# Netmaker — Business VPN & Zero Trust Access

Netmaker by Netmaker, Inc. holds a panel rating of 3/5 from 6 AI judges (category median 3/5), as of 2026-11-05. Provenance: Rest of world; sovereignty: not determined.

- Vendor: Netmaker, Inc. (https://www.netmaker.io)
- Category: [Business VPN & Zero Trust Access](https://whats-best.ai/software/business-vpn.md)
- Provenance (editorial classification): Rest of world
- Canonical page: https://whats-best.ai/software/business-vpn/netmaker
- Alternatives: https://whats-best.ai/software/business-vpn/netmaker/alternatives ([markdown](https://whats-best.ai/software/business-vpn/netmaker/alternatives.md))
- Data as of: 2026-11-06 · evaluated 2026-11-05 · oldest source captured 2026-11-05

**AI-generated.** Every score, rationale and verdict here is written by a panel of AI judges from public evidence — an analysis, not a hands-on test. Every fact quotes the vendor page it was read from. No score can be bought. How scores are made: https://whats-best.ai/methodology

## At a glance

- Vendor: Netmaker, Inc.
- Headquarters: Not stated on the vendor’s pages as of 5 Nov 2026
- Data hosting: Not stated on the vendor’s pages as of 5 Nov 2026
- Free plan: Not stated on the vendor’s pages as of 5 Nov 2026

## The panel's verdict

Netmaker is an open-source virtual networking platform built on WireGuard. Its strongest scores are for connectivity and administration: access and connectivity and deployment and administration sit at 7, with identity and policy at 6-7. Judges credited combinable patterns — peer-to-peer mesh, split and full tunnel, site-to-site, hub-and-spoke — single sign-on with Google, Microsoft Entra ID and Okta, and a documented API, CLI and Intune silent install. Sovereignty is the weakest and most divided area, with scores spreading 2 to 4: contracting is with Netmaker, Inc. under New York law and exclusive New York County venue, and judges weighed that differently against the self-hosting path available on every plan. Architecture and assurance scored 4-5, and we found no public information on independent audits, a status page, or any SLA beyond a custom Enterprise MSA. Visibility and audit scores sit at 6, with traffic logs in beta, Business-plan only, and needing Netmaker team activation. Pricing transparency spans 5-6: Team is "STARTING $ 2 / active connection / month", Business $ 4, but the captured pages give different per-connection figures and Enterprise is custom.

**Speaks for it:**
- Peer-to-peer WireGuard mesh with relays, split-tunnel egress, full-tunnel internet gateways, site-to-site and hub-and-spoke, combinable in one deployment.
- Single sign-on with Google, Microsoft Entra ID and Okta, with SCIM provisioning and just-in-time access requiring approval at the Enterprise tier.
- Traffic logs record source, destination, protocol, ports, direction and volume, and events stream to Datadog, Splunk, Microsoft Sentinel or Elastic Security.
- Server and client source code are open on GitHub, with a downloadable OpenAPI document, an NMCTL CLI, and silent Windows deployment via Microsoft Intune.
- Self-hosting is available on every plan, including an on-premises edition described as storing data entirely within your infrastructure.

**Held against it:**
- New networks auto-generate default policies enabling unrestricted two-way communication, so least privilege must be configured by hand.
- Traffic logs are beta and Business-plan only, requiring activation by the Netmaker team when not in the plan, and we found no public information on retention periods.
- We found no public information on independent security audits, penetration tests, a bug bounty, a public status page, or an SLA below custom Enterprise contracts.
- Sovereignty scores spread 2 to 4 over contracting under New York law with exclusive New York County venue, no public information on where the hosted control plane or logs live, and terms barring air-gapping the commercial platform without permission.
- Enterprise is custom "Contact us", the captured pages give different figures for the per-connection rate, and we found no public information on VAT treatment, minimum seats or minimum term.

