Netmaker - A powerful, open source, self hosted, GUI for setting up Wireguard networks and VPNs.

Поділитися
Вставка
  • Опубліковано 26 сер 2024

КОМЕНТАРІ • 118

  • @i-am-you-tube
    @i-am-you-tube Рік тому +5

    BIG THANKS Brian, for all your hard work and clear explanations you have in your video's. Very much appreciated!! Keep up the good work and stay safe my friend. Greetings from The Netherlands

  • @pedroporrasmedina
    @pedroporrasmedina Рік тому +2

    That should amazing, I'm actually running pfsense but I can use Netmaker as an alternative to manage my VPN access outside of the pfsense box to have better distribution and also can always have access to my network also if the pfsense services go down preparing an LTE connection.

    • @AwesomeOpenSource
      @AwesomeOpenSource  Рік тому

      Absolutely, just what I'm doing as a backup to my other VPN option for a client now.

  • @codester_d
    @codester_d Рік тому +2

    Great video! Been using this service for a while and it’s been amazing.

  • @nicoladellino8124
    @nicoladellino8124 Рік тому +4

    Nice product and video, TNX.

  • @heaton922
    @heaton922 Рік тому +3

    netmaker is very powerful, thanks for share

    • @AwesomeOpenSource
      @AwesomeOpenSource  Рік тому

      You are welcome! It is some truly Awesome Open Source softwrae.

  • @Archerstidbits
    @Archerstidbits 10 місяців тому +1

    superb video! I've been following it and only ran into one issue using your blog. The x to make the script executable is a capital, when it should be a lowercase x. Took me a while to find why it was not working :-). Please keep making these!

    • @AwesomeOpenSource
      @AwesomeOpenSource  10 місяців тому

      Sorry for that, and thanks for letting me know, I'll go fix it.

    • @Archerstidbits
      @Archerstidbits 10 місяців тому

      @@AwesomeOpenSource np, it was not meant as a criticism, just helping other people along🙏

  • @kson2659
    @kson2659 Рік тому +1

    Thanks a lot for this! pro tip: Use Ctrl+L to clear your console :)

  • @Glatze603
    @Glatze603 Рік тому +2

    Thanks for this video and this nice wireguard-application! I'll try it out more in the next few days!

    • @Glatze603
      @Glatze603 Рік тому +1

      It's just a pity that security functions such as 2FA can only be used in the Enterprise version - not even for the admin login. A clear devaluation of the free version

    • @AwesomeOpenSource
      @AwesomeOpenSource  Рік тому

      It's really great stuff.

    • @AwesomeOpenSource
      @AwesomeOpenSource  Рік тому

      I understand your viewpoint, but also understand the need to support the project. I know Alex is just starting with the Pro idea, so he may be open to suggestions on ways you think he could better monetize. Separating out an option for 2FA in a separate plan or something.

    • @Glatze603
      @Glatze603 Рік тому +1

      @@AwesomeOpenSource It is ok to move multiple features to a cost plan, but when someone uses such a solution, security is high priority, so moving 2fa out to the costs plan is not only a bad idea, it makes such a tool less secure and therefore not realy useful, regardless the good stuff. I do not want to use any application on a cloud server without multi factor > totp or yubiky.

    • @AwesomeOpenSource
      @AwesomeOpenSource  Рік тому +1

      I completely understand where you are coming from. I have found Alex (the project owner) to be a super understanding and good guy. I highly recommend you reach out and have a conversation about your concerns. Maybe he'll put that into the free offering. It never hurts to ask.

  • @ninja2807
    @ninja2807 Рік тому +9

    Great video as always... Thanks!!!
    I just got a bit lost with the "egress" and "ingress" concepts, perhaps a diagram would help for better understanding.
    Would be possible to have the server deployed in the home network and external clients like family phones connect in (like as using openvpn)?

    • @AwesomeOpenSource
      @AwesomeOpenSource  Рік тому +2

      Yeah. Ingress is a route into the wireguard network from an external client (one not using the netclient form netmaker), and egress is a point inside your network where you allow traffic to leave the wireguard network and access other machines on your LAN. Running the server inside your home network is possible, but it's best to have a static public IP, and you will have to open ports on your home firewall, so not an ideal setup IMO.

    • @ninja2807
      @ninja2807 Рік тому +1

      @@AwesomeOpenSource Thank you for the explanation.

  • @Mr.clemclem
    @Mr.clemclem Рік тому +3

    This is... 🤯 AWESOME...

  • @ArifKamaruzaman
    @ArifKamaruzaman Рік тому +3

    ahaha. I was looking for something like this. Thank you for the video.

