The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Set up a Netmaker server on an Ubuntu 24.04 VPS with a public static IP, point service DNS records at it, and allow the required web and WireGuard traffic through both the VPS firewall and cloud security group. Then create a non-overlapping Netmaker network, join nodes with Netclient, and assign a Remote Access Gateway for users. To reach a home or office LAN, add an Egress Gateway on a machine that can reach that LAN and route only the required private address ranges.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
The available Community installation command comes from a guide marked deprecated, so treat it as a legacy documented method—not confirmation that it is the current recommended installer. If you use it, review the current Netmaker installation instructions first. The remaining sections explain the network design, ports, and access controls that make the deployment work securely.
As an Amazon Associate I earn from qualifying purchases.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsWhat you need before installing Netmaker
Plan the server endpoint, DNS, address ranges, and firewall rules before running the installer. These choices determine whether clients can connect and whether routes to a remote LAN work without clashing with users’ local networks.
VPS and operating system
- Operating system: Ubuntu 24.04 is the documented server OS.
- Public endpoint: Use a public static IP so Netmaker nodes can reliably reach the server. Confirm whether your VPS provides IPv4, IPv6, or both, and use the reachable address family in DNS and firewall rules.
- Resources: The published minimum is 1 GB RAM, 1 CPU, and 2 GB storage. The production recommendation is 2 GB RAM, 2 CPU, and 10 GB storage. These are sizing recommendations, not throughput guarantees.
- Provider: The setup guide recommends DigitalOcean, Linode, AWS, Azure, and GCP, and notes known network-configuration issues with Oracle Cloud.
Domain names and TLS
Domain access is preferred for service DNS and TLS. Create public DNS records that resolve to the VPS for the Netmaker API, dashboard, and MQTT broker. The documented example names are api.example.com, dashboard.example.com, and broker.example.com. Optional monitoring and exporter records are prometheus.example.com, grafana.example.com, and netmaker-exporter.example.com.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
If you use Cloudflare, proxying can interfere with MQTT. Use DNS-only behavior for the affected hostname when required; do not assume that proxying works for every Netmaker service.
Address plan
Choose a Netmaker network range that does not overlap with the home or office LANs you plan to reach, or with users’ local networks. For example, if a user’s laptop is already on a local network using the same range as the office network, the laptop may send traffic to its local network instead of through the tunnel. Decide the ranges before creating the network and routes; changing an address plan later can require updating connected nodes and route settings.
Install the server and check its initial access
The Community command documented by the deprecated quick-install guide downloads and runs the installer as root. The URL shown here is the exact script URL in that command:
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
sudo wget -qO /root/nm-quick.sh https://raw.githubusercontent.com/gravitl/netmaker/master/scripts/nm-quick.sh && sudo chmod +x /root/nm-quick.sh && sudo /root/nm-quick.sh
For the Pro installation, that guide says to append -p. Because the guide is deprecated, confirm the supported installation path and command in Netmaker’s current official documentation before deploying a new production server. A downloaded shell script run with root privileges can make system-level changes; only run it when you have verified that the source and method are appropriate for your deployment.
- Provision the Ubuntu 24.04 VPS and assign or retain its public static IP.
- Create the DNS records for the API, dashboard, and broker, and any optional monitoring services you intend to use.
- Allow the server traffic listed in the firewall section below in both the cloud security group and the VPS host firewall.
- Run the currently supported installation method for your edition. If you are intentionally following the deprecated Community quick-install guide, use its command above.
- Open the dashboard hostname in a browser, sign in with the initial credentials, create or invite an administrator, and confirm that the administrator can access the dashboard. Replace or retire any initial credentials according to the server’s supported account-management process.