**Best for:**
- You are an MSP or multi-client consultancy that needs per-tenant isolation with usage and billing monitoring per tenant.
- Your estate mixes managed servers and unmanaged contractor phones and laptops, which join through generated WireGuard config files or QR codes.
- You want to run the platform yourself, on-premises, with data stored entirely within your infrastructure.
- You administer Windows fleets through Microsoft Intune and want a silent, preconfigured desktop deployment.

**Avoid if:**
- You need least privilege out of the box — new networks start open, with auto-generated two-way policies.
- You need a fixed, predictable annual budget — billing is per daily active connection, and the captured pages give different per-connection figures.
- Your procurement requires published service levels and independent audit evidence — service levels appear only as custom Enterprise contracts, and we found no public information on independent audits.
- You must contract under European law or venue, or air-gap the platform — the terms specify New York law, exclusive New York County venue, and bar air-gapping the commercial platform without permission.

## Scores by judge and criterion

Scores out of 5, each judge scoring independently against the published rubric (v1). "n/r" = not rated: the vendor publishes no price, or the judge found no public information on that criterion.

| Criterion | The IT Lead | The DevOps Engineer | The MSP Technician | The Operations Manager | The Information Security Officer | The Skeptic |
| --- | --- | --- | --- | --- | --- | --- |
| Access model & connectivity | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 |
| Identity, access policy & device posture | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3/5 |
| Logs, audit trail & incident response | 3/5 | 3/5 | 3/5 | 3/5 | 3/5 | 3/5 |
| Deployment, API & administration | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 |
| Architecture, reliability & security assurance | 2/5 | 2/5 | 2/5 | 2/5 | 2.5/5 | 2.5/5 |
| European sovereignty | 1/5 | 1.5/5 | 2/5 | 2/5 | 2/5 | 1.5/5 |
| Pricing transparency | 2.5/5 | 3/5 | 2.5/5 | 3/5 | 3/5 | 3/5 |
| **Weighted verdict** | **3/5** | **3/5** | **3/5** | **3/5** | **3/5** | **3/5** |

### The judges

- **The IT Lead** (v1.0): Head of a three-person IT team at a 140-person mechanical engineering firm with two plants and a sales office in Vienna. The VPN still runs on the firewall, and every update of it is a weekend. Wants a client that installs through Intune and connects on its own, sign-in with Microsoft Entra so a leaver loses access the same day, the ERP and the file server reachable without opening the whole network, a fixed IP for the supplier portal, and a price per user that survives the next budget round.
- **The DevOps Engineer** (v1.0): Platform engineer at a sixty-person software company with servers at Hetzner, a Kubernetes cluster on AWS and a bastion host everyone shares a key for. Wants a mesh that reaches every server and cluster without inbound ports, access policies kept in Git and applied with Terraform, SSH access tied to the identity provider, connectors that run as containers, and a published architecture that says what the vendor's relays can see.
- **The MSP Technician** (v1.0): Senior technician at an IT service provider in Hamburg that looks after thirty clients, from tax advisers to a dental chain. Each client has its own remote access, set up by whoever was on site that year. Wants one console with a tenant per client, gateways and users added in minutes, access logs a client can be shown after an incident, billing per tenant, and prices per user that can be quoted without calling the vendor first.
- **The Operations Manager** (v1.0): Runs operations at a fifty-person consultancy where a third of the work is done by freelancers on their own laptops and the rest of the team travels to client sites. Has no IT department, only an external provider billed by the hour. Wants each freelancer to reach one project system and nothing else, access that ends with the contract, a setup a non-specialist can follow, and no call to the helpdesk from a hotel lobby.
- **The Information Security Officer** (v1.0): Information security officer at a regional energy supplier that falls under NIS2 and was asked by its auditor who could reach the control systems last year. Wants access granted per resource, not per network, device checks before a connection, every access and admin change in a log that reaches the SIEM, an independent audit of the product, and the identities and logs kept in Europe by a vendor whose subprocessors are listed.
- **The Skeptic** (v1.0): Has seen "zero trust" on a VPN that still drops every user into the whole office network, "no logs" from a vendor that keeps every connection for a year, and a remote access tool that locked out the whole company when its own control plane went down. Asks who can see the traffic and the metadata, what keeps working when the vendor is offline, whether the audit was published or only announced — and whether the network could be moved to a self-hosted server.

