Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NetMaker: Connect Everything with a WireGuard VPN

netmaker.io

Post reply on HN
Print view View original

111–120 of 172 posts

Re: NetMaker: Connect Everything with a WireGuard VPN

#111

Post by afeiszli »

joeframbach wrote: post #19

A pain point I still haven't resolved with WG is this. From my phone, I want to access my homelab through the WG server at home, but everything else through an external WG VPN somewhere else. My homelab ip range is 10.10.0.0/24 or whatever, but the external VPN is some other range. Wireguard doesn't seem to like this. The alternative is to route my phone to home for 100% of traffic, and my home router would egress th…

Netmaker may help with this. You configure an "Egress Gateway" to 0.0.0.0/0 as your internet VPN, inside of a Netmaker network of 10.10.0.0/24. We do our routing rules differently and it is meant to be compatible. However, I'm a bit surprised you have this issue with regular WireGuard, as it tends to be quite stable for this sort of setup in my experience.

Re: NetMaker: Connect Everything with a WireGuard VPN

#112

Post by afeiszli »

irjustin wrote: post #22

I've been using Netmaker for a few months now and it is incredible. Bastion VPN management for all our enviornments. The only thing we havne't gotten to work is full 0.0.0.0 forwarding. Docs say it's possible (tho not fully common use case), but we always get hangs when attempting. Usually we have to use sshuttle Other than that - incredible.

Thanks for the feedback. Just wondering, with 0.0.0.0, are you accessing using "external clients" or the regular netclient?

Re: NetMaker: Connect Everything with a WireGuard VPN

#113

Post by afeiszli »

FabHK wrote: post #17

First question I have: On what devices/OSs is it supported? The only resource I find is this: https://docs.netmaker.io/architecture.html#compatible-system... No mobile, no NAS yet?

NAS should work if it's linux or freebsd based. For mobile you (currently) have to use our "client gateway", which accesses the network just using a regular WireGuard config file, which you can scan from the Netmaker UI using the WireGuard app on your phone. But it works well. However, we've got a mobile app in the works.

Re: NetMaker: Connect Everything with a WireGuard VPN

#114

Post by SOLAR_FIELDS »

irjustin wrote: post #22

I've been using Netmaker for a few months now and it is incredible. Bastion VPN management for all our enviornments. The only thing we havne't gotten to work is full 0.0.0.0 forwarding. Docs say it's possible (tho not fully common use case), but we always get hangs when attempting. Usually we have to use sshuttle Other than that - incredible.

Curious what other people’s setups are with the server hosting. Do you expose Netmaker bastion to the public Internet for all your VPC, where the bastion lives outside the VPC? That’s what they recommended to me when I set mine up but I also explored putting my bastion inside my VPC and exposing it to the internet

Re: NetMaker: Connect Everything with a WireGuard VPN

#115

Post by afeiszli »

hackermeows wrote: post #5

Why is this better than running wireguard directly on a cheap instance .

Netmaker guy here, and I'll be the first to tell you that if you have a static setup of, let's say 5 machines or less, then there's no need for something as complex as Netmaker. It's really useful for people who have many machines, or machines that will move around dynamically. Or, if you need to route traffic through a NAT gateway. A static setup is fine for technical people and small networks, it's just not scalable. As an analogy, you wouldn't run Kubernetes if you just need to deploy 3 docker containers, but as the complexity grows, you need a management system.

Re: NetMaker: Connect Everything with a WireGuard VPN

#117

Post by SOLAR_FIELDS »

javitury wrote: post #46

For the particular case of creating a wireguard mesh network in kubernetes, I've been quite happy with Kilo[0]. Does anyone with experience in both kilo and netmaker know how they compare? [0]: https://kilo.squat.ai/

I remember looking at both and deciding on Netmaker at the time. Netmaker should be able to do a strict superset of what kilo does. I was able to get Netmaker running on Kubernetes by injecting the client onto each node via a daemonset.

Re: NetMaker: Connect Everything with a WireGuard VPN

#118

Post by afeiszli »

javitury wrote: post #46

For the particular case of creating a wireguard mesh network in kubernetes, I've been quite happy with Kilo[0]. Does anyone with experience in both kilo and netmaker know how they compare? [0]: https://kilo.squat.ai/

Kilo is cool! And works. It will be similar, just sort of depends on what you're comfortable with and what sort of management features you need. Some people like a UI where they can see all their nodes and troubleshoot without having to SSH, which is a primary advantage, but Kilo is probably better for smaller setups that are purely for Kubernetes.

Re: NetMaker: Connect Everything with a WireGuard VPN

#119

Post by GhostWhisperer »

yeck wrote: post #104
GhostWhisperer wrote: post #66

Earlier quoted context omitted.

i use fireguard through tailscale to access multiple machines over ssh, with their setup i was able to reduce exposure as i no longer need to open a port on the router tailscale does this with their DERP servers i doubt netmaker doesn't have an alternative to connect machines behind nat routers; that would be a serious disadvantage for soho setups

Is "fireguard" a typo or a distinct thing?

typo, thanks for pointing it out

Re: NetMaker: Connect Everything with a WireGuard VPN

#120

Post by hwillis »

afeiszli wrote: post #103
ignoramous wrote: post #70

Earlier quoted context omitted.

> Docs are written for self-hosters. These are all good signs. Except at the time of writing, netmaker isn't FOSS: https://github.com/gravitl/netmaker/blob/16d5b5807/LICENSE.t...

Hi! Netmaker here. At the time of this writing this is true, but we're making some licensing changes this sprint, which I think will make people very happy. We started with SSPL just because it's much easier to go from more restrictive to less restrictive, as opposed to the alternative. However, several months ago we moved all of the client-side code to Apache-2.0, and are about to make the server-side code FOSS-comp…

That's awesome! Glad it's a priority.
Post reply on HN