NetBird vs. ZeroTier: Layer 2 or Layer 3? The Enterprise Comparison (2026)

ZeroTier and NetBird appear to solve the same problem: connecting devices across sites and clouds into one private network, without central VPN concentrators. Under the hood, the two could hardly be more different. ZeroTier builds a virtual Ethernet at Layer 2 with its own protocol, while NetBird orchestrates standard WireGuard tunnels at Layer 3. On top of that, since 2025 there is a licensing difference that many comparison articles have not caught up with: ZeroTier's agent is now MPL-licensed, but the network controller is commercially source-available, whereas NetBird is fully open source and can be self-hosted including its dashboard. This comparison sorts out architecture, features, licensing, pricing and GDPR aspects for IT decision-makers and answers the real question: in which cases is ZeroTier the right choice, and when does NetBird fit business use better?

NetBird and ZeroTier in 60 Seconds

ZeroTier comes from ZeroTier Inc., a US company based in California [9]. The approach: a global peer-to-peer overlay (internally called VL1) transports encrypted packets, and on top of it VL2 virtualizes a complete Ethernet including VLAN capabilities and multicast [1]. Devices behave as if they were plugged into the same switch, whether they sit in the office, in a data center or in a home office. Management normally runs through ZeroTier Central, the vendor's hosted control plane. The current version, ZeroTier One 1.16.2, was released in May 2026 [8].

NetBird comes from NetBird GmbH in Berlin [16] and is built entirely on WireGuard: every connection between two peers is a regular WireGuard tunnel that the NetBird services (management, signal, relay) negotiate automatically [10]. Instead of a virtual switch, you get a routed Layer 3 network with central access policies, posture checks and IdP integration. The complete stack including the web dashboard is licensed under BSD-3 and AGPL and can be self-hosted [10], or run as a managed service. The release cadence is high: v0.76.0 and v0.76.1 shipped at the end of July 2026 [12]. We cover the comparison with the SaaS market leader separately in NetBird vs. Tailscale 2026: The Ultimate Enterprise Comparison.

The Architectural Difference: Virtual Ethernet vs. WireGuard Overlay

How ZeroTier Works

ZeroTier operates in two layers. VL1 is the peer-to-peer transport: encrypted, with NAT traversal and relaying via root servers as a fallback. The cryptography is a custom construction from established primitives: Curve25519/Ed25519 for keys and signatures, Salsa20 with Poly1305 in an encrypt-then-MAC scheme [1]. One documented design decision: VL1 does not implement forward secrecy; the protocol documentation justifies this with simplicity, reliability and a small code footprint, and recommends running sensitive protocols such as SSL or SSH through the overlay on top [1].

Peer discovery runs through root servers, the so-called "Planet": currently four globally distributed servers operated by ZeroTier Inc. as a free service [1]. On top of that, VL2 virtualizes the actual Ethernet, while network controllers manage configuration and memberships [1].

How NetBird Works

NetBird does without a custom protocol: the data plane is standard WireGuard, including support for kernel WireGuard [10]. Management, signal and relay services negotiate the tunnels automatically: direct peer-to-peer connections where possible, relay fallback where necessary [10]. Access policies, posture checks, IdP integration and audit logging live centrally in the management plane. How much manual work a WireGuard network takes without this orchestration is covered in our guide Setting Up WireGuard in the Enterprise: NetBird automates exactly this key distribution and configuration.

What Layer 2 Means in Practice

The most important difference does not show up in any feature table: the network layer. Because ZeroTier emulates Ethernet, broadcast and multicast work in the overlay, devices find each other via discovery protocols such as mDNS, and with a Linux bridge you can even join physical LANs where devices cannot run a ZeroTier agent at all [5]. One limitation is documented by ZeroTier itself: on iOS and Android, the systems' VPN APIs do not allow broadcast/multicast [5].

NetBird works one layer up: IP packets through WireGuard tunnels, controlled via routes, DNS and policies. Multi-site Layer 2, broadcast-dependent applications or non-IP protocols are not what NetBird does. For typical business remote access and site-to-site networking at the IP level, Layer 3 is exactly right and keeps the overlay tidy: no broadcast traffic across sites, clear routes, clear policies.

Licensing and Self-Hosting: Where Everything Changed in 2025

ZeroTier Since 1.16.0: MPL Agent, Commercial Controller

With version 1.16.0 (2025), ZeroTier restructured its licensing model: the agent's core and service have since been licensed under the Mozilla Public License 2.0 [8]. The network controller, the component that manages networks, memberships and rules, sits in the nonfree/ directory under the "ZeroTier Source-Available License v1.0" [9].