## European sovereignty — proven facts

Built only from facts on the vendor's own pages; a dimension we could not prove is left open, never scored as zero. Headline: not determined.

| Dimension | Finding | Points | Source |
|---|---|---|---|
| Legal entity | Not determined | — | — |
| Hosting location | Not determined | — | — |
| Hosting options | Not determined | — | — |
| Open source | Not determined | — | — |
| Data processing agreement | Not determined | — | — |
| Transfer impact assessment | Not determined | — | — |

## Key facts

Each fact is the vendor's own statement, cited to the source page it was read from ([S*n*] → Sources).

**Compliance**
- Children under 13: yes · 13 [S11]

**Data**
- Collected contact registration: name · company name · email address · payment history · Stripe [S11]
- Consent model: consent by use of website [S11]
- Log files collected: IP addresses · browser type · ISP · date and time stamp · referring/exit pages · number of clicks [S11]
- Payment history scope: charge amount · date of purchase [S11]
- Privacy policy scope online only: online activities on www.netmaker.io only · no [S11]

**Integrations**
- API source: yes · MQTT broker [S21]
- Openapi spec: OAS 3.1.1 · v1.4.0 · yes [S8]
- Siem configuration location: Configured via Settings → Integrations [S17]
- Siem connection test: Integration supports connection testing before saving [S17]
- Siem event forwarding: Forwards supported audit and activity events to selected SIEM [S17]
- Siem export purpose: Exports platform events to external security monitoring [S17]
- Siem streaming: Streams audit and network activity events to SIEM platforms [S17]
- Siem supported platforms: Datadog · Splunk · Microsoft Sentinel · Elastic Security [S17]

**Legal**
- Community edition third party licenses: yes [S10]
- Contracting entity: Netmaker, Inc. [S10]
- Data collection aggregate: yes · yes [S10]
- Exclusive venue: New York County, New York, U.S.A. [S10]
- Governing law: New York, U.S.A. [S10]
- Ip feedback assignment: yes [S10]
- Malware warranty remedy: yes · 30 [S10]
- Privacy policy exists: Privacy Policy published at www.netmaker.io [S11]
- Termination refund: termination for uncured material breach by Netmaker/Customer per 6.2 · yes [S10]
- Termination without subscription: no current subscription · 30 [S10]
- Warranty disclaimer: yes · yes [S10]

**Pricing**
- Billing error window: 60 [S10]
- Business price: active connection per month · 4 · USD [S9]
- Deployment models: yes · cloud · on-prem [S9]
- Enterprise custom: yes [S9]
- Estimator example: 0 · 10 · 13 · 3 · 3 [S9]
- Fee change notice: end of Initial Service Term or renewal term · 30 [S10]
- Fees reference: https://dashboard.license.netmaker.io/purchase [S10]
- Late finance charge: 1.5 [S10]
- Model: per daily active connection [S9]
- Team price: active connection per month · 2 · USD [S9]
- Traffic logs business only: Business · yes · yes [S16]
- Trial: 7 · yes [S9]

