Netmaker

What Netmaker actually is

Netmaker is a WireGuard network manager: you run a server that hands out keys, addresses, and peer discovery, and it assembles your machines into encrypted mesh networks with a dashboard on top. Where raw WireGuard gives you configuration files and discipline, Netmaker gives you networks as objects — create a network, enroll devices with the netclient agent, define ACLs, and let the platform handle routing, relays, and egress gateways. It covers mesh VPNs, site-to-site links, remote access gateways, and Kubernetes integration.

The company is small and young. Netmaker's GitHub repository dates to March 2021; the business was founded by Alex Feiszli and Dillon Carns, went through Y Combinator (W22), and announced a $2.3 million funding round in October 2022 led by Lytical Ventures, Uncorrelated Ventures, and SaxeCap, alongside the 1.0 release of the community product and an Enterprise Edition. It is based in Asheville, North Carolina. Total disclosed funding sits around $2.8 million, and public company directories put headcount in single digits. We flag that up front because with a networking tool in your critical path, you are betting partly on the vendor's survival — and this is a startup competing against Tailscale, ZeroTier, and Netbird.

The product itself is genuinely capable. Networks are defined with IPv4 and IPv6 subnets (dual-stack; IPv6-only is not supported), devices get virtual IPs, and the platform layers on private DNS, OAuth, access controls, relay servers for hostile NAT environments, egress gateways for routing traffic out of the mesh, and — on higher tiers — metrics, SCIM provisioning, SIEM integration, and traffic logs. The core is licensed under Apache 2.0 with a proprietary license covering the pro/ directory, so "open source" here means the community server and client are free to run, while the commercial features are closed.

Pricing: what you really pay

Netmaker's current pricing page leads with "pay only for active connections" — the pitch is that you stop paying for idle seats and are billed for machines actually online. The published tiers:

• Community — free forever. Self-hosted, Apache 2.0, unlimited networks and usage, basic access controls with device policies. Community-supported only.
• Professional — from $2 per active connection per month. Cloud or on-prem deployment, desktop and mobile apps, dedicated traffic router, secure device-to-device traffic, email and chat support, and a free implementation session.
• Business — from $4 per active connection per month. Adds SCIM user and group provisioning (Entra ID, Google Workspace, Okta), traffic logs, just-in-time access, and SIEM integration.
• Enterprise — custom. Custom MSA and SLAs, pay by invoice, choice of data residency, dedicated support, network design services, feature customization.

Underneath the per-connection headline sits a second, older usage model that is still published: base fees covering the first 100 devices and first 10 networks, then $1 per device for the next 500, $0.50 for the next 500, $0.25 beyond that, $10 per additional network, and user tiers at $100 for up to 200 users, $500 up to 500, and $1,000 for unlimited. Usage above base limits is calculated hourly — the site's own example: a machine online one hour in a month is charged $0.0014, not $1.

We have mixed feelings about this. Hourly proration of per-device cost is fairer than seat licensing, and the free community tier is unlimited in scope, which is generous. But the pricing page simultaneously shows the current per-connection tiers, an older calculator with a $18.00 platform fee and $20.00 networks fee per month (an example total of $100.50/month), and a legacy Professional plan at $99/month with 10 users and 100 nodes. New buyers cannot tell which model they will actually be billed under without talking to sales, and we consider that a transparency problem, not a pricing problem. A 7-day free trial exists for the paid platform.

Performance & infrastructure

The performance case rests on WireGuard itself: a modern, kernel-friendly VPN protocol with a small codebase and materially lower overhead than IPsec or OpenVPN. Netmaker's launch materials claim up to 15 times faster performance than alternatives; we treat that as a vendor number and quote it as one — we have not benchmarked Netmaker, and our own dated sysbench, fio, and iperf3 runs measure VPS plans (see /benchmarks), not overlay networks.