This license is stricter than many expect. "Commercial Use" literally covers any use "by or for the benefit of a for-profit company", explicitly including production, staging and development environments for business purposes, and government bodies and non-profits fall under it as well [9]. Non-commercial use covers only private use, student projects and an evaluation of at most 30 days [9]. The license text itself makes it clear that the software is "source-available, but it is not 'open source' as defined by the Open Source Initiative" [9]. Any business that wants to self-host the ZeroTier controller therefore needs a commercial agreement with ZeroTier.

The release notes document the license history [8]:

Many older comparison articles still describe the BSL situation. When in doubt, check the release notes and the license files in the repository directly [8].

On self-hosting: the controller is embedded in ZeroTier One and can technically be operated yourself; it is managed through a local HTTP API. The documentation describes this as a low-tech path and notes: "You'd likely build yourself something fancier around this API" [4]. There is no official web UI for self-hosted operation [4], and the root server structure remains with the vendor by default [1].

NetBird: BSD-3/AGPL, the Complete Stack Is Self-Hostable

NetBird takes the opposite path. The code is licensed under BSD-3-Clause, with only the management/, signal/ and relay/ directories under the AGPL-3.0 [10]. Both are OSI licenses; commercial use including self-hosting is possible without a license agreement. Full self-hosting is officially documented: management, signal, relay, STUN and the web dashboard run on your own infrastructure via a quickstart script [14].

Running it yourself, however, also means patch responsibility. At the end of July 2026, NetBird shipped a security fix with v0.76.0: advisory GHSA-qcpp-8vwj-hhwr describes a local privilege escalation via an unauthenticated IPC socket in the client daemon, severity high, affecting versions 0.5.0 through 0.75.1, patched in 0.76.0 [11]. v0.76.0 was released on July 29, 2026, followed by v0.76.1 on July 31, 2026 [12]. Getting such releases into servers and client rollouts promptly is part of operations, whether self-hosted or managed.

Access Control and Zero Trust Features

ZeroTier ships its own rules engine: it is stateless, meaning it does without connection tracking, and rules are enforced in a distributed fashion by both senders and receivers [2]. The building blocks are flow rules, capabilities (signed rule bundles with a maximum of 64 entries) and 32-bit tags for segmentation; custom flow rules are only available from Scale/Enterprise [2]. This is powerful, but it is a proprietary rules DSL with a learning curve. Device SSO is a paid feature "available to Essential and Commercial subscribers", runs only on desktop operating systems, the IdP must support PKCE, and direct Google OIDC is not supported [3].

NetBird controls access via group-based policies in the web UI and adds posture checks with five check types: NetBird client version, country/region, peer network range, operating system version and running process; they are evaluated on connect or login and take effect through linked policies [13]. In the cloud edition, the Team plan includes enterprise IdP integration, SCIM and audit logs, while the Business plan adds device approval, MDM/EDR checks and traffic events [15]. How this policy approach stacks up against classic ZTNA vendors is covered in our comparison Twingate Alternative 2026: NetBird vs. Twingate.

Pricing Compared: Per Device, Per User, Flat Rate

The two vendors bill in fundamentally different ways, and this is often where the economics are decided.

ZeroTier bills per device [6]:

With Quantum, ZeroTier additionally positions a custom tier for "sovereign deployments" and mission-critical infrastructure [6]; the product page describes post-quantum cryptography with hybrid classical/quantum-resistant encryption and targets, among others, defense, government and finance [7]. For mid-sized businesses this is a side note, but it matters for reading the product strategy.

NetBird Cloud bills per user [15]:

Team and Business include 100 machines plus 10 per user; each additional machine costs €0.50/month [15]. Self-hosting is the third option: no license costs, but full operational effort for your own team [14].

The difference between the models becomes concrete as fleets grow. A device-heavy environment with 250 devices (servers, IoT, kiosks) costs $179 plus 150 times $1.80 on ZeroTier Scale, i.e. $449/month. A user-heavy team of 50 pays €600/month on NetBird Cloud Business. The third variant is a flat rate per instance: birdhost charges from €99.90/month for managed NetBird (DE region), regardless of user and device count. More on that below.

GDPR and Compliance: Where Does the Control Plane Run?

For European companies, the core question is less about the data plane than about the control plane: who operates it, where does it run, and which jurisdiction does the operator fall under?

With ZeroTier, the control plane in the default setup runs as a hosted service (ZeroTier Central) with the vendor, a US company from California [9]; the four root servers of the default "Planet" are also operated by ZeroTier Inc. [1]. That places connection metadata (who connects to whom, and when) with a US provider, which requires a third-country transfer assessment under Art. 44 ff. GDPR. In fairness: payload data is end-to-end encrypted and preferably flows directly between peers [1]. Why the control plane of US cloud services can still become a compliance risk, keyword CLOUD Act, is laid out in detail in GDPR-Compliant VPN 2026: Why US Cloud VPNs Are a Compliance Risk.