**Product**
- Access controls: Granular policy-driven traffic control with default-deny or allow-based models [S2]
- Access controls groups: yes [S6]
- Acl default policies auto: Default policies auto-generated on network creation enabling unrestricted two-way communication [S14]
- Acl default policy names: All Nodes · All Remote Access Gateways · All Users · Network Admin · Network User [S14]
- Acl edit remove: ACL policies can be edited via the Edit option [S14]
- Acl enable disable: ACLs can be enabled/disabled and new policies created from the Access Control page [S14]
- Acl how it works: Define rules via Access Control pane; updates applied to network; device access added/removed [S5]
- Acl low level controls: Low-level controls for allowed traffic destinations for users and devices [S5]
- Acl managed access: Access Control Lists provide managed access between devices [S5]
- Acl policies for users devices: Policies for users and devices to manage traffic flow [S5]
- Acl policy types: User Policies · Resource Policies [S14]
- Acl resource policies: Resource policies control which devices can communicate with each other [S14]
- Acl support: yes · yes [S4]
- Acl tags: Tags available to group nodes and apply rules efficiently [S14]
- Acl tags grouping: Tags to group devices, destinations, users for policy management [S5]
- Acl traffic rules: Rules based on directionality, ports, device/route destination, hostnames [S5]
- Acl user policies: User policies control which users can access specific network devices such as servers, databases, gateways [S14]
- Air gapping restricted: no [S10]
- Amui capabilities: AMUI manages profile info, payment method info, and invoicing details [S19]
- Amui tenant management: AMUI: manage tenants, monitor bill payments & usage, manage users per tenant [S19]
- Amui URL: https://account.netmaker.io · https://app.netmaker.io [S19]
- API nmctl: API and NMCTL CLI documented as references [S7]
- API version: v1.4.0 [S8]
- App session expiry: yes [S21]
- Auto reroute: yes [S4]
- Auto start on login: Client can be configured to start automatically on user login (via scheduled task NetmakerDesktopStartup) [S18]
- Bidirectional access: End device becomes reachable over the gateway, enabling integration of machines (e.g. IoT devices) without netclient [S3]
- Broker public reachability: yes [S21]
- Business features: Priority Support · yes · yes · yes [S9]
- Client apps: yes · yes [S6]
- Client custom public key: yes [S12]
- Client disable enable toggle: yes [S12]
- Client invalidation via delete: yes [S12]
- Client qr code provisioning: yes · yes [S12]
- Clients: Netclient (Windows, Linux, macOS, Docker) · WireGuard Endpoints · Netmaker Desktop [S7]
- Combined patterns: Netmaker supports combining point-to-point, site-to-site, full tunnel, and hub-and-spoke patterns in one deployment [S13]
- Community edition features: Community Edition: DNS server, egress traffic, full configuration control, limited advanced features [S7]
- Components: Netmaker Server · Clients · Message Queue (MQ) · DNS Service [S7]
- Conditional access: Context-aware access policies with JIT access requiring explicit approval [S2]
- Config server key: Client configuration JSON contains a single 'server' key holding the Netmaker server address [S18]
- Coredns integration: yes [S8]
- Default proxy: Caddy · 0.17.0 [S21]
- Description: Open-source virtual networking platform built on WireGuard, automating secure overlay networks across devices, servers, containers and users [S7]
- Desktop app: Windows · macOS · Linux [S21]
- Dns: Integrated DNS with automatic hostnames, custom records, and existing DNS integration [S2]
- Dns load balancing: yes [S4]
- Dns nameservers: yes [S21]
- Dns service: DNS service with hostname resolution across nodes, domain-specific rules and scoped name-servers [S7]
- Edr compliance options: require_agent_installed · require_agent_healthy · maximum_allowed_risk · require_recent_check_in · Low · Medium · High · Critical [S15]
