luci-app-netbirdluci-app-netbird
A LuCI app for the NetBird mesh-VPN client on OpenWrt / ImmortalWrt — manage NetBird on OpenWrt from the LuCI dashboard, no command line needed.
With curl:
sh -c "$(curl -fsSL https://luci-app-netbird.okk.sh/install.sh)"
Routers without curl (wget):
wget -O - https://luci-app-netbird.okk.sh/install.sh | sh
Features
Everything you need to run NetBird on OpenWrt, managed through a clean LuCI interface.
Connect & Manage
Connect, reconnect, disconnect, or deregister your NetBird client — works with both the NetBird cloud and self-hosted servers.
Version Control
Pick your NetBird binary source: official GitHub releases, the system package feed, or a custom download URL.
Firewall Automation
One-click NetBird firewall zone creation.
Toggle LAN → NetBird and
NetBird → LAN forwarding as needed.
Full netbird up Settings
WireGuard, routes, DNS, SSH, IPv6, Rosenpass, and log level — all NetBird client options exposed in the UI.
Peer Status
See every connected peer, their IPs, and connection state at a glance.
Live Logs
Tail the NetBird daemon logs right from the LuCI interface — no SSH needed.
Setup / Quick Start
Get NetBird running on OpenWrt in three steps. For self-hosted users, fill in the Management URL first.
Create a Setup Key
In the NetBird dashboard (or your self-hosted panel), create a setup key. This key registers your router as a new NetBird client.
Authenticate in LuCI
Open Services → NetBird → Authentication. For self-hosted, set the Management URL first. Turn on the master switch, paste your setup key, and click Connect.
Configure the Firewall (optional)
Go to the Network tab. Click
Create Firewall Zone, then enable
LAN → NetBird and/or
NetBird → LAN forwarding so devices on your
local network can reach the mesh and vice versa.
Screenshots
Every part of the NetBird management UI on OpenWrt.
Authentication
Version Management
Settings
Status
Network
Logs
Self-Hosted NetBird Server
luci-app-netbird works with both the NetBird cloud and your own self-hosted NetBird server — the setup is nearly identical.
If you run a NetBird server on OpenWrt or any other host, open Services → NetBird → Authentication, fill in the Management URL pointing to your server, then paste the setup key and click Connect. The LuCI app treats self-hosted and cloud deployments the same way — all features (WireGuard config, firewall zones, peer status, logs) work without any extra NetBird OpenWrt config changes.
Install Methods
Three ways to install NetBird on OpenWrt — pick the one that fits your setup.
One-Click Script
Adds the signed package feed and installs everything in one command. Best for new users — just copy the curl or wget command from the top of this page.
Feed Only
Add the signed feed, then install by name — best if you already have netbird installed:
wget -O - https://luci-app-netbird.okk.sh/feed.sh | sh opkg install luci-app-netbird luci-i18n-netbird-zh-cn
OpenWrt 25+: use apk add instead of opkg install.
Manual .ipk / .apk
Download the NetBird OpenWrt package files from the
Downloads section,
then install offline with opkg install *.ipk or
apk add --allow-untrusted *.apk. Ideal for routers without
internet access during setup.
Frequently Asked Questions
How do I install NetBird on OpenWrt without curl?
Use the wget command shown at the top of this page:
wget -O - https://luci-app-netbird.okk.sh/install.sh | sh.
Most OpenWrt builds include wget by default. If your router has neither
curl nor wget, download the .ipk package from the
Downloads section
on another machine and transfer it to the router for manual installation.
Does luci-app-netbird support self-hosted NetBird servers?
Yes. In Services → NetBird → Authentication, fill in the Management URL with your self-hosted server's address before connecting. The LuCI app treats self-hosted and cloud setups identically — all features including peer status, firewall zones, and WireGuard configuration work the same way.
How do I set up the NetBird firewall on OpenWrt?
Go to the Network tab in the LuCI app, click
Create Firewall Zone, then enable
LAN → NetBird to let your local devices reach the mesh,
or NetBird → LAN to let mesh peers reach your local network.
You can toggle either direction independently. The optional
conntrack package improves connection tracking for forwarded traffic.
Can I use NetBird with WireGuard on OpenWrt?
Yes — NetBird uses WireGuard as its underlying tunnel protocol, and it coexists with your existing WireGuard tunnels. Because the interface (device) name and listen port are configurable under Services → NetBird → Settings — along with MTU and persistent keepalive — NetBird won't conflict with other WireGuard instances on the same router. You can also configure routes, DNS, IPv6, and Rosenpass (post-quantum resistant WireGuard) from the same tab.
Which architectures does the NetBird OpenWrt package support?
The LuCI package itself is architecture-independent (PKGARCH:=all)
and works on x86_64, arm64, 386 (32-bit x86), and armv6. The underlying
netbird binary from the feed is architecture-specific and
available for all major OpenWrt targets. x86_64 is the most tested platform;
other architectures are supported but receive less testing.
How do I update the NetBird client on OpenWrt?
Use the Versions tab in the LuCI app (Services → NetBird → Versions). You can switch between the official release channel, the system package feed, or pin a specific version via custom URL, then download and switch with one click.
Will my settings survive an OpenWrt upgrade?
Yes. /etc/config/netbird is marked as a conffile, so your
authentication keys, Management URL, firewall settings, and all other
configuration are preserved across package upgrades. If you uninstall and
reinstall the package, however, you may need to reconfigure.
Downloads
Latest NetBird packages for OpenWrt —
architecture-independent, available as .ipk (24.10) and .apk (25+).
🔒 Signed feed — opkg: usign · apk: EC (prime256v1)