Set up Netmaker on an Ubuntu 24.04 VPS with a public static IP, point its service hostnames to that address, install Netmaker with the official script, and allow only the required HTTPS and WireGuard traffic. Then join your devices with Netclient, create a non-overlapping network, assign a publicly reachable Remote Access Gateway for authenticated users, and add an Egress Gateway when you need routes into a home or office LAN.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
This design keeps application networks private: gateway hosts carry encrypted WireGuard traffic, while Remote Access Client (RAC) users authenticate to your self-hosted Netmaker server instead of sharing reusable VPN files.
As an Amazon Associate I earn from qualifying purchases.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What the finished design looks like
Netmaker uses WireGuard tunnels to connect managed nodes. The VPS hosts the Netmaker control plane and can also serve as a gateway. A Remote Access Gateway is the ingress point for people connecting from outside; an Egress Gateway is the node that advertises routes into a private site such as a house or office LAN.
| Component | Purpose | Network requirement |
|---|---|---|
| Netmaker VPS | Runs the API, dashboard, broker and control services | Public static IPv4 or IPv6 endpoint; public DNS recommended |
| Remote Access Gateway | Accepts RAC or WireGuard-client connections into the Netmaker network | Publicly reachable node; the VPS is an acceptable default |
| Egress Gateway | Routes traffic from Netmaker to a private home or office subnet | Linux host that can reach the private LAN; router forwarding may be required |
| Netclient node | Managed endpoint on Linux, Windows, macOS or FreeBSD | Outbound access to the server and WireGuard transport |
| Unsupported device | Joins with a standard WireGuard profile | Import a generated configuration into its WireGuard client |
Keep the address ranges distinct. For example, do not use the same CIDR for the Netmaker network and the LAN behind an Egress Gateway. If a user’s local Wi-Fi network and the remote network overlap, the local route normally wins and the remote service becomes unreachable.
#1 Best Overall
- 【Five Gigabit Ports】1 Gigabit WAN Port plus 2 Gigabit WAN/LAN Ports plus 2 Gigabit LAN Port. Up to 3 WAN ports optimize bandwidth usage through one device.
- 【One USB WAN Port】Mobile broadband via 4G/3G modem is supported for WAN backup by connecting to the USB port. For complete list of compatible 4G/3G modems, please visit TP-Link website.
- 【Abundant Security Features】Advanced firewall policies, DoS defense, IP/MAC/URL filtering, speed test and more security functions protect your network and data.
- 【Highly Secure VPN】Supports up to 20× LAN-to-LAN IPsec, 16× OpenVPN, 16× L2TP, and 16× PPTP VPN connections.
- Security - SPI Firewall, VPN Pass through, FTP/H.323/PPTP/SIP/IPsec ALG, DoS Defence, Ping of Death and Local Management. Standards and Protocols IEEE 802.3, 802.3u, 802.3ab, IEEE 802.3x, IEEE 802.1q
Prerequisites and VPS sizing
Server requirements
- Ubuntu 24.04 is the documented server operating system.
- A public static IP is required for reliable node communication. Confirm that the address will not change when the VPS reboots.
- Domain access is strongly preferred so the API, dashboard and broker can use stable names and TLS certificates.
- Minimum published size: 1 GB RAM, 1 CPU and 2 GB storage.
- Recommended production size: 2 GB RAM, 2 CPUs and 10 GB storage.
The published figures are installation guidance, not independent throughput or latency benchmarks. Increase the size if you expect many concurrent clients, extensive logging or monitoring services.
Prepare administrative access
- Record the VPS public IPv4 and, if used, IPv6 addresses.
- Have a DNS account that can create A and AAAA records.
- Have authority to edit both the cloud security group and the Ubuntu host firewall.
- Choose non-overlapping private ranges for the Netmaker network, each remote LAN and the local networks used by your users.
Point DNS names at the VPS
Create public DNS records before requesting certificates. The documented service names are:
| Service | Example hostname | Use |
|---|---|---|
| Netmaker API | api.example.com |
Control-plane API used by clients and administration |
| Dashboard | dashboard.example.com |
Web administration interface |
| MQTT broker | broker.example.com |
Service messaging for node coordination |
| Prometheus | prometheus.example.com |
Optional metrics service |
| Grafana | grafana.example.com |
Optional dashboards |
| Exporter | netmaker-exporter.example.com |
Optional exporter endpoint |
Use A records for IPv4 and AAAA records for IPv6 as appropriate. If a DNS proxy is placed in front of the records, keep the broker record in DNS-only mode when proxying interferes with MQTT. Verify that each name resolves publicly to the VPS before running the installer.
Install Netmaker on Ubuntu 24.04
Run the documented Community installer
- Connect to the VPS over SSH with an administrative account.
