You fixed remote access with WireGuard once. Hand-edited wg0.conf, copied keys around on Slack, forgot which laptop had the latest peer list, and prayed nobody rotated an IP without telling you. It works until you have more than three sites, a homelab, a cloud VPC, and a contractor who needs database access without exposing Postgres to the whole internet.
Netmaker is what a lot of teams reach for next. Gravitl built it to automate WireGuard networks: mesh VPNs, site-to-site links, remote-access gateways, private DNS, ACLs, and an admin UI so you are not SSH-ing config fragments to every machine. Roughly 11k GitHub stars, written in Go, and squarely in the "self-hosted overlay network" lane alongside Tailscale's model — except you run the control plane on your own VM.
What it actually does
WireGuard is the data plane — fast kernel tunnels, modern crypto, none of the OpenVPN baggage. Netmaker is the control plane. You install a Netmaker server (the brain), then join machines with netclient agents. The server pushes keys, addresses, and routing rules so peers find each other without you pasting [Peer] blocks by hand.
Common patterns:
- Remote access gateway — laptops and phones dial into your private network through a gateway node instead of punching holes in every firewall rule.
- Mesh — every node can talk to every other node on the overlay (great for dev clusters, less great if you forget ACLs).
- Site-to-site — office LAN, Canadian VPS, and a cloud region behave like one routed fabric for admin tools, backups, or replication.
- Kubernetes and multi-cloud — Gravitl ships plugins and community tooling (Terraform provider, k8s helpers) because this is where Netmaker stops being a homelab toy.
The dashboard covers OAuth for login, network definitions, enrollment keys, DNS for service names inside the mesh, and access control lists so "everyone on the VPN" does not mean "everyone on production." Remote access gateways are the feature MSPs and small IT shops quote most often: one well-placed node in your Canadian DC becomes the front door.
Why self-host Netmaker?
You own the control plane. Netmaker's hosted offering at netmaker.io is fine for experiments. Production teams often want the enrollment server, audit trail, and DNS data on infrastructure they patch and back up — especially when the mesh carries admin access to client environments.
WireGuard performance without WireGuard paperwork. Kernel WireGuard is already the performance winner; Netmaker's value is operational: add a node, revoke a laptop, change a route without a maintenance window spent editing configs on twelve hosts.
Internal reachability. SaaS VPNs are convenient until you need a site-to-site link between two Canadian offices and a Beauharnois VPS, custom ACLs, or DNS names that only resolve inside the mesh. Self-hosted Netmaker lets you design that without per-seat pricing on every server and container.
License reality check. Most of the repo is Apache 2.0; Gravitl also ships a pro/ tree with separate licensing for professional features. Read LICENSE.md before you assume every enterprise feature is in the quick-install script. For many teams the open-source quick start is enough to replace hand-rolled WireGuard; others need Pro for SSO depth or support contracts.
What running it takes
Gravitl's quick path is a Ubuntu VM with a static public IP, wildcard DNS (e.g. *.netmaker.example.com pointing at the server), and firewall rules for 443 and 51821 TCP/UDP. Their install script (nm-quick.sh) bundles the server stack — treat it like any other infrastructure bootstrap: read the script, pin versions in production, and snapshot the VM after a clean install.
Resource sizing depends on peer count and churn, not raw bandwidth (WireGuard does the heavy lifting in the kernel). A modest Canadian VPS can run the control plane for a small business mesh; scale up CPU and disk when you have hundreds of netclients checking in or heavy API automation. Put TLS in front of the dashboard, restrict admin access, and back up whatever database the server uses — lose the control plane and you are re-enrolling nodes even if tunnels technically still exist.
Clients run on Linux, Docker, Windows, and Mac. Edge cases (OpenWRT, k3s homelabs) have community packagers if you like living on the forum threads. Plan egress: gateways need reliable UDP; some corporate Wi-Fi still fights WireGuard, so keep a fallback SSH bastion in your runbook.
Who it's for (and who should skip it)
Good fit: MSPs linking client sites, dev teams who outgrew a single wg-quick file, shops with multiple Canadian VMs that need private admin paths without a public IP on every database, Kubernetes clusters that need a flat overlay.
Maybe skip it: if you only need one personal VPN to one home server, plain WireGuard or a minimal installer is simpler. If you want zero ops and happy to pay per user, managed Tailscale or Netmaker Cloud might beat running patches yourself. If you will not maintain DNS, firewall rules, and backups on the control node, do not self-host the brain of your network.
Hosting it in Canada
We run Netmaker control planes and gateway nodes on Canadian VPS hosting when clients want admin traffic and metadata staying north of the border — same idea as self-hosted monitoring or automation: the sensitive part is not the public website, it is who can reach the private ports behind it.
Tell us how many sites and gateways you are joining if you want help sizing the server, hardening the install, or pairing Netmaker with the rest of your stack (Docker apps, databases, remote desktop). Getting WireGuard right is easy; keeping it right at scale is where Netmaker earns its disk space.