  • @raul230285
    @raul230285 Рік тому +1

    Hi Bryan, could you make a video of headscale is a fork of tailscale. Thank you very much for your valuable time.

  • @ElliotWeishaar
    @ElliotWeishaar Рік тому +5

    Great video! My ISP is one of the major wireless carriers, so I'm stuck behind a CG-NAT (double NAT). I currently have a peer to peer wireguard setup that peers with a VPS so that I can bypass the CG-NAT and host web services locally. In order to accomplish this I got really lucky and I was able to get some iptables rules from the self hosting community that allows me to forward all traffic on port 80 and 443 to my internal server. This solution has worked, but it's all manual and difficult to scale. In your opinion, do you think I'd be able to replace my current setup with Netmaker? It looks like I should be able to just create the server on the VPS, and then the netclient on my internal device, and just pass thru all traffic on 80 and 443?

    • @AwesomeOpenSource
      @AwesomeOpenSource  Рік тому +1

      Yep, it should work. You'd set your internal client as an egress gateway, and your main server (VPS) as the ingress, and you should be set to go.

  • @pedroalcaraz9596
    @pedroalcaraz9596 Рік тому +1

    works perfectly, thank you

  • @CarlosJOlivQ
    @CarlosJOlivQ Рік тому +4

    This really looks great. One question.
    What IP appears to be sending the requests with the Site to site configuration?
    I'm trying to expose some self hosted appliances that require quite a lot of ports and are commonly being targeted by bots trying to guess passwords. When using WG it appears to the server on the LAN that the request is coming from the VPN tunnel instead of an Internet IP which makes it immpossible to ban.
    I'm using the VPS to get a public IP because the servers are behind CGNAT and there is no way the ISP provides me with an static IP.

    • @AwesomeOpenSource
      @AwesomeOpenSource  Рік тому +2

      It will still appear to be from the server IP. I have a follow up video on using Netmaker with NginX Proxy Manager to do reverse proxying in this way, and you should be able to use ACLs to help slow that down a bit. Note, the video is coming out soon, not out yet.

    • @CarlosJOlivQ
      @CarlosJOlivQ Рік тому +1

      @@AwesomeOpenSource I really appreciate that. It is drivin slightly nuts trying to figure that. Specially because the servers main workloads are for Internal LAN and I can't just move them to a cloud service.

  • @nitinrai6093
    @nitinrai6093 2 місяці тому +1

    what happens if i have egress on two different nodes with same ip range ?

    • @AwesomeOpenSource
      @AwesomeOpenSource  2 місяці тому

      In the same network, no issue. On different networks..you should change the range on one of them to avoid issues I imagine.

  • @user-vu3wn7ed1i
    @user-vu3wn7ed1i Рік тому

    so hard to install this app
    i try following your steps one by one and i found in netmaker the quick install steps are changed
    can you please re install app again with the quick install on netmaker

  • @mazhar1986
    @mazhar1986 6 місяців тому +1

    Is there any open source for rds terminal server for publishing thick client application as remote app.

    • @AwesomeOpenSource
      @AwesomeOpenSource  6 місяців тому

      Nothing that I've found. I think you could do SSH forwarding, but not really the same. I think the rds terminal server allows you to install an application and make it available to multiple users at once.

  • @Excited-IT-Architect
    @Excited-IT-Architect Рік тому +4

    Thank you so much for this great video! What if we'd set up the netmaker server not in the cloud, but in our own homelab (e.g. behind an nginx reverse proxy which is also hosted at home? If that would be possible and wouldn't that be worth another great video?

    • @AwesomeOpenSource
      @AwesomeOpenSource  Рік тому +1

      Let me see what I can do. It would require port forwarding, so I was trying to show some options to not open ports, but still serve things up more securely, but i can see the benefit of having this type of setup as well. Great suggestion.

    • @newcart1
      @newcart1 Рік тому +1

      That's what I'm currently trying to do, but I keep getting an iptables fatal error when I try to spin up the netmaker installer and I'm just, I'm just tired and I have no idea what to do anymore

  • @BasePointer
    @BasePointer 2 місяці тому

    why don't you open yml file with nano and change whatever required at once?? really bizarre

  • @MdMozammelHossain
    @MdMozammelHossain 11 місяців тому +1

    does WireGuard has Linux client UI like that ? its look like a windows app, also you seem to be running KDE. I'm not sure though.