Open the right ports in both firewalls
Cloud security groups and the operating system firewall are separate layers. A port must be permitted at each layer that filters it. The server, a gateway-only host, and a Linux Netclient node do not necessarily need identical rules.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
| System or purpose | Protocol and port | Why it is listed |
|---|---|---|
| Netmaker server | TCP 80 | Caddy certificate requests. |
| Netmaker server | TCP 443 | Dashboard, API, and MQTT services. |
| Netmaker server | UDP 51821 and UDP 443 | WireGuard traffic. |
| Linux Netclient node | UDP 51821 and UDP 443 | WireGuard ports listed for Linux nodes. From Netclient v0.30.0, the client tries UDP 443 as its default listening port and falls back to 51821 if that port is unavailable. |
| Linux Netclient node | TCP 51821 | Endpoint detection port listed by Netmaker documentation. |
| Linux Netclient node | Outbound access to the server and outbound TCP 443 | Connectivity requirements listed for nodes; allow only the destinations and directions appropriate to your firewall design. |
| Separate Remote Access Gateway | UDP 51821 | The security guide says a separate Remote Access Gateway needs only this WireGuard UDP port exposed. |
The port requirements above describe the documented services; they are not a reason to open every port on every host. In particular, distinguish a Netmaker server, which serves the dashboard and API, from a separate gateway that only forwards encrypted WireGuard traffic.
Enable forwarding deliberately
Traffic routed through a gateway must be allowed to pass through it. The deprecated setup guide gives iptables --policy FORWARD ACCEPT as a way to guarantee forwarding. That command sets the forwarding policy to accept broadly; it is not a narrowly scoped rule. Do not apply it automatically to a host whose security policy depends on restricting forwarded traffic. Ensure forwarding is enabled and permitted in a way that matches the routes and firewall policy you intend to operate.
Default-deny rules for a gateway-only Ubuntu host
For a separate gateway host that should accept no unsolicited inbound traffic except WireGuard, the security guide gives this UFW starting point:
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow 51821/udpEnable UFW if it is not already enabled, or reload it after changing rules. Before enabling a deny-incoming policy on a remotely managed machine, ensure your administration method is allowed so you do not lock yourself out. Add any genuinely required management access explicitly; the three commands above do not add SSH access.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Create the network and join managed nodes
Netmaker uses WireGuard for encrypted transport. Netclient is the management agent for supported devices; installing it alone does not enroll a machine in a network.
- Create a Netmaker network. Select the planned CIDR and verify that it does not overlap with LANs or client networks that need to communicate through it.
- Install Netclient on a supported device. Supported systems listed in the documentation are Linux, Windows, macOS, and FreeBSD. On Linux, Netclient runs as a system daemon.
- Enroll the node with a join token. Run
netclient join -t <token>on the device, substituting the token issued for the intended network. Treat join tokens as credentials and share them only through an appropriate secure channel. - Verify the node appears and connects. Confirm its status in Netmaker before relying on it as a route or gateway. If it cannot connect, check DNS resolution, outbound connectivity to the server, the applicable cloud and host firewall rules, and whether the listening WireGuard port is reachable.
For a device that cannot run Netclient, Netmaker can generate a standard WireGuard configuration. That provides a way to connect unsupported devices, but it is a configuration file rather than the Netclient-managed enrollment flow. Keep generated configurations private and revoke or replace them when access should end.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Choose the gateway that matches the traffic direction
Netmaker’s gateway functions solve different problems. A Remote Access Gateway is an entry point for people or devices connecting into the Netmaker network. An Egress Gateway advertises routes from that network toward a private site or other external ranges. A single node may perform one or both functions, but keeping their roles clear makes firewall and routing decisions easier.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minute| Design | Role | Public-IP and exposure considerations | When to use it |
|---|---|---|---|
| Netmaker server as Remote Access Gateway | Ingress for Remote Access Clients (RAC) or WireGuard-config clients. | The gateway node must have a public IP. The Netmaker server is an acceptable default; it also needs the server’s web/API and WireGuard rules. | A straightforward starting design when the server itself can serve as the public entry point. |
| Separate Remote Access Gateway | Ingress for remote users into the Netmaker network. | It must be publicly reachable. The security guide says it needs only UDP 51821 exposed when it is a separate gateway. | When you want to separate user entry from the server’s dashboard and API services. |
| Egress Gateway at a home or office | Routes selected traffic from Netmaker clients into the private LAN. | The host must be able to reach the LAN. If it sits behind NAT, forward UDP 51821 on the router and set a static listening port when required. | When authorized users need to access private-site services by their private addresses. |
Configure Remote Access for users
Assign a publicly reachable node as the Remote Access Gateway, then onboard users through authenticated access. Remote Access Clients authenticate to the self-hosted server and connect to their assigned gateway. The documented access options include the Netmaker Desktop App and generated WireGuard configuration files. Relay mode can help nodes that cannot establish direct peer-to-peer connections.