- Run the documented quick-install command:
sudo wget -qO /root/nm-quick.sh https://raw.githubusercontent.com/gravitl/netmaker/master/scripts/nm-quick.sh && sudo chmod +x /root/nm-quick.sh && sudo /root/nm-quick.shThat command is from the published quick-install guide, which is marked deprecated; check the current Netmaker documentation for any replacement before deploying a new production system. For the Pro edition, append -p to the script invocation.
Rank #2
- 【AC1200 Dual-band Wireless Router】Simultaneous dual-band with wireless speed up to 300 Mbps (2.4GHz) + 867 Mbps (5GHz). 2.4GHz band can handles some simple tasks like emails or web browsing while bandwidth intensive tasks such as gaming or 4K video streaming can be handled by the 5GHz band.*Speed tests are conducted on a local network. Real-world speeds may differ depending on your network configuration.*
- 【Easy Setup】Please refer to the User Manual and the Unboxing & Setup video guide on Amazon for detailed setup instructions and methods for connecting to the Internet.
- 【Pocket-friendly】Lightweight design(145g) which designed for your next trip or adventure. Alongside its portable, compact design makes it easy to take with you on the go.
- 【Full Gigabit Ports】Gigabit Wireless Internet Router with 2 Gigabit LAN ports and 1 Gigabit WAN ports, ideal for lots of internet plan and allow you to connect your wired devices directly.
- 【Keep your Internet Safe】IPv6 supported. OpenVPN & WireGuard pre-installed, compatible with 30+ VPN service providers. Cloudflare encryption supported to protect the privacy.
Finish the first login
- Open the dashboard hostname in a browser after the containers and services finish starting.
- Sign in with the initial credentials supplied by the installer.
- Create or invite a separate administrator account.
- Verify that the new administrator can reach the dashboard and API before removing or disabling any bootstrap account.
Do not expose the dashboard with a temporary, unencrypted hostname after setup. Use the final DNS names so certificate issuance and client configuration remain consistent.
Open only the required ports
VPS cloud security group and host firewall
Permit the same traffic in both layers. Allowing a port in the cloud security group does not bypass Ubuntu’s firewall, and allowing it locally does not override a provider-level deny.
Recommended Free Tools
| Protocol and port | Where | Reason |
|---|---|---|
| TCP 80 | Netmaker VPS | Caddy certificate requests and HTTP validation |
| TCP 443 | Netmaker VPS | Dashboard, API and MQTT-over-TLS access |
| UDP 51821 | VPS and publicly reachable gateway | WireGuard transport |
| UDP 443 | VPS and publicly reachable gateway | WireGuard transport when using the UDP 443 listener |
Ensure packet forwarding is enabled on the VPS and any gateway that routes between interfaces. The deprecated guide gives this iptables policy as a way to guarantee forwarding:
sudo iptables --policy FORWARD ACCEPTUse that command only within a firewall policy you understand; replacing a carefully restricted forwarding policy with unconditional acceptance can weaken isolation.
Rank #3
- New-Gen WiFi Standard – WiFi 6(802.11ax) standard supporting MU-MIMO and OFDMA technology for better efficiency and throughput.Antenna : External antenna x 4. Processor : Dual-core (4 VPE). Power Supply : AC Input : 110V~240V(50~60Hz), DC Output : 12 V with max. 1.5A current.
- Ultra-fast WiFi Speed – RT-AX1800S supports 1024-QAM for dramatically faster wireless connections
- Increase Capacity and Efficiency – Supporting not only MU-MIMO but also OFDMA technique to efficiently allocate channels, communicate with multiple devices simultaneously
- 5 Gigabit ports – One Gigabit WAN port and four Gigabit LAN ports, 10X faster than 100–Base T Ethernet.
- Commercial-grade Security Anywhere – Protect your home network with AiProtection Classic, powered by Trend Micro. And when away from home, ASUS Instant Guard gives you a one-click secure VPN.
Netclient node traffic
Linux Netclient documentation lists UDP 51821 and UDP 443 for WireGuard, TCP 51821 for endpoint detection, outbound access to the Netmaker server, and outbound TCP 443. From Netclient v0.30.0, the default listening attempt is UDP 443, with fallback to UDP 51821 when UDP 443 is unavailable.
Gateway-only hardening
If an Ubuntu host exists solely as a gateway, start with a default-deny inbound policy:
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow 51821/udp
sudo ufw enableReload UFW instead of enabling it again if it is already active. A separate Remote Access Gateway needs only UDP 51821 exposed according to the security guidance; do not open SSH or application ports to the Internet unless you have a specific administrative requirement and source restriction.
Create a network and join managed devices
Create the Netmaker network
- In the dashboard, create a network with a CIDR that does not overlap the private LANs your users will access or the local networks from which they connect.