    • @AwesomeOpenSource
      @AwesomeOpenSource  11 місяців тому

      Was probably running KDE when I made this video. Wireguard itself doesn't have GUIs for Linux, but there are several third party gui options out there on GitHub for it if you want it. I've made one, that I continue to work on, but it's really just for me. You're welcome to try it if you want. gitlab.com/bmcgonag/wg-gui

  • @MdMozammelHossain
    @MdMozammelHossain 7 місяців тому +1

    does netmaker's server dashboard is opensource too ?

  • @limabegum9102
    @limabegum9102 Рік тому +1

    New Netmaker yml file not working....

    • @AwesomeOpenSource
      @AwesomeOpenSource  Рік тому

      Definitely go get their file It is much more likely to work as the video ages. Concepts are still the same.

  • @idriskautsar757
    @idriskautsar757 Рік тому +1

    ingrees and egrees same like route the network yes ?

    • @AwesomeOpenSource
      @AwesomeOpenSource  Рік тому

      Yes. Ingress to the network, and egress out to another network.

  • @MarkConstable
    @MarkConstable Рік тому +3

    Is it possible to set up the server side without using docker? Any hints how?

    • @ganon4
      @ganon4 Рік тому +1

      I don't have the time to take a look but if you have some, you can just check the docker image for the server side and use commands in your server instead of using the dockerfile

    • @AwesomeOpenSource
      @AwesomeOpenSource  Рік тому

      netmaker.readthedocs.io/en/v0.7.2/server-installation.html will give you the advanced installation instructions for Netmaker.

    • @MarkConstable
      @MarkConstable Рік тому

      @@AwesomeOpenSource Ah, thanks for the pointer to the docs. I'll try it out on a couple of x86 OpenWrt LXC containers.

    • @haydenc2742
      @haydenc2742 Рік тому +1

      docker would be optimal, especially since it can run internally on practically any linux distro due to the flexibility of docker

    • @MarkConstable
      @MarkConstable Рік тому +1

      @@haydenc2742 But it also hides how services really work and puts them behind an obfuscated layer of overlays that I have no control over. TO me, docker is far from optimal.

  • @jainayrogeorge2924
    @jainayrogeorge2924 11 місяців тому +1

    Hi @AwesomeOpenSource if i understand correctly you installed netmaker client also on the proxmox machine or else it would not be available to access right?

    • @AwesomeOpenSource
      @AwesomeOpenSource  11 місяців тому

      So, there are a few ways you can set things up. In my case, I installed the client as an exit node on the remote network in an LXC VM on the network. I was then able to access any machine on that remote network through the Wireguard Tunnel that Netmaker creates. Not sure if that help you or not.

    • @jainayrogeorge2924
      @jainayrogeorge2924 11 місяців тому +1

      @@AwesomeOpenSource yes it helped. That machine kinda.... became like your router for that network.

  • @Themahaaveer
    @Themahaaveer 6 місяців тому +1

    Shame it won't work with dynamic dns

    • @AwesomeOpenSource
      @AwesomeOpenSource  6 місяців тому

      I think you could replace Dynamic DNS with this running ona cheap VPS though.

  • @lightspeed79
    @lightspeed79 Рік тому +1

    When accesing the dashboard and creating an Admin, I am getting a could not reach server error...

    • @demanuDJ
      @demanuDJ Рік тому

      I had the same error, and I've gave up, its a one of the bugs in netmaker. It fixed after few restarts of docker, but then letsencrypt will ban you domain. I've tried to ask community but they doesn't know what is happening. Dont use it right now, Its still too bugy to use

    • @lightspeed79
      @lightspeed79 Рік тому +1

      @@demanuDJ Like you said it worked out of nowhere, then again as you say I think its too buggy still. I´m going for regular wireguard on ubuntu for now. Thanks for the feedback.

    • @AwesomeOpenSource
      @AwesomeOpenSource  Рік тому

      Sorry you guys are seeing these issues. I had no issues from the beginning. It would be helpful to go to the netmaker github and submit an issue ticket. They may ask you to pull some logs, but that's the only way to make software get better over time.

  • @Strawberriesshorts
    @Strawberriesshorts Рік тому +1

    Lengthy process to access a web server through the internet

    • @AwesomeOpenSource
      @AwesomeOpenSource  Рік тому

      Probably more just the video making it seem lengthy, it's really quite quick. I had a server up and running in about 5 minutes the other day. OF course, if you're comparing to using paid options, you pay them, download their config or client, and connect, so it's pretty ft, but if you want to self host it all, then it takes a bit more setup initially.

  • @CanopusInfinity
    @CanopusInfinity Рік тому +1

    Thank you for your excellent explanation. I installed and set up my Netmaker server using this video tutorial.
    Could you kindly guide me with a task I'm trying to achieve with Netmaker? I'm trying to connect a WireGuard server to another Wireugard server (which I will set up) and allow clients to connect to the primary server, but have their traffic go to the web through the second server and essentially access the internet through the second server. The first server will act as a tunneling method to just move the client traffic to the other network and let the client have the second server's IP address and internet connectivity.