Where practical, use the Remote Access Client flow with user authentication and role assignment rather than distributing reusable VPN configuration files. The security guide describes RAC login as safer operationally because access remains tied to user credentials and assigned roles. Netmaker also documents Service Users, invitations, and OAuth/SSO as onboarding and authentication options. Give users only the access their role requires, and remove or change assignments when that access is no longer appropriate.
Route a home or office LAN through an Egress Gateway
- Choose a Linux machine on the private site that can reach the LAN resources users need.
- Install Netclient on it, join it to the Netmaker network, and configure that node as an Egress Gateway.
- Add only the external route ranges that should be reachable through this gateway. Avoid advertising a broad range when users need access to only a few private subnets.
- Keep NAT egress enabled when appropriate for the way the private network handles return traffic.
- If the egress host is behind a router performing NAT, forward UDP 51821 from the router to that host. Set a static listening port when required so the forwarded port continues to point to the expected WireGuard listener.
- Connect a client and test a required service using its private IP address. A successful tunnel does not by itself prove that the intended LAN route or return path is correct.
A gateway route is not a substitute for LAN reachability: the gateway machine must be able to reach the target network, and the address ranges must not collide with the client’s local routes. If access fails, check those conditions before exposing additional ports.
Validate the deployment without exposing private services
Work through this checklist from the public endpoint inward. Test from a network outside the VPS and private site rather than relying only on a machine already inside either network.
- Confirm the VPS has a public static endpoint and that each required DNS name resolves to it.
- Confirm TCP 80 and 443 and the required WireGuard UDP ports are allowed in both cloud security groups and the host firewall.
- Confirm forwarding is enabled where traffic must traverse a gateway, and that firewall policy permits the intended routes.
- Check that the Netmaker network, private-site routes, and client-local ranges do not overlap.
- Create the network, join a test node with Netclient, and verify that it connects.
- Assign the Remote Access Gateway and test a RAC login or WireGuard configuration from an external network.
- If private-site access is needed, verify the Egress Gateway route and, for a gateway behind NAT, the router’s UDP 51821 forwarding and required static listening port.
- Test a private service by its private address. Keep private web, file, and administrative services off the public internet; expose only the required encrypted WireGuard transport on gateway hosts.
Troubleshoot the most common failures
The dashboard or API hostname does not load
- Check that the DNS record points to the VPS’s current public static address.
- Check TCP 443 at both firewall layers, and TCP 80 where needed for Caddy certificate requests.
- Confirm that the installation completed and that the hostname used is the one configured for the service.
Nodes do not establish a tunnel
- Check UDP 51821 and UDP 443 rules where the server or node needs them, and confirm that the cloud firewall and host firewall agree.
- For Linux nodes, account for Netclient v0.30.0 and later trying UDP 443 first and falling back to 51821 if unavailable.
- Confirm the node has outbound access to the server and outbound TCP 443 as documented.
- If direct peer-to-peer connectivity is not possible, consider whether relay mode is needed.
A user connects but cannot reach the home or office resource
- Check that the route is configured on an Egress Gateway, not only a Remote Access Gateway.
- Confirm the gateway host can reach the target private address on the LAN.
- Check for overlapping CIDRs and verify the client is using the intended private route.
- If the gateway is behind NAT, verify router forwarding for UDP 51821 and the configured listening port.
- Verify the gateway’s forwarding and firewall policy permits the selected route, and that return traffic can reach the client.
MQTT connectivity is unreliable with proxied DNS
Cloudflare proxying may interfere with MQTT. Try DNS-only behavior for the broker hostname when required, while retaining the proxy choice appropriate for other service names.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