The architecture is peer-to-peer: the server brokers keys and discovery, but traffic flows directly between machines wherever NAT traversal allows, with relay servers as fallback. That keeps latency low and avoids a central bandwidth bottleneck — the opposite of a traditional hub-and-spoke VPN. For Kubernetes, Netmaker can network clusters and nodes across clouds; for edge and IoT, the netclient runs on Linux, Windows, Mac, and FreeBSD.

Deployment flexibility is the other structural advantage. You can run the entire server yourself (community or pro), run it on Netmaker's cloud, or have Netmaker's team operate it — the pricing page offers fully managed deployment, monitoring, and maintenance as a service. Data residency choice exists on Enterprise. If your requirement is that network metadata never leaves your infrastructure, self-hosting covers it.

For readers deciding between this and hand-rolled WireGuard, the honest comparison is operational rather than technical. Raw WireGuard is faster to start and has no vendor at all; it also gives you no central inventory, no key rotation automation, no ACL model beyond firewall rules you write yourself, and no dashboard when a tunnel breaks at 2 a.m. Netmaker's value is exactly those layers — a control plane that knows which machines exist, which keys they hold, and which peers they may reach. If your network is five servers and a laptop, plain WireGuard with a couple of config management templates is genuinely enough, and we would not talk you out of it. Netmaker earns its complexity at a few dozen machines across multiple sites, where per-device state becomes the problem the platform solves.

Where it falls short

Company scale is the standing risk. A team of roughly five people with under $3 million raised maintains a product that would sit in every connection between your machines; if Netmaker the company changes direction — the pricing page's half-retired models hint at exactly that kind of churn — you are maintaining a fork. The Apache 2.0 core mitigates this, and the pro features do not.

Self-hosting the platform is real operational work: a server, a database, upgrades, TLS, monitoring. The free tier prices this at zero money and non-zero time. Native mobile meshing is listed as not yet supported in the troubleshooting docs (phones connect through a Remote Access Gateway with external clients and the standard WireGuard app), which matters for teams imagining phone-first deployments.

Documentation is functional but uneven — the docs cover the mechanics well and the commercial layers poorly, which is typical for a product growing this fast. Support on Community is community-only; email and chat support start at Professional, and SLAs are an Enterprise negotiation. For anything in your incident path, price in the cost of being your own support.

Who should pick this

Our pick for DevOps and platform teams that want WireGuard mesh networking under their own control with a proper dashboard: multi-site infrastructure, hybrid cloud, cluster-to-cluster links, or an access network you would rather operate than rent. The unlimited free community tier makes it a natural first step, and upgrading to Professional is justified the moment you want metrics, managed endpoints, or someone to call.

We would look elsewhere for phone-first deployments, for organizations that want a large vendor behind a remote-access product with contractual SLAs at low volume, or for teams unwilling to run a server. Tailscale, ZeroTier, and similar hosted services trade control for convenience at comparable or lower operational cost. And if you do adopt Netmaker, self-host the community edition as your fallback posture so a vendor change never becomes your outage.

Key takeaways

• WireGuard-based network platform (mesh VPN, site-to-site, remote access gateways) with dashboard, ACLs, private DNS, and relay/egress gateways.
• Community tier is free forever, self-hosted, Apache 2.0 core with unlimited networks and devices; pro/ features are proprietary.
• Paid plans bill per active connection — Professional from $2/month, Business from $4/month — with hourly proration of usage.
• Pricing page mixes current, legacy ($18 platform + $20 network fees, $99/month Professional), and custom models — confirm your billing basis before signing.
• Founded 2021 (Asheville, NC), YC W22, $2.3M round in October 2022; a very small company behind a critical-path product.
• Dual-stack IPv4/IPv6 networks supported; native mobile meshing is not — phones connect via gateways and the WireGuard app.

Sources

• https://www.netmaker.io/pricing
• https://www.netmaker.io/old-pricing
• https://github.com/gravitl/netmaker
• https://docs.netmaker.io/docs/operations-guide/network-setup
• http://prnewswire.com/news-releases/netmaker-launches-with-2-3m-in-funding-to-fix-cloud-networking-with-wireguard-301656489.html