Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NetMaker: Connect Everything with a WireGuard VPN

netmaker.io

Post reply on HN
Print view View original

101–110 of 172 posts

Re: NetMaker: Connect Everything with a WireGuard VPN

#101

Post by joeframbach »

rudasn wrote: post #37
joeframbach wrote: post #19

A pain point I still haven't resolved with WG is this. From my phone, I want to access my homelab through the WG server at home, but everything else through an external WG VPN somewhere else. My homelab ip range is 10.10.0.0/24 or whatever, but the external VPN is some other range. Wireguard doesn't seem to like this. The alternative is to route my phone to home for 100% of traffic, and my home router would egress th…

What's your setup right now? A single wg interface/config on your phone, with two peers, one for home wg and one for remote vpn, with AllowedIPs on the home peer as 10.10.0.0/24 and AllowedIPs on the remote vpn peer as 0.0.0.0/24? Have you tried excluding the cidr of your home wg from the AllowedIPs of the remote vpn? Like not having 0.0.0.0/24, but one or more entries that end up excluding local cidrs.

The external VPN provider dictates what my interface's IP range is. I generated a new WG config using the UI, and it comes with interface IP 10.66.123.123/32. If I want my home ip to be 10.10.0.2/32, then I'll have to set it as 10.0.0.0/8, and the VPN provider didn't seem to agree with that.

I have two wg interfaces and I manually switch between them.

Re: NetMaker: Connect Everything with a WireGuard VPN

#103

Post by afeiszli »

ignoramous wrote: post #70
minimalist wrote: post #7

Related, from earlier this year: https://news.ycombinator.com/item?id=35584533 Wherein the author compares Yggdrasil, tinc, Tailscale, Zerotier, Netmaker, Nebula, and ends up prefering Yggdrasil. Actually, it was this comparison that made me look into Netmaker and prefer it and I've been running it without issue for experimentation. I hope the author revisits NM. I agree that the project is moving quickly, which resu…

> Docs are written for self-hosters. These are all good signs. Except at the time of writing, netmaker isn't FOSS: https://github.com/gravitl/netmaker/blob/16d5b5807/LICENSE.t...

Hi! Netmaker here. At the time of this writing this is true, but we're making some licensing changes this sprint, which I think will make people very happy. We started with SSPL just because it's much easier to go from more restrictive to less restrictive, as opposed to the alternative.

However, several months ago we moved all of the client-side code to Apache-2.0, and are about to make the server-side code FOSS-compatible.

Re: NetMaker: Connect Everything with a WireGuard VPN

#104

Post by yeck »

GhostWhisperer wrote: post #66
darthrupert wrote: post #63

Earlier quoted context omitted.

Wireguard requires an open UDP port, by default 51820. NetMaker, at least based on the quick install manual, asks you to open up the following: - 443, 80 (tcp) - 3479, 8089 (TURN, TURN api) - 8085 (exporter EE) - 1883, 8883, 8033, 18083 (if using EMQX) But perhaps none of these are required for actual WAN/Wireguard connections and one needs only limited access to these ports in order to configure the software.

i use fireguard through tailscale to access multiple machines over ssh, with their setup i was able to reduce exposure as i no longer need to open a port on the router tailscale does this with their DERP servers i doubt netmaker doesn't have an alternative to connect machines behind nat routers; that would be a serious disadvantage for soho setups

Is "fireguard" a typo or a distinct thing?

Re: NetMaker: Connect Everything with a WireGuard VPN

#105

Post by xpe »

ranting-moth wrote: post #102

Personally I find the landing page confusing. Some marketing text and I don't understand why this is better than just vanilla wireguard?

First, I get that the landing page didn't answer your questions. Building the right "first" page for the right customer... that's a potential opportunity in of itself!

Second, did you find https://docs.netmaker.io/about.html ? It might help.

Re: NetMaker: Connect Everything with a WireGuard VPN

#106

Post by SOLAR_FIELDS »

ignoramous wrote: post #71
GhostWhisperer wrote: post #15

Earlier quoted context omitted.

1. thanks for linking that 2. the comparison: - protocol: wireguard is now baseline - speed: netmaker is faster because it uses kernel wg - this is not going to hold true for all system configurations, certainly doesn't for macos - flexibility: feels like it does the same as tailscale, marketed slightly different as they list common use-cases – egress and ingress gateways; network shaping with acls is also possible i…

> - speed: netmaker is faster because it uses kernel wg - this is not going to hold true for all system configurations, certainly doesn't for macos Unless something changed super recently, tailscale (per their own claims) are faster than (linux) kernel wg: https://tailscale.com/blog/throughput-improvements/ Surprisingly, we improved the performance of wireguard-go (running in userspace) enough to make it faster than…

Huh, would be interesting to see some non-tailscale benchmarks of this. Assuming the kernel impl is actually optimized it should be theoretically impossible to exceed the performance with userland wg?

Re: NetMaker: Connect Everything with a WireGuard VPN

#107

Post by afeiszli »

jeroenhd wrote: post #2

The feature list reminded me of Tailscale so I went looking and found this on their website: https://www.netmaker.io/resources/tailscale-vs-zerotier Their comparison graph at the bottom seems to indicate that the differentiating features between their product and Tailscale is that you can't self-host (ignoring the existence of headscale) and that WireGuard support is limited. I believe the latter point refers to the…

Hi, worth noting another point on this. Netmaker has "Client Gateways", which allow you to generate and modify raw WireGuard config files. This is extremely useful for integrating custom WireGuard setups. For instance, generate a config file, modify it, put it on a router, and boom, site-to-site. https://www.netmaker.io/features/ingress

Re: NetMaker: Connect Everything with a WireGuard VPN

#108

Post by afeiszli »

ranting-moth wrote: post #102

Personally I find the landing page confusing. Some marketing text and I don't understand why this is better than just vanilla wireguard?

You might find the github or docs more helpful, which are more geared to a technical audience: - https://github.com/gravitl/netmaker - https://docs.netmaker.io/

Re: NetMaker: Connect Everything with a WireGuard VPN

#109

Post by nusak »

latchkey wrote: post #3

Digging through their repo on github... I'm really disappointed at the lack of `_test.go` files. This is a security product, I'd be terrified something bad could happen.

the majority of testing is done with integration tests which are in a different repo

Re: NetMaker: Connect Everything with a WireGuard VPN

#110

Post by SOLAR_FIELDS »

ranting-moth wrote: post #102

Personally I find the landing page confusing. Some marketing text and I don't understand why this is better than just vanilla wireguard?

You can think of Netmaker as essentially a mesh network configuration manager that uses Wireguard under the hood to create the mesh network. It’s easy enough to connect two machines with wg. But when you need to manage fleets of them, you need something that automates discovery, onboarding and off boarding of machines, etc

(Not associated with Netmaker at all, that’s just my interpretation from using their offering for awhile)

Post reply on HN