- Choose a range large enough for expected nodes, but avoid reusing common home-router ranges such as those frequently found on consumer equipment.
- Record the network name and the gateway assignment you intend to use.
Install and enroll Netclient
Netclient installs as a system daemon, but installation alone does not join a network. Generate or obtain a join token from the Netmaker administration interface, then run:
Rank #4
- 【DUAL BAND WIFI 7 TRAVEL ROUTER】Products with US, UK, EU, AU Plug; Dual band network with wireless speed 688Mbps (2.4G)+2882Mbps (5G); Dual 2.5G Ethernet Ports (1x WAN and 1x LAN Port); USB 3.0 port.
- 【NETWORK CONTROL WITH TOUCHSCREEN SIMPLICITY】Slate 7’s touchscreen interface lets you scan QR codes for quick Wi-Fi, monitor speed in real time, toggle VPN on/off, and switch providers directly on the display. Color-coded indicators provide instant network status updates for Ethernet, Tethering, Repeater, and Cellular modes, offering a seamless, user-friendly experience.
- 【OpenWrt 23.05 FIRMWARE】The Slate 7 (GL-BE3600) is a high-performance Wi-Fi 7 travel router, built with OpenWrt 23.05 (Kernel 5.4.213) for maximum customization and advanced networking capabilities. With 512MB storage, total customization with open-source freedom and flexible installation of OpenWrt plugins.
- 【VPN CLIENT & SERVER】OpenVPN and WireGuard are pre-installed, compatible with 30+ VPN service providers (active subscription required). Simply log in to your existing VPN account with our portable wifi device, and Slate 7 automatically encrypts all network traffic within the connected network. Max. VPN speed of 100 Mbps (OpenVPN); 540 Mbps (WireGuard). *Speed tests are conducted on a local network. Real-world speeds may differ depending on your network configuration.*
- 【PERFECT PORTABLE WIFI ROUTER FOR TRAVEL】The Slate 7 is an ideal portable internet device perfect for international travel. With its mini size and travel-friendly features, the pocket Wi-Fi router is the perfect companion for travelers in need of a secure internet connectivity on the go in which includes hotels or cruise ships.
sudo netclient join -t <token>- Install Netclient on the supported Linux, Windows, macOS or FreeBSD machine.
- Run the join command with a token scoped for the intended enrollment.
- Confirm the node appears in the dashboard and is assigned to the correct network.
- Test encrypted reachability between the new node and a second node before adding private-site routes.
For devices that cannot run Netclient, generate a standard WireGuard configuration from Netmaker and import it into the device’s WireGuard application. Treat the file as a credential: store it securely, restrict distribution and revoke or regenerate it when the device or user is no longer trusted.
Configure a Remote Access Gateway
Choose the gateway node
A Gateway is a publicly reachable Netmaker node. The VPS can serve as the first gateway, or you can assign another node with its own public endpoint. The gateway must be able to receive WireGuard traffic on the allowed UDP port.
- Open the gateway section in the dashboard and select the enrolled node that has a public address.
- Assign it as the Remote Access Gateway for the network containing the resources users need.
- Enable relay mode when clients or nodes cannot establish direct peer-to-peer WireGuard sessions because of restrictive NAT or firewalls.
- Confirm the gateway status is healthy before inviting users.
Use authenticated Remote Access Clients
RAC users authenticate to the self-hosted server and then connect to the gateway assigned to them. Create service users or invitations, or integrate the available OAuth/SSO option, and give each person only the role and network access required for the job.
Credential-based RAC access is operationally safer than handing out one reusable VPN file to an entire team: access remains associated with a user account and role assignment, so you can remove one person without replacing every other user’s profile. This does not eliminate the need to protect local credentials or revoke compromised sessions.
Best Value
- Next-Gen Gigabit Wi-Fi 6 Speeds: 2402 Mbps on 5 GHz and 574 Mbps on 2.4 GHz bands ensure smoother streaming and faster downloads; support VPN server and VPN client¹
- A More Responsive Experience: Enjoy smooth gaming, video streaming, and live feeds simultaneously. OFDMA makes your Wi-Fi stronger by allowing multiple clients to share one band at the same time, cutting latency and jitter.²
- Expanded Wi-Fi Coverage: 4 high-gain external antennas and Beamforming technology combine to extend strong, reliable, Wi-Fi throughout your home.
- Improved Battery Life: Target Wake Time helps your devices to communicate efficiently while consuming less power.
- Improved Cooling Design: No heat ups, no throttles. A larger heat sink and redefined case design cools the WiFi 6 system and enables your network to stay at top speeds in more versatile environments.
Add an Egress Gateway for a home or office LAN
Prepare the egress host
- Choose a Linux machine on the private site that can reach the target LAN services.
- Install Netclient and join the same Netmaker network as the remote users.
