Why should you use Netmaker instead of manual configuration?
If you are managing a network for an office of 50 employees or a small datacenter cluster, WireGuard is undoubtedly the top choice due to its speed and lightweight nature. However, complications arise as soon as the number of devices (nodes) starts to increase.
Let’s do a simple calculation: With 20 servers, you have to create 20 Public/Private Key pairs and manually copy-paste each .conf configuration file. Every time you add a new node, you have to update the Peer list for the remaining 19 nodes. Just one missing comma, and the connection will be interrupted immediately. This is where Netmaker shines.
Netmaker acts as a centralized management layer (Control Plane). It doesn’t replace WireGuard but helps you control the network via a Web interface or REST API. Instead of laboriously configuring each machine, you just issue a command: “Connect machines A, B, and C into a Mesh network.” A small agent called netclient will automatically handle the rest.
Compared to Tailscale or ZeroTier, Netmaker allows you to be in full control of your system (Self-hosted). All data passes through private channels, independent of third-party servers. This is extremely important if you are running a Lab or deploying for enterprises that prioritize absolute security.
Deploying Netmaker Server
To get started, prepare a Linux VPS (Ubuntu 22.04 recommended) with a static IP. You also need a domain name to point 3 A records for the subdomains: dashboard, api, and broker.
1. Minimum Hardware Requirements
- CPU: 2 Cores.
- RAM: 2GB (increase if managing over 100 nodes).
- OS: Ubuntu 20.04 or 22.04.
- Tools: Docker and Docker Compose.
2. Quick Installation via Script
Instead of setting up each container individually, I usually use an automated script to save 15-20 minutes of configuration. Run the following command:
wget -qO - https://raw.githubusercontent.com/gravitl/netmaker/master/scripts/nm-quick.sh | bashThe script will prompt you to enter your main domain (e.g., itfromzero.com). The system will automatically register free SSL certificates from Let’s Encrypt for the relevant subdomains. Once completed, save the admin information displayed on the screen.
3. Checking System Status
Use the docker ps command to ensure the 4 core components are running: netmaker (main server), netmaker-ui (interface), mosquitto (MQTT broker), and coredns. If all are in the “Up” state, you’re halfway there.
Setting Up a Real-World Mesh Network
Log in to the Dashboard; the first thing to do is create a shared network space.
Step 1: Initialize the Network
Go to Networks -> Create Network. Name it office-mesh and choose an internal IP range, for example, 10.10.10.0/24. Click Create to be ready to accept clients.
Step 2: Connecting Nodes using Netclient
This is where the real value lies. You don’t need to touch the WireGuard config files. On the Dashboard, create an Enrollment Key, then copy the installation command:
curl -sL https://raw.githubusercontent.com/gravitl/netmaker/master/scripts/netclient-install.sh | sudo bash -s -- -t <YOUR_TOKEN>When executed, netclient will automatically install WireGuard, generate the Key pair, and register the Public Key with the server. It only takes about 10 seconds for a new machine to join the Mesh network.
Step 3: Configuring Egress Gateway
Suppose you want VPN machines to access a printer or NAS within the office LAN range (192.168.1.0/24). Netmaker supports the Egress Gateway feature to solve this.
Simply select a node located at the office, enable Egress, and enter that internal IP range. Immediately, all machines in the Mesh network will “see” the office LAN without needing complex routing configurations.
Monitoring and Automation
The network is running, but how do you know if it’s stable?
1. Checking Connections
On the workstation, the sudo netclient list command will show you the current connection status. To see detailed actual data traffic, use the familiar sudo wg show command.
2. Automating with REST API
If you want to integrate into a CI/CD system or automate permission granting, Netmaker provides a powerful API. Here is a short Python code snippet to check which nodes are online:
import requests
API_KEY = "your_secret_admin_key"
URL = "https://api.itfromzero.com/api/nodes"
headers = {"Authorization": f"Bearer {API_KEY}"}
response = requests.get(URL, headers=headers)
for node in response.json():
status = "Online" if node['is_active'] else "Offline"
print(f"Node: {node['name']} - IP: {node['address']} - [{status}]")Hard-learned Lessons during Deployment
After running into several obstacles while deploying Netmaker, I have a few important notes for you:
- Open UDP Ports: WireGuard uses UDP. Make sure you have opened ports 51821-51830 on the Firewall. If these ports are blocked, nodes will see each other but will never be able to ping successfully.
- MTU Issues: If you can ping but cannot load websites, try reducing the MTU to 1280. This is a classic issue when running VPNs over connections with high overhead.
- Data Backup: Always backup the
/root/netmakerdirectory. If the SQLite database gets corrupted, you will have to reinstall netclient for the entire system from scratch – a scenario no one wants.
Netmaker has truly transformed VPN management from a tedious manual task into a smooth automated process. It preserves the speed of WireGuard while completely eliminating configuration complexity. Good luck building your Mesh network!