    • @AwesomeOpenSource
      @AwesomeOpenSource  Рік тому +1

      I'd have to think about that a bit, but why the extra hop? Why not just connect the client to the server that will give internet access?

    • @CanopusInfinity
      @CanopusInfinity Рік тому

      @@AwesomeOpenSource Censorship is the main reason for the extra hop. Connecting directly to the internet is not possible in Iran, and all the ports and outbound traffic to the outside of the country has been impacted by censorship. However VPS servers within the country have much better access to the global internet and hence connecting to the local regional servers and tunneling to the outside will result in much better outcome.

    • @AwesomeOpenSource
      @AwesomeOpenSource  Рік тому

      I gotcha. Here's how I think you should try this. Install Netmaker on both VPS (Hop 1, in country), Hop 2 (out of country). Next, create a network in each. Add the netmaker client on each server, and setup the two servers as clients of each other, so Hop 2 is a client of Hop 1 server, and Hop 1 is a client of hop 2 server. Install the client on your local machine, and add it as a client of the Hop 1 server network. Now, limit hop 1 networks to the IP range of Hop1 and Hop2 only. So, your local client won't try to egress from hop1. Instead, make hope 1 as the client of hop 2, the ingress node of Hop 2 server, and see if when you try to reach a known site, you get the appropriate public IP address back.
      Mapped out, it's
      local client -- Hop 1 (ingress) -- Hop 2 -- internet. The routing on it may be a little weird, and may take some playing around. You could also ask over at the Netmaker discord channel.

  • @DamjanDimitrioski
    @DamjanDimitrioski Рік тому +1

    Hi, sorry for for off topic, but can you do a video on something alternative to: Dashy, Homer, Heimdail; that provides instead of web links to add bash scripts. For instance lets say you have custom way to reset the ssl certificates other needs + login.

    • @AwesomeOpenSource
      @AwesomeOpenSource  Рік тому

      Let me see what I can find. If you have something in mind, let me know.

    • @DamjanDimitrioski
      @DamjanDimitrioski Рік тому +1

      @@AwesomeOpenSource I think I got it, something like supervisord, but cooler UI + authorization system, if it looks like Dashy will be cool. I will try now to create a quick Django project that:
      - parses tasks conf files
      - checks task status
      - start/reload/stop/restart actions
      if it takes me 2 hours I will use that.
      And in the background I will use the rpc API of supervisord.
      My requirements are more like one time execute job, rather than to run the process as a daemon, but it will do I guess.

  • @djstraussp
    @djstraussp Рік тому +7

    Nice video. I've been using Wireguard as my main VPN (Self hosted) for a long time. But, there's a catch, ultimately I've noticed that WG leaks my IP, no matter what I do, the big G knows my local IP in every search or network use. This is not present when I use Cloud flare Warp or PIA vpn, it always throw a different browsing experience even G shows my location as the one I select as location. Do you know any way to replicate this behavior (PIA or WARP) in a self hosted Wireguard?

    • @AwesomeOpenSource
      @AwesomeOpenSource  Рік тому +1

      I'd be interested to know if you see the same issu in using Netmaker instead.

    • @djstraussp
      @djstraussp Рік тому

      I'll implement this option later today. Will report back. Cheers

    • @hotstovejer
      @hotstovejer Рік тому +4

      Sounds like you have split tunnel set up.

    • @entelin
      @entelin Рік тому +10

      I think you have some fundamental misunderstanding about VPNs. Fundamentally all a vpn is, is a secure way of virtually plugging your computer into a remote network as if you had a second network card connected to a super long ethernet cable connected to another network card at the other end. That's it, nothing more. It has nothing explicitly to do with "hiding" your ip address or anything else. In most cases you wouldn't actually route your general internet traffic over the vpn at all, generally people will create a vpn to access a remote network, for example the only port I have open to the outside world here at home is my wireguard server. Once I connect to that, I can then ssh or rdp into my servers, workstations and such.
      If you did route all your internet traffic over the vpn, the ip address that websites would see should be that of your vpn server. So if you wanted websites to see an ip address outside of the country in which you live, you would need a server in the country you want to appear as. Your commercial vpn services have many endpoints all over the world, and that's what allows you to pick what location you wish to appear as. It should also be noted that so called "private" vpn services will hide your traffic from your isp, but does not hide your traffic from the vpn provider, and like isp's, they *definitely* are tapped by whatever government is interested. However most web traffic is encrypted anyway, so your isp can't see that regardless. Plus vpn has nothing automatically to do with DNS either, so if you are using a vpn, but are doing dns queries via your isp, then they will still be logging and selling data on what sites you look up.
      So in short, it all depends on what you want to accomplish. Commercial VPN services that you see being shilled all over youtube sell themselves by flat out lieing about about security benefits.

