A NetBird user case describes building a WireGuard-based private network by installing clients and signing in on each device. Relays maintain access when direct connections are unavailable, including behind CGNAT. A reverse proxy can expose public services, but TCP and UDP services do not inherit the web proxy’s SSO or PIN protection. Cloud control-plane outages and relay latency remain trade-offs. Self-hosting offers more control but requires a public server, a domain and responsibility for operating the infrastructure.