NetBird Reverse Proxy with L4 Support: Control TCP, UDP and TLS Directly from the Dashboard

Great news for all birdhost customers: NetBird v0.67.0 delivers a feature the community has been waiting for — Layer 4 support in the built-in reverse proxy. This means that in addition to HTTP services, you can now publish raw TCP, UDP and TLS connections through the NetBird reverse proxy. At birdhost, we will update all our Business customers directly so you can start using this feature right away.

Why Is This a Game Changer?

Since version 0.65, NetBird has offered a built-in reverse proxy that makes internal services accessible via custom domains with automatic TLS certificates and SSO authentication — no classic port forwarding, no firewall holes. Until now, however, this was limited to Layer 7 (HTTP/HTTPS).

In practice, this meant: if you wanted to publish a web application, dashboard or API, you were well served. But when it came to databases, proprietary protocols or real-time communication, you still had to fall back on manual workarounds like VPS port forwarding or iptables rules.

With L4 support in v0.67.0, this limitation is gone. The reverse proxy can now forward raw TCP connections, UDP datagrams and TLS passthrough connections — fully configurable from the NetBird dashboard. For a detailed comparison of how NetBird stacks up against alternatives, see our NetBird vs. Tailscale comparison.

What Exactly Is L4 (Layer 4) and What Does It Enable?

Layer 4 in the OSI model is the transport layer — this is where TCP and UDP operate. Unlike Layer 7 (HTTP), L4 proxying does not inspect the content of connections. The proxy forwards raw connections or datagrams directly to the backend without analyzing the application layer content.

This opens up a wide range of new use cases:

Database Access: Make PostgreSQL, MySQL, Redis or MongoDB directly accessible through the reverse proxy — without the database server needing a public IP.

SSH and Remote Management: Build secure tunnels for SSH sessions or remote desktop protocols without opening ports directly on the host. Check out our guide on setting up a company network for remote employees for a step-by-step walkthrough.

VoIP and Streaming: SIP/RTP traffic that requires UDP can now be cleanly routed through NetBird.

Legacy and Industrial Protocols: Whether healthcare systems with HL7/DICOM, ERP systems like SAP GUI, SCADA interfaces or proprietary thick clients — anything that communicates over raw TCP streams can now run through the reverse proxy.

TLS Passthrough: In TLS mode, the proxy performs SNI-based routing and forwards the encrypted connection directly to the backend without terminating TLS. The backend retains full control over encryption.

How Does It Work Technically?

Configuration is done through the familiar NetBird dashboard under "Reverse Proxy → Add Service":

1. Choose service mode: In addition to HTTP, TCP, UDP and TLS are now available as modes.
2. Configure port: L4 services listen on a dedicated port on the proxy cluster. Depending on the cluster configuration, the port is auto-assigned or can be manually selected.
3. Define targets: Like HTTP services, each target points to a peer, host, domain or subnet in the NetBird network — plus target port.
4. Access control: Access restrictions via IP CIDR ranges and geo-blocking are also available for L4 services.

An important difference: L4 services do not support browser-based authentication methods (SSO, password, PIN), as there is no HTTP layer for auth flows to run through. Instead, access can be restricted via IP and country rules.

For birdhost customers: Every Business instance is provisioned with a dedicated port range for L4 services. Simply choose a port from your assigned range in the dashboard — no need to worry about the underlying infrastructure. HTTP and TLS services continue to run on port 443 and require no additional configuration.

Also via CLI: netbird expose with L4 Support

The netbird expose command introduced in v0.66 also supports L4 protocols. This allows you to temporarily publish local services through the reverse proxy — ideal for quick demos, development servers or temporary database tunnels:

# Temporarily publish PostgreSQL
netbird expose 5432 --protocol tcp --with-pin 123456

# UDP service with password protection
netbird expose 5353 --protocol udp --with-password my-password

Services created this way are ephemeral — they exist only while the command is running and are automatically removed when the session ends.

What This Means for birdhost Customers

We are rolling out the v0.67.x update for all our Business customers shortly. Here's what that means:

You don't need to do anything. We take care of updating your birdhost instances. Once the update is live, L4 support is available directly in the dashboard.

For L4 services, Business customers receive a dedicated port range pre-configured on their instance. Simply create your TCP, UDP or TLS service through the dashboard, pick a port from your assigned range and you're live — no tickets, no waiting.

This makes NetBird via birdhost a complete replacement for traditional VPN concentrators — whether as an OpenVPN alternative or Sophos VPN replacement. Whether you want to publish web apps, databases, legacy systems or IoT devices — everything runs through a single interface, on your own infrastructure, in ISO 27001 certified data centers. And with our new locations in Singapore and Australia, it's ready for global teams too.

New article: NetBird Agent Network extends the same approach to AI agents: identity instead of API key, with budget caps and a model allowlist.

Summary: Key New Features in v0.67.0

Not a birdhost Customer Yet?

With birdhost, you get NetBird as a fully managed service at a predictable monthly flat rate, hosted in ISO 27001 certified data centers (certification held by the data center operator), with dedicated support. No effort for updates, no worries about infrastructure.

Get started now: managed NetBird hosting at a glance

This post is based on the NetBird v0.67.0 release notes, the official NetBird documentation and the associated Pull Request #5530.