- Egress acl capabilities: IP restriction inside egress CIDR · individual endpoint rules · combine egress resources/nodes/tags/IP targets in one policy · one-way or two-way traffic [S14]
- Egress acl config locations: Egress screen · Access Control screen [S14]
- Egress acl ip restriction: Egress ACLs can restrict access to specific IPs inside an egress CIDR range [S14]
- Egress gateway: Egress Gateway: specify IPs/CIDRs to route; creates a split tunnel VPN for end users and devices [S13]
- Endpoints: Multiple deployment models: background agent, authenticated user app, native WireGuard config files [S2]
- Enrollment keys: yes [S4]
- Enterprise features: Dedicated Support · yes · yes · yes · yes [S9]
- Feature list: Egress Gateway · Mesh Network · Remote Access Gateway · Relay · Access Control Lists · DNS · Metrics & Monitoring · Failover · User Management [S2]
- Feature list: Egress Gateway · Mesh Network · Remote Access Gateway · Relay · Access Control Lists · DNS · Metrics & Monitoring · Failover · User Management [S3]
- Feature list: Egress Gateway · Mesh Network · Remote Access Gateway · Relay · Access Control Lists · DNS · Metrics & Monitoring · Failover · User Management [S5]
- Feature list: Egress Gateway · Mesh Network · Remote Access Gateway · Relay · Access Control Lists · DNS · Metrics & Monitoring · Failover · User Management [S4]
- Feature list: Egress Gateway · Mesh Network · Remote Access Gateway · Relay · Access Control Lists · DNS · Metrics & Monitoring · Failover · User Management [S6]
- Feature list: Egress Gateway · Mesh Network · Remote Access Gateway · Relay · Access Control Lists · DNS · Metrics & Monitoring · Failover · User Management [S9]
- Features: Egress Gateway · Mesh Network · Remote Access Gateway · Relay · Access Control Lists · DNS · Metrics & Monitoring · Failover · User Management [S10]
- Free features: yes · yes · yes · yes [S9]
- Full tunnel via internet gateways: Full Tunnel VPN (Internet VPN) is implemented via Internet Gateways [S13]
- Gateway default dns option: yes [S12]
- Gateway node public ip requirement: Gateway node should have a public IP address, not behind NAT [S12]
- Gateways: Gateways provide secure entry points, traffic relaying and internet exit nodes [S2]
- Hub and spoke static wireguard: Static WireGuard deployments and Relay endpoints use a Hub (hub-and-spoke); a mix of point-to-point and hub-and-spoke can exist in one network [S13]
- Idp integrations: yes · Google · Microsoft Entra ID (Azure) · Okta [S7]
- Internet gateway: yes · yes [S4]
- Internet gateway: Internet Gateway forwards all traffic (no IP specification), creating a full tunnel VPN [S13]
- Internet gateway dns leak warning: Default client DNS must be specified to avoid DNS leaks [S12]
- Internet gateway hosts pro: yes [S12]
- Internet gateway ipv6 support: IPv6 support work in progress [S12]
- Intune deployment support: Netmaker Desktop can be deployed to Windows devices via Microsoft Intune with silent installation, automatic configuration and startup [S18]
- Intune win32 packaging: Deployment package is created with Microsoft Win32 packaging tool (IntuneWinAppUtil.exe) producing a .intunewin file [S18]
- K8s operator: Kubernetes operator available [S7]
- Managed dns: 0.30.0 · yes [S21]
- Managed dns format: <device-name>.<network-name> [S21]
- Managed dns platforms: Windows · macOS · Linux [S21]
- Mdm compliance options: require_mdm_enrollment · require_mdm_compliance · max_state_age_hours [S15]
- Mesh default: yes [S4]
- Mesh overlay: WireGuard-based encrypted mesh overlay network with policy-driven connectivity [S2]
- Mesh switchable: yes [S4]
- Message broker: Mosquitto (MQTT) · yes [S21]
- Mobile app: yes [S7]
- Mobile app: iOS · Android [S21]
- Mqtt dynamic mesh: MQ pub-sub enables dynamic mesh updates to peers [S21]
- Msp platform: MSP Platform for launching managed networking service [S1]

