NetPulse: self-hosted, monitoring for OpenWrt networks (looking for beta testers)

Community Builds, Projects & Packages
1

Hi everyone,

I want to introduce NetPulse, a personal project I'm building since a few months ago and that is finally in a presentable state: a read-only monitoring panel for networks built with OpenWrt, self-hosted.

My context: at home I have four routers with OpenWrt (a Flint 2 as gateway and three second-hand Xiaomi AX6 as APs), and I was always missing a unified view of what was happening in the network: what connects where, how each AP is doing, how the roamings between nodes are going. I didn't find anything that fitted me, all the solutions are from brands and work only with their closed ecosystem.

What NetPulse does:

  • Fleet view: per-router health (CPU, memory, temperature, uptime), live WAN traffic and latency.
  • Live topology map, inferred from the bridge FDB (and LLDP when available): wired and wireless clients, detected switches and hypervisors, WireGuard tunnels drawn.
  • Devices: every client classified by type, with band, signal and first time seen.
  • Roaming: DAWN signal matrix, 802.11r status per SSID and roaming events history (30 days).
  • WireGuard (peers, handshakes, transfer) and AdGuard Home (queries, top blocked domains).
  • Alerts with native push notifications (Web Push, no third-party services).
  • Multi-user, ES/EN, installable PWA.

Design:

  • A single static Go binary with the frontend embedded + SQLite. No Docker, pure systemd.
  • Read-only by design: the server generates its own ed25519 keypair, you authorize the public one on each router and it only reads (ubus, /proc, iwinfo, bridge fdb, wg show). It cannot touch your network.
  • Optional agent for the routers (.ipk, ~12 MB RAM, <1% CPU) if you want real-time wifi events.
  • Everything local: no data leaves the network. Everything for OpenWrt.

Real state: I use it 24/7 in several real networks (my home, work and some friends and family), it's quite stable, but it has not been tested with tens or hundreds of users, any OpenWrt router should work (in theory).

I think it covers a GAP for this community and I would love to know if it can help other people, I'm looking for feedback of any kind, beta testers with hardware different from mine and, if someone wants to collaborate (code, ideas, translations, testing and reporting), you are welcome. In the roadmap there is a beta-testing program with stable/unstable channels and I would like to start it with people from here.

imagen
imagen2447Ă—1250 398 KB

2 Likes
2

Nice! I just let it connect to three OpenWrt switches that are connected to each other, but it did not learn the topology from LLDP. Does it take some time or hints?

192.168.66.254_3000_routers_router-11
192.168.66.254_3000_routers_router-11696Ă—3454 237 KB

3

Thanks for the feedbak :slight_smile:

NetPulse builds the topology from the switches' MAC tables and only uses LLDP to put a name on what it finds, but for that it needs lldpd installed on each OpenWrt box, which doesn't ship by default. A quick opkg install lldpd, enable and start it, and within a minute or two your switches should show up as identified managed switches.

Also the map anchors everything to the gateway, so a switch hanging behind another switch gets drawn off the gateway rather than as a true chain. Proper chained rendering is on the ideas list.

Let me know what you see after installing lldpd, happy to dig further if something still looks off.

4

Maybe it does not like the FDB or OpenWrt snapshot, yet?

I started a fresh v2.10.2 and gave it access to three switches, the gateway and two APs (Gluon).

The gateway and switches all run lldpd.

I can open issues for the small nits I noticed, or list them here.

  • The "copy" for the SSH key does not copy
  • links are not discovered :frowning:
  • wired clients are not discovered (that made me wonder if the FDB is read at all)
  • the router screen does show an empty MAC address on all my devices (edit: was router screen does not show MAC for easier manual link configuration)
  • on the topology screen, when I want to look up the details of a router the popup vanishes before I can click
  • alerts for devices added by name being offline don't clear. Its the two Gluon APs that live on IPv6 tunnel with network restrictions. I'm not sure how it is tested.
  • a detected gateway without SSH access is shown as offline

There is a new beta feature in snapshots to add labels to ports an VLANs for luci. That could be another source to learn names from in addition to LLDP.

config switchvlan 'port_labels'
        option lan1 'Router/Fritzbox'

config switchvlan 'vlan_labels'
        option 1 'lan-legacy'
        option 10 'fritzguest'
        option 20 'FreifunkClient'
        option 22 'FreifunkMesh'
        option 30 'MaaS'
        option 40 'lan-dennis'
root@lgs352c:~# cat /etc/config/luci
5

Thank you so much for your feedback! (my first user, yeyyy), I'll open issues in github, you can also help there if you have time and want to :slight_smile:

6

Hi @gnacho, how are you?