- Give the host a stable address on the private LAN and ensure its operating system can forward packets between the Netmaker interface and the LAN interface.
- In Netmaker, create or assign the node as an Egress Gateway.
Advertise only the needed private routes
Add the external route ranges for the services users actually need, such as the office server subnet or a narrow address block for a file server. Avoid advertising the entire private network when only a few systems are required. Keep NAT egress enabled when the private network does not have a return route back to the Netmaker CIDR; NAT makes replies return through the egress host without requiring every LAN router to know the overlay range.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Handle a gateway behind NAT
If the egress host is behind a home or office router, forward UDP 51821 from that router to the host. Set a static WireGuard listening port when automatic endpoint detection cannot maintain a usable mapping. The router must forward only the WireGuard transport; private web, file-sharing and database ports should remain unexposed.
Test the route
- From an external network, authenticate with RAC or import a test WireGuard profile.
- Connect to a private service by its private IP address, not its public address.
- Check that the response returns through the egress host and that no private service port is reachable directly from the Internet.
- Remove the route or revoke the test account after validation if it is no longer needed.
Choose the right gateway arrangement
| Design | Public-IP requirement | Exposed transport | Ingress or egress role | Authentication | NAT or forwarding |
|---|---|---|---|---|---|
| VPS as Remote Access Gateway | VPS public static IP | TCP 80/443 and WireGuard UDP ports on the server | Ingress to Netmaker networks | RAC credentials or individual WireGuard profile | Usually none for the VPS; relay can assist restrictive clients |
| Separate public Remote Access Gateway | Gateway public IP | Required WireGuard UDP port; keep other inbound traffic denied | Ingress | RAC credentials or individual profile | Direct sessions or relay mode |
| Egress Gateway on private LAN | Not necessarily public | WireGuard UDP 51821 forwarded from the site router when behind NAT | Egress into selected private routes | Users authenticate through RAC or their assigned profile | Router port-forwarding; NAT egress when return routes are absent |
| Full-tunnel Internet Gateway | Publicly reachable gateway recommended | WireGuard transport plus forwarding for Internet traffic | Egress for all client Internet traffic | RAC or profile-based | Requires deliberate default-route and NAT design |
Use a full-tunnel Internet Gateway only when you intentionally want clients’ Internet traffic to exit through the VPS or another gateway. For private application access, advertise only the required site routes instead.
Validate the deployment before relying on it
- Confirm the VPS has a stable public endpoint and that every required DNS name resolves correctly.
- Check TCP 80 and 443 plus the selected WireGuard UDP ports in both the cloud security group and Ubuntu firewall.
- Verify forwarding on the server and gateways.
- Confirm that the Netmaker, home/office and user-local CIDRs do not overlap.
- Join a test node with Netclient and verify it is online.
- Assign the Remote Access Gateway and test RAC from a network different from the VPS and private LAN.
- For private-site access, verify the Egress Gateway route and, when applicable, UDP 51821 forwarding on the site router.
- Reach a private service by its private address and confirm that only encrypted WireGuard transport is exposed on gateway hosts.
Troubleshoot common failures
The dashboard or certificate request fails
- Check that the API and dashboard DNS records resolve to the VPS, not an old address.
- Verify TCP 80 and 443 in both firewall layers.
- If a DNS proxy is enabled, switch the broker record to DNS-only when MQTT connections fail.
A node never becomes reachable
- Confirm outbound TCP 443 from the node.
- Allow UDP 443 and UDP 51821 as required by the Netclient version and network policy.
- Check that TCP 51821 is available for endpoint detection where the documentation requires it.
- Use relay mode when symmetric or restrictive NAT prevents direct peers.
The private LAN is unreachable
- Look for overlapping CIDRs; change the Netmaker network or local LAN range if they collide.
- Confirm the Egress Gateway is attached to the correct network and advertises the intended route.
- Enable NAT egress when the LAN has no route back to the Netmaker range.
- For a gateway behind NAT, verify the router forwards UDP 51821 to the correct host and that the listening port is static when necessary.
Users can connect but should not see a resource
Review the user’s RAC role, invitation or service-user assignment and the network attached to the gateway. Remove broad routes and issue a narrower route for the required service.
Quick Recap
Operational security practices
- Keep gateway-only hosts default-deny for inbound traffic and expose only the WireGuard port required by the design.
- Use separate administrator identities instead of continuing to rely on bootstrap credentials.
- Prefer RAC roles, invitations and SSO where available so access can be revoked per person.
- Protect generated WireGuard files like passwords; regenerate them after loss or suspected compromise.
- Document every CIDR and route so future LAN changes do not silently create overlaps.
- Apply Ubuntu, Netmaker and Netclient updates during a maintenance window, then rerun the validation checklist.
- Monitor gateway health and test access from an external network after firewall, DNS or router changes.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
