated group assignment scriptable at the same point.

A polling-based sync against Microsoft Graph or the Google Workspace Admin SDK is achievable as customer-built automation against the XML-RPC/REST API or the CLI, but is not a shipped product feature

SCIM 2.0, and API polling, where NetBird pulls from the identity provider: Microsoft Graph for Entra ID, the Google Workspace Admin SDK, and proprietary APIs for Okta, JumpCloud, and Keycloak — each requiring an app registration or service account holding directory read permissions. Not available in all plans — Team+ in cloud; self-hosted requires the Enterprise Commercial License; the free Community Edition has neither

MFA / two-step authentication

Built into the product — MFA via TOTP authenticator apps including Google Authenticator and Duo, with centralized controls in the Admin Web UI to enable, disable, or reset MFA across users. Additional or replacement factors can be implemented in post-authentication scripts.

Identity-provider-side only — NetBird consumes the identity provider's MFA outcome rather than enrolling a second factor itself.

Periodic re-authentication / session control

Authentication failure lockout policy as above (default 3 failures in 15 minutes). Session and re-authentication behaviour is configurable through server settings

Peer Session Expiration: default 24 hours, configurable from 1 hour to 180 days, set account-wide rather than per group, with per-peer opt-out. Applies only to SSO-enrolled peers — peers added with a setup key are unaffected.

Scalability

Server clustering for horizontal scale — add nodes rather than resizing a single server. Nodes are distributed by DNS round-robin, all active simultaneously, sharing credentials and certificates and presenting as a single Access Server to users, under a single shared subscription across the cluster. Nodes can be geographically distributed to place servers closer to users. Data Channel Offload performs encryption and decryption in kernel space, multi-threaded across server CPUs, avoiding the user-space round trip; OpenVPN describes order-of-magnitude performance gains. A client does not require DCO to connect to a DCO-enabled server

No published concurrent-peer numbers or benchmarks. Documented scaling path: split relay servers out, then move from SQLite to PostgreSQL on a dedicated host. Lazy Connections is the scale mechanism — connections open only when traffic requires them rather than maintaining a full mesh; requires v0.50.1+ on clients, Management, and Signal, and is default-on only for accounts created on v0.74.0+

Seamless handover on server failure

Within a cluster, another node picks up load if one node has an outage. A separate active-standby failover mode is also available, in which a second standby server takes over — both servers must be on the same LAN

Because the data path is direct peer-to-peer WireGuard and Signal forwards no traffic once peers connect, an established tunnel does not depend on the control plane and survives a control-plane outage until keys or configuration must change, or a new peer pair must be discovered.

Redundancy / high availability

Active-active clustering and active-standby failover mode, both included in the product rather than gated behind a higher tier

Active-active HA for Management and Signal, with zero-downtime rolling upgrades. Not available in all plans — explicitly gated to the Enterprise Commercial License; the Community Edition is DIY HA only. Cloud includes HA

Multiple routing peers give metric-based failover (lowest metric primary; equal metrics select by client latency with a 20 ms anti-flap threshold) — failover, not load balancing.

Routing features

Split tunneling; NAT mode (client-initiated connections only) and Routing mode; site-to-site and point-to-site routing; domain-name-based routing. Zero Trust Application Broker (domain routing) intercepts DNS queries for permitted domains and returns a mapped address from an internal pool (100.64.0.0/10 by default) instead of the real IP, then DNAT-translates server-side to the true destination — so the client never learns the address of anything it is not authorized to reach.

Network routes by CIDR via routing peers; domain-based routing through a DNS forwarder on the routing peer; exit nodes via 0.0.0.0/0 (masquerade required by default, IPv6 blocked on exit routes to prevent leakage); split tunnelling implicitly through selective routes rather than a tunnel-wide setting; private DNS management with an embedded client resolver.

Routing-peer redundancy is metric-based failover with latency-based selection among equal metrics

Logs

Connection logs recording user identity, IP address, connection duration, and metadata — viewable, filterable, and exportable, with granular per-user activity detail and a real-time connection snapshot for troubleshooting. Remote logging to a local or external syslog server. Reports for performance and usage insight. Instant diagnostic file generation for support cases

Two streams: audit events (system and administrator activity) and connection traffic events. Documented traffic-log constraints: up to 10-minute reporting delay, 7-day retention while in beta, maximum 50,000 flow records via API. No native syslog destination — export is via streaming integrations

Administrator audit log

Yes, via server debug flags written to /var/log/openvpnas.log rather than a dashboard audit view. Logs all activity between Access Server and its configuration databases — who authenticated, which settings they changed, and the source IP.

Yes. Not available in all plans — Team+ in cloud

Admin access control / multiple administrators

Two roles: admin and user. Any user account can be elevated to admin, which grants management of the VPN server; multiple administrators are therefore supported.

Six roles: Owner (one per account, the only role able to delete the organization), Admin, Network Admin, Billing Admin, Auditor (read-only), and User. Roles apply identically to dashboard and API. Unlimited administrator and regular users is a Team+ line item.

SIEM export

Remote syslog to an external server

Audit and traffic event streaming to Datadog, SentinelOne Singularity Data Lake, Huntress, Wazuh, Amazon S3, Amazon Data Firehose, or generic HTTP. Not available in all plans — Business+ in cloud; self-hosted requires the Enterprise Commercial License

Post-quantum key rotation (Rosenpass)

Marketed as the first quantum-resistant mesh VPN. Uses Classic McEliece and Kyber to rotate WireGuard pre-shared keys every two minutes. Enabled per client. Experimental, not supported on mobile, and a Rosenpass-enabled peer can only reach other Rosenpass-enabled peers unless permissive mode is used.

NetBird SSH

Identity-aware SSH with no internet-exposed sshd — an embedded SSH server on each peer, JWT/OIDC authentication mapping sessions to identity-provider identities, and group-to-local-OS-account mapping. NetBird's one genuine layer-7 identity-aware access capability. Requires v0.61.0+ for fine-grained control; disabled by default; port forwarding unavailable on Windows servers. Listed as a Free-tier feature. Session recording is not supported.

Browser client for SSH and RDP

Access without a locally installed client

Lazy Connections

On-demand connection establishment as a mesh-scale optimization

Ephemeral peers

Setup-key option that removes peers automatically 10 minutes after they go offline, for containers and autoscaling groups

Support

24 x 7 chat, email and ticketing support. Support SLA available.

Tiered: Free — community support; Team — ticketing system; Business — standard support; Enterprise — priority support plus solutions-engineer consultation, implementation assistance, custom MSAs and SLAs, and custom integrations.