# NetBird v0.65 - Built-in Reverse Proxy with Custom Domains

NetBird v0.65 introduces a built-in reverse proxy in the management server, letting you expose internal services through your NetBird network with SSO, PIN, or password authentication—no VPN client required for end users.

\
Written by [Brandon Hopkins](https://www.linkedin.com/in/hopki/)

Published on February 18th, 2026

## On this page:

- Why Not Just Use Cloudflare Tunnels?
- Add a Service
- Custom Domains
- Authentication
- Settings
- Self-Hosted Improvements
- Cloud Support Coming Soon
- Other Improvements
- Get Started

NetBird v0.65 has integrated a reverse proxy into the management server. Point a custom domain at your NetBird server, configure the proxy in the dashboard, and your internal services are securely accessible from any browser. No VPN client required for end users. TLS, authentication, and routing are handled through encrypted WireGuard tunnels, fully self-hosted and under your control.

## Why Not Just Use Cloudflare Tunnels?

Cloudflare Tunnels is free and easy to set up, but all of your traffic flows through their infrastructure, allowing them to see your traffic—essentially a man-in-the-middle by design. Moreover, Cloudflare's free plan has data transfer limits, making it unsuitable for media streaming or large file transfers.

NetBird eliminates these limitations with self-hosted deployments, providing full ownership over the proxy and its limitations. The reverse proxy includes built-in authentication options such as SSO through your identity provider, shared passwords, or PIN codes, minimizing the need for additional services.

## Add a Service

Expose any internal service by selecting a subdomain and adding backend targets.  You can add multiple targets to a single service and use path-based routing to direct different URL paths to various backend services.

## Custom Domains

To bring your own custom domain, add a CNAME record pointing to your NetBird proxy cluster. NetBird automatically handles TLS certificate provisioning.

1. Navigate to **Reverse Proxy** → **Custom Domains**
2. Click **Add Domain**
3. Enter your domain name
4. Add a CNAME record at your DNS provider pointing to your NetBird proxy
5. NetBird verifies the CNAME and provisions a TLS certificate automatically

Learn more in the [Custom Domains documentation](https://docs.netbird.io/manage/reverse-proxy/custom-domains).

## Authentication

Secure your exposed services through multiple authentication methods:

- **SSO** - Authenticate users through your identity provider, optionally restricting access to certain user groups.
- **Password** - Use a shared password for easy access to internal tools or for external collaborators.
- **PIN Code** - Add a numeric PIN for quick access control.
- **No authentication** - Expose services publicly when needed (use with caution).

Methods can be combined on the same service, and sessions are managed using JWT tokens for seamless connectivity.

Learn more in the [Authentication documentation](https://docs.netbird.io/manage/reverse-proxy/authentication).

## Settings

Each service has additional options to control how the proxy handles requests:

- **Host header passthrough** - Allows the original Host header to be forwarded to your backend.
- **Redirect rewriting** - Rewrites redirect URLs in backend responses to use the public domain, ensuring users aren't sent to internal addresses.

## Self-Hosted Improvements

Version 0.65 introduces a unified NetBird server binary, consolidating services into a single container for simplified management. If you are currently running a deployment, updated quick start scripts and a migration guide are available to enable the reverse proxy.

## Cloud Support Coming Soon

Currently available for self-hosted deployments only, cloud support with hosted reverse proxy nodes will be ready soon. Follow updates via [X](https://x.com/netbird) or join our [Slack](/content/slack-url/index.html) community.

## Other Improvements

This release includes enhanced access control on various endpoints, a public OpenAPI cloud API spec, an early message buffer for preventing message loss, and a refactored relay connection container.

Full details are in the [GitHub release notes](https://github.com/netbirdio/netbird/releases/tag/v0.65.0).

## Get Started

- **Reverse Proxy docs**: [Reverse Proxy Overview](https://docs.netbird.io/manage/reverse-proxy)
- **Custom Domains**: [Custom Domains documentation](https://docs.netbird.io/manage/reverse-proxy/custom-domains)
- **Authentication**: [Authentication documentation](https://docs.netbird.io/manage/reverse-proxy/authentication)
- **Try NetBird**: [Get started at netbird.io/pricing](/content/pricing/index.html)