**Support**
- Contract termination for noncompliance: 15 [S10]
- Docs deprecation: learn.netmaker.io · yes [S8]
- Docs location: These docs are deprecated; new documentation at learn.netmaker.io [S19]
- Docs migration: deprecated, moved to learn.netmaker.io [S21]
- Docs page updated: 6 months ago [S16]
- Unlimited questions: no [S10]

99 more facts on the canonical page: https://whats-best.ai/software/business-vpn/netmaker

## Questions

### Is Netmaker European?

No. whats-best.ai classifies Netmaker as Rest of world.

### Where does Netmaker store data?

Not stated on the vendor’s pages as of 5 Nov 2026.

### Does Netmaker have a free plan?

Not stated on the vendor’s pages as of 5 Nov 2026.

### What are the best alternatives to Netmaker?

As of 6 Nov 2026, the panel rates [Defguard (3.5/5)](https://whats-best.ai/software/business-vpn/defguard), [Firezone (3.5/5)](https://whats-best.ai/software/business-vpn/firezone) and [Tailscale (3.5/5)](https://whats-best.ai/software/business-vpn/tailscale) highest among the other 12 Business VPN & Zero Trust Access products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is [Defguard](https://whats-best.ai/software/business-vpn/defguard) (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: [how scores are made](https://whats-best.ai/methodology#ordering). The full list, with European products first: [Netmaker alternatives](https://whats-best.ai/software/business-vpn/netmaker/alternatives).

## What this page leaves out

- 23 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 6 integrations facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 4 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 3 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 3 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 3 support facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 1 sovereignty dimension could not be confirmed on the vendor’s own pages and is shown as unknown.

## Sources

- [S1] Vendor homepage: https://www.netmaker.io/ (checked 2026-11-05)
- [S2] Features page: https://www.netmaker.io/features (checked 2026-11-05)
- [S3] Features page (remote access gateway): https://www.netmaker.io/features/remote-access (checked 2026-11-05)
- [S4] Features page (mesh VPN): https://www.netmaker.io/features/mesh (checked 2026-11-05)
- [S5] Features page (access control lists): https://www.netmaker.io/features/acls (checked 2026-11-05)
- [S6] Features page (user management): https://www.netmaker.io/features/users (checked 2026-11-05)
- [S7] Documentation: https://docs.netmaker.io/ (checked 2026-11-05)
- [S8] API documentation: https://docs.netmaker.io/api (checked 2026-11-05)
- [S9] Pricing page: https://www.netmaker.io/pricing (checked 2026-11-05)
- [S10] Terms of service: https://www.netmaker.io/terms-and-conditions (checked 2026-11-05)
- [S11] Privacy policy: https://www.netmaker.io/privacy-policy (checked 2026-11-05)
- [S12] Access model & connectivity — found from sitemap: https://docs.netmaker.io/docs/features/remote-access-gateways-and-clients (checked 2026-11-05)
- [S13] Access model & connectivity — found from sitemap: https://docs.netmaker.io/docs/operations-guide/networking-scenarios-vpn-types-and-terminology (checked 2026-11-05)
- [S14] Identity, access policy & device posture — found from sitemap: https://learn.netmaker.io/features/acls-access-controls (checked 2026-11-05)
- [S15] Identity, access policy & device posture — found from sitemap: https://learn.netmaker.io/features/conditional-access/posture-checks (checked 2026-11-05)
- [S16] Logs, audit trail & incident response — found from sitemap: https://learn.netmaker.io/features/telemetry-and-logging/activity/network-flow-logs (checked 2026-11-05)
- [S17] Logs, audit trail & incident response — found from sitemap: https://learn.netmaker.io/integrations/siem-integration (checked 2026-11-05)
- [S18] Deployment, API & administration — found from sitemap: https://learn.netmaker.io/how-to-guides/netmaker-desktop-intune-deployment-guide (checked 2026-11-05)
- [S19] Deployment, API & administration — found from sitemap: https://docs.netmaker.io/docs/netmaker-saas/account-management (checked 2026-11-05)
- [S20] Architecture, reliability & security assurance — found from sitemap: https://www.netmaker.io/cybersecurity-incident-disclosure-policy (checked 2026-11-05)
- [S21] Architecture, reliability & security assurance — found from sitemap: https://docs.netmaker.io/docs/about/architecture (checked 2026-11-05)

---

Cite as: whats-best.ai, "Netmaker — Business VPN & Zero Trust Access", AI panel analysis, as of 2026-11-06. https://whats-best.ai/software/business-vpn/netmaker

Corrections: https://whats-best.ai/correct/1602?target=page