Netmaker makes networks with WireGuard. Netmaker automates fast, secure, and distributed virtual networks.
Find a file
Abhishek K 307a3d1e4b
NET-1932: Merge egress and internet gateways (#3436)
* feat: api access tokens

* revoke all user tokens

* redefine access token api routes, add auto egress option to enrollment keys

* add server settings apis, add db table for settigs

* handle server settings updates

* switch to using settings from DB

* fix sever settings migration

* revet force migration for settings

* fix server settings database write

* egress model

* fix revoked tokens to be unauthorized

* update egress model

* remove unused functions

* convert access token to sql schema

* switch access token to sql schema

* fix merge conflicts

* fix server settings types

* bypass basic auth setting for super admin

* add TODO comment

* setup api handlers for egress revamp

* use single DB, fix update nat boolean field

* extend validaiton checks for egress ranges

* add migration to convert to new egress model

* fix panic interface conversion

* publish peer update on settings update

* revoke token generated by an user

* add user token creation restriction by user role

* add forbidden check for access token creation

* revoke user token when group or role is changed

* add default group to admin users on update

* chore(go): import style changes from migration branch;

1. Singular file names for table schema.
2. No table name method.
3. Use .Model instead of .Table.
4. No unnecessary tagging.

* remove nat check on egress gateway request

* Revert "remove nat check on egress gateway request"

This reverts commit 0aff12a189.

* remove nat check on egress gateway request

* feat(go): add db middleware;

* feat(go): restore method;

* feat(go): add user access token schema;

* add inet gw status to egress model

* fetch node ids in the tag, add inet gw info clients

* add inet gw info to node from egress list

* add migration logic internet gws

* create default acl policies

* add egress info

* add egress TODO

* add egress TODO

* fix user auth api:

* add reference id to acl policy

* add egress response from DB

* publish peer update on egress changes

* re initalise oauth and email config

* set verbosity

* normalise cidr on egress req

* add egress id to acl group

* change acls to use egress id

* resolve merge conflicts

* fix egress reference errors

* move egress model to schema

* add api context to DB

* sync auto update settings with hosts

* sync auto update settings with hosts

* check acl for egress node

* check for egress policy in the acl dst groups

* fix acl rules for egress policies with new models

* add status to egress model

* fix inet node func

* mask secret and convert jwt duration to minutes

* enable egress policies on creation

* convert jwt duration to minutes

* add relevant ranges to inet egress

* skip non active egress routes

* resolve merge conflicts

* fix static check

* update gorm tag for primary key on egress model

* create user policies for egress resources

* resolve merge conflicts

* get egress info on failover apis, add egress src validation for inet gws

* add additional validation checks on egress req

* add additional validation checks on egress req

* skip all resources for inet policy

* delete associated egress acl policies

* fix failover of inetclient

* avoid setting inet client asd inet gw

* fix all resource egress policy

* fix inet gw egress rule

* check for node egress on relay req

* fix egress acl rules comms

* add new field for egress info on node

* check acl policy in failover ctx

* avoid default host to be set as inet client

* fix relayed egress node

* add valid error messaging for egress validate func

* return if inet default host

* jump port detection to 51821

* check host ports on pull

* check user access gws via acls

* add validation check for default host and failover for inet clients

* add error messaging for acl policy check

* fix inet gw status

* ignore failover req for peer using inet gw

* check for allowed egress ranges for a peer

* add egress routes to static nodes by access

* avoid setting failvoer as inet client

* fix egress error messaging

* fix extclients egress comms

* fix inet gw acting as inet client

* return formatted error on update acl validation

* add default route for static nodes on inetclient

* check relay node acting as inetclient

* move inet node info to separate field, fix all resouces policy

* remove debug logs

---------

Co-authored-by: Vishal Dalwadi <dalwadivishal26@gmail.com>
2025-05-21 12:50:21 +05:30
.github Bump dawidd6/action-download-artifact from 8 to 9 (#3355) 2025-04-30 02:39:00 +04:00
auth NET-1932: Merge egress and internet gateways (#3436) 2025-05-21 12:50:21 +05:30
cli Merge pull request #3441 from gravitl/nmctl-access-token 2025-05-20 09:16:24 +05:30
compose update release versions (#3387) 2025-03-25 11:08:54 +04:00
config NET-1950: Persist Server Settings in the DB (#3419) 2025-04-30 02:34:10 +04:00
controllers NET-1932: Merge egress and internet gateways (#3436) 2025-05-21 12:50:21 +05:30
database NET-1950: Persist Server Settings in the DB (#3419) 2025-04-30 02:34:10 +04:00
db add ctx to DB funcs (#3435) 2025-04-29 00:22:02 +04:00
docker Simplify and unify apk usage in Dockerfiles (#3407) 2025-04-30 02:55:34 +04:00
docs fix: update documentation links to new docs (#3156) 2024-10-17 14:35:36 +04:00
functions NET-1227: User Mgmt V2 (#3055) 2024-08-20 17:08:56 +05:30
k8s update release versions (#3387) 2025-03-25 11:08:54 +04:00
logger ee license check 2023-04-12 10:45:06 -04:00
logic NET-1932: Merge egress and internet gateways (#3436) 2025-05-21 12:50:21 +05:30
migrate NET-1932: Merge egress and internet gateways (#3436) 2025-05-21 12:50:21 +05:30
models NET-1932: Merge egress and internet gateways (#3436) 2025-05-21 12:50:21 +05:30
mq NET-1950: Persist Server Settings in the DB (#3419) 2025-04-30 02:34:10 +04:00
netclient/ncutils load all nodes into cache 2024-11-27 14:56:24 +04:00
nginx remove references to grpc/comms net 2022-04-21 15:53:44 -04:00
pro NET-1932: Merge egress and internet gateways (#3436) 2025-05-21 12:50:21 +05:30
schema NET-1932: Merge egress and internet gateways (#3436) 2025-05-21 12:50:21 +05:30
scripts udpate ip service 2025-04-01 10:04:57 +04:00
servercfg NET-1950: Persist Server Settings in the DB (#3419) 2025-04-30 02:34:10 +04:00
serverctl NET-1933: option to force destroy network (#3311) 2025-02-03 15:19:44 +04:00
test remove agentbackend 2023-02-20 02:22:48 -07:00
tls initial changes to make cert <-> broker comms work 2022-07-05 15:04:45 -04:00
utils feat: send gateway dns and private address (#3378) 2025-03-18 13:26:29 +04:00
validation merge conflicts resolved 2022-09-26 17:47:20 +05:30
.dockerignore NET-163: Return 403 instead of 401 (#2326) 2023-05-25 09:40:39 -04:00
.fpm add rpms 2022-03-09 15:28:39 -05:00
.gitignore docs(NET-953): update docs spec, gitignore (#2880) 2024-04-09 11:52:00 +05:30
.goreleaser.prerelease.yaml Net 792 remove freebsd (#2735) 2024-01-16 20:19:08 +05:30
.goreleaser.update.yaml cleanup 2023-02-25 08:03:16 -05:00
.goreleaser.yaml Net 792 remove freebsd (#2735) 2024-01-16 20:19:08 +05:30
.swaggo add format int64 for swagger doc (#3247) 2024-12-12 09:52:52 +04:00
CONTRIBUTING.md Create CONTRIBUTING.md 2022-01-20 08:19:23 -05:00
dev.yaml remove grpc parameters 2023-02-20 09:09:26 -07:00
Dockerfile Simplify and unify apk usage in Dockerfiles (#3407) 2025-04-30 02:55:34 +04:00
Dockerfile-quick Simplify and unify apk usage in Dockerfiles (#3407) 2025-04-30 02:55:34 +04:00
go.mod NET-1932: Merge egress and internet gateways (#3436) 2025-05-21 12:50:21 +05:30
go.sum NET-1932: Merge egress and internet gateways (#3436) 2025-05-21 12:50:21 +05:30
LICENSE.md Change License To Apache (#2597) 2023-09-21 08:26:11 -04:00
main.go NET-2000: Api access tokens (#3418) 2025-04-23 20:21:42 +04:00
main_ee.go NET-1778: scale test code changes (#3203) 2024-12-10 10:15:31 +04:00
README.md update release versions (#3387) 2025-03-25 11:08:54 +04:00
release.md update release versions (#3387) 2025-03-25 11:08:54 +04:00
SECURITY.md Update SECURITY.md 2022-11-02 09:10:50 -04:00
swagger.yaml Update documentation 2025-04-02 15:19:06 2025-04-02 15:19:07 +00:00

ROSS Index - Fastest Growing Open-Source Startups | Runa Capital Y-Combinator

WireGuard® automation from homelab to enterprise

Create Manage Automate
✔️ WireGuard Networks ✔️ Admin UI ✔️ Linux
✔️ Remote Access Gateways ✔️ OAuth ✔️ Docker
✔️ Mesh VPNs ✔️ Private DNS ✔️ Mac
✔️ Site-to-Site ✔️ Access Control Lists ✔️ Windows

Try Netmaker SaaS

If you're looking for a managed service, you can get started with just a few clicks, visit netmaker.io to create your netmaker server.

Self-Hosted Open Source Quick Start

These are the instructions for deploying a Netmaker server on your cloud VM as quickly as possible. For more detailed instructions, visit the Install Docs.

  1. Get a cloud VM with Ubuntu 24.04 and a static public IP.
  2. Allow inbound traffic on port 443,51821 TCP and UDP to the VM firewall in cloud security settings, and for simplicity, allow outbound on All TCP and All UDP.
  3. (recommended) Prepare DNS - Set a wildcard subdomain in your DNS settings for Netmaker, e.g. *.netmaker.example.com, which points to your VM's public IP.
  4. Run the script to setup open source version of Netmaker:

sudo wget -qO /root/nm-quick.sh https://raw.githubusercontent.com/gravitl/netmaker/master/scripts/nm-quick.sh && sudo chmod +x /root/nm-quick.sh && sudo /root/nm-quick.sh

To Install Self-Hosted PRO Version - https://docs.netmaker.io/docs/server-installation/netmaker-professional-setup

After installing Netmaker, check out the Walkthrough and Getting Started guides to learn more about configuring networks. Or, check out some of our other Tutorials for different use cases, including Kubernetes.

Get Support

Why Netmaker + WireGuard?

  • Netmaker automates virtual networks between data centres, clouds, and edge devices, so you don't have to.

  • Kernel WireGuard offers maximum speed, performance, and security.

  • Netmaker is built to scale from small businesses to enterprises.

  • Netmaker with WireGuard can be highly customized for peer-to-peer, site-to-site, Kubernetes, and more.

Community Projects

Disclaimer

WireGuard is a registered trademark of Jason A. Donenfeld.

License

Netmaker's source code and all artifacts in this repository are freely available. All content that resides under the "pro/" directory of this repository, if that directory exists, is licensed under the license defined in "pro/LICENSE". All third party components incorporated into the Netmaker Software are licensed under the original license provided by the owner of the applicable component. Content outside of the above mentioned directories or restrictions above is available under the "Apache Version 2.0" license as defined below. All details for the licenses used can be found here: LICENSE.md.