    • @iamrage4753
      @iamrage4753 Рік тому +1

      @@AwesomeOpenSource heard of wirebird? can you cover it's use please?

  • @shanewilliams2956
    @shanewilliams2956 Рік тому +2

    Please make a updated video on this! your video and instructions are all out of date. Yes, I could read the new instructions but I'm a visual person and prefer a video.

    • @AwesomeOpenSource
      @AwesomeOpenSource  Рік тому +1

      Let me see what I can do.

    • @shanewilliams2956
      @shanewilliams2956 Рік тому +1

      @AwesomeOpenSource Oh sweet I didn't think you would even read this... Thank you! Also love what you do, I watch tons of your videos. Can you make a video on cosmos server and wazuh please?

    • @AwesomeOpenSource
      @AwesomeOpenSource  11 місяців тому +1

      Thanks. I try to read (and when I have any kind of answer) answer all of my comments on the channel. There are those that I simply don't understand sometimes, but I do try to respond to as many as I can. As for Netmaker, Alex (the original creator of it) is awesome, and I know he's also been working on his own videos, but it is about time for me to see if he'll come back on my channel and walk me through an update.

  • @coldpizza2453
    @coldpizza2453 Рік тому +2

    👍👍👍

  • @eidodoos
    @eidodoos 9 місяців тому +1

    no android app

    • @AwesomeOpenSource
      @AwesomeOpenSource  9 місяців тому

      You add Android or iOS as an "external" client, then just use the Wireguard app.

    • @eidodoos
      @eidodoos 9 місяців тому +1

      @@AwesomeOpenSource all self hosted vpn server using wireguard can connect with same wireguard tunnel? and use wireguard app on play store? man, i didnt know this and never think of this

  • @beauthompson5338
    @beauthompson5338 Рік тому +1

    Hi, Brian.Great video.I need some clarification On how to set up netmaker.I have my proxmox server.And then I will have a VPS.I am trying to set it up so that I can run remotely or rust desk.On my proxmox .And not have to open ports the will I need two droplets or one? And where's the server. Go on the VPS or on the proxmox box also if i am not running a dns server what options do i have? Thank you for any help you can give me to give me pointed in the right direction.Thanks.

    • @AwesomeOpenSource
      @AwesomeOpenSource  Рік тому

      Great question. I have a video that shows how to do what you're asking I think. Check this one out. ua-cam.com/video/CGw4Kc424VE/v-deo.html

  • @kasepdimple
    @kasepdimple Рік тому +1

    all workеd

  • @superxlson
    @superxlson Рік тому +1

    Wow

  • @iamrage4753
    @iamrage4753 Рік тому +1

    Shame it doesn't support arm64 yet...

    • @AwesomeOpenSource
      @AwesomeOpenSource  Рік тому

      He has clients for Arm64, just not sure about a build for the server. But always worth asking on their Github for the additional build.

    • @iamrage4753
      @iamrage4753 Рік тому +1

      @@AwesomeOpenSource how would i go about this if i had a dynamic ip that isp changes? i have heard i can use duckdns and use script to update for ip changes on my router

    • @AwesomeOpenSource
      @AwesomeOpenSource  Рік тому

      You can use DuckDNS, or there are a lot of docker containers for updating registrars A-records for places like Godaddy, Cloudflare etc, if you prefer to use your own domain. Lastly, you soudl just do like I did and setup an inexpensive VPS to host the server on.

  • @MarkConstable
    @MarkConstable Рік тому +1

    Sorry Alex, but your audio is so bad it makes this valuable video almost useless.

    • @AwesomeOpenSource
      @AwesomeOpenSource  Рік тому

      Actually, the audio wasn't on Alex's end. It was some issue I have with OBS when trying to record while in a video call. Not sure why it does that.

    • @MarkConstable
      @MarkConstable Рік тому

      @@AwesomeOpenSource Sorry about my negative reaction and apologies to Alex. I didn't realize it was only a small part of an otherwise great quality video.

  • @rmmachine
    @rmmachine Рік тому

    The audio was so bad i had to stop listening

    • @AwesomeOpenSource
      @AwesomeOpenSource  Рік тому

      That was an issue on my end. The recording software messed up during streaming. Apologies.