NetBird can be operated entirely on your own or European infrastructure, including the control plane [14]; the vendor, NetBird GmbH in Berlin, is a German company [16]. For organizations in scope of NIS2, access control, MFA and auditability matter on top: policies, posture checks and audit features provide the technical foundation for that, regardless of vendor.

Important: this section is not legal advice. Involve your data protection or legal counsel for concrete assessments.

Decision Matrix: When ZeroTier, When NetBird

ZeroTier is the right fit if you:

• Need real Layer 2 across sites: broadcast, multicast, device discovery via mDNS or protocols beyond IP
• Want to bridge physical LANs, including legacy devices that cannot run an agent
• Are networking a homelab or mixed legacy protocols: the free tier with 10 devices goes a long way
• Accept the hosted control plane or negotiate an Enterprise/Quantum agreement
• Deliberately want fine-grained packet filtering via the rules DSL

NetBird is the right fit if you:

• Are building business remote access and site-to-site networking at the IP level, the standard case
• Standardize on WireGuard as a broadly audited protocol, for example at the request of your security team or auditors
• Need IdP integration, posture checks and audit evidence for compliance requirements such as NIS2
• Want full self-hosting without a license agreement, or managed operations in the EU
• Prefer predictable costs over per-device tiers as your device fleet grows

Managed NetBird: If It Should Be NetBird, Without Running It Yourself

If the choice lands on NetBird, the operations question remains: self-host or have it run for you. birdhost operates the NetBird control plane as a dedicated instance. In Germany, Essential costs EUR 99.90 per month, Business EUR 199.90, Priority EUR 249.90 and Enterprise EUR 449.90, all net. Users and devices are not limited by count. Support response ranges from 24 hours on Essential through 4 hours on Business and 1 hour on Priority to 60 minutes around the clock on Enterprise. Access policies, posture checks and audit events are part of the core scope, while the reverse proxy and a custom domain are included from Business.

Hosting is available in 8 regions (Germany, Netherlands, USA, Canada, Singapore, Japan, Australia, India), GDPR-compliant when you choose an EU location (Germany, Netherlands); the German location runs in ISO 27001 and BSI C5 certified data centers. Operations, monitoring, backups and updates are handled by the birdhost team, including applying security releases such as v0.76.0 to the instance. You can test it free for 7 days, credit card required.

Conclusion

NetBird and ZeroTier are not interchangeable products but two answers to different questions. ZeroTier answers the question "How do I get an Ethernet across sites?", with everything that entails: broadcast, multicast, bridging, legacy protocols. NetBird answers the question "How do I build a WireGuard-based corporate network with identity, policies and auditability?". The trigger for switching is often an end-of-life legacy appliance, as the end of support for Cisco ASA and AnyConnect is currently demonstrating for many companies.

Two developments from 2025/2026 belong in every current evaluation: ZeroTier's licensing overhaul with 1.16.0, which makes the controller subject to a commercial license for commercial self-hosting [8][9], and NetBird's high release cadence including security fixes such as the one in v0.76.0 [11], which shows that an overlay network needs ongoing care.

If you need real Layer 2, choose ZeroTier. If you are looking for a WireGuard-based corporate network with a clear licensing situation, IdP integration and an EU operations option, NetBird is the right choice, either self-hosted or as a managed service with a predictable flat rate.

Sources

• [[1]] ZeroTier Protocol Design Whitepaper (VL1/VL2, cryptography, forward secrecy, root servers)
• [[2]] ZeroTier Rules Engine Documentation (flow rules, capabilities, tags)
• [[3]] ZeroTier SSO Documentation (paid feature, PKCE, desktop-only)
• [[4]] ZeroTier Controller Documentation (self-hosting via local API)
• [[5]] ZeroTier Bridging Documentation (Layer 2 bridging, broadcast/multicast limits on mobile)
• [[6]] ZeroTier Pricing (Personal, Essential, Scale, Enterprise, Quantum)
• [[7]] ZeroTier Quantum Product Page (post-quantum cryptography, target industries)
• [[8]] ZeroTier Release Notes (1.16.0 license overhaul, 1.16.2, license history from 1.4.4)
• [[9]] ZeroTier Source-Available License v1.0 (nonfree/LICENSE.md)
• [[10]] NetBird GitHub Repository (README: WireGuard data plane, BSD-3/AGPL licensing)
• [[11]] NetBird Security Advisory GHSA-qcpp-8vwj-hhwr (Local Privilege Escalation via Unauthenticated IPC Socket)
• [[12]] NetBird Releases (v0.76.0 on July 29, 2026, v0.76.1 on July 31, 2026)
• [[13]] NetBird Posture Checks Documentation (5 check types)
• [[14]] NetBird Self-Hosted Quickstart (complete stack incl. dashboard)
• [[15]] NetBird Cloud Pricing (Free, Team, Business)
• [[16]] NetBird Imprint (NetBird GmbH, Berlin)