I like the software and plan to test it soon...

I'm from Brazil, and I have a setup at home similar to yours—specifically, an x86 router and 3 APs. I also have a WireGuard server and AdGuard Home installed on the x86 router.

I've been following the posts and will be joining the conversation here soon.

See you soon!

1 Like
7

Thank you! Be aware that I barely use wireguard and adguard just works (right now) with gl-inet forked version, but with some feedback should be easy to adapt to native openwrt.

Thank you very much!

8

Allright..

At this moment, I have only 1 client wireguard configured, my cell phone...

I tried installing it here and got the errors below...

First, I ran *opkg update*...

Then I ran *opkg install ./netpulse-agent_*.ipk ./luci-app-netpulse_*.ipk*

root@horus:~# opkg install ./netpulse-agent_*.ipk ./luci-app-netpulse_*.ip
Collected errors:
 * wfopen: ./netpulse-agent_*.ipk: No such file or directory.
 * pkg_init_from_file: Failed to extract control file from ./netpulse-agent_*.ipk.
root@horus:~#

I'm running version 24.10.5 here.

9

Didn't try in older versions, any chance you can upgrade to 25? Otherwise I can compile opkg compatible package, so scope of support for versions will be higher.

10

Thanks...

But right now, I don't see any need to upgrade my system, as it runs perfectly and I see a lot of issues on the forum related to version 25...

Maybe later on, yes, but for the moment, I prefer to leave it as is—super stable and 100% functional.

11

You can try last release, with ipk packages :crossed_fingers:

12

Thank you for this nice software.
A missing piece.

A few things I have recognized so far, please understand this as constructive feedback.

  • No devices are discovered - What are you discovering with?
  • I have manually onboarded my router, my switch and one AP with FQDN, TTL is 600sec, still netpulse is quering my resolver every 5 seconds
  • No IP addresses are shown in Client panel, only the MAC addresses
  • language is set to english, still I see a lot of spanish strings
  • AdGuardHome, a configuration option: port, FQDN and not only on the router, would be great
    version 2.18.0
1 Like
13

Duplicated message --

14

Thanks for the feedback, I'm working on it. News soon :slight_smile:

1 Like
15

Can you update to the latest release? That should be fixed. Let me know, thanks.

16

Thank you.

2.22.2:

image
image1680Ă—165 11.7 KB

No IP addresses for the clients.

image
image1737Ă—100 17.2 KB

AdGuard settings is possible, but reverts to port 3000 after saving and leaving the page.

17

Hello my humble feedback

The password change in the configuration page fails with an error: Failed to fetch
The SSH key copy button doesn't copy
The uninstall process does not eliminate the netpulse group, when you try to re-install the installation process fails with: useradd: group netpulse exists - if you want to add this user to that group, use -g.
Error when installing luci package: ERROR: /tmp/luci-app-netpulse_all.apk: v2 package format error

The latest version 2.25.0 didn't build any package, so the default install process fail

Thank you for this tool

18

Thank you for taking the time to test it and for the detailed report, this was genuinely useful. All five issues are fixed in v2.26.1 (https://github.com/gnacho/netpulse/releases/tag/v2.26.1), released a few minutes ago.

What was going on with each one:

  • Password change: the settings form was calling an endpoint that simply did not exist on the server side. It is implemented now: it verifies your current password and signs out your other sessions, keeping the one you are using.
  • SSH key copy button: the web app is normally served over plain HTTP on the LAN, and the clipboard API does not exist there, so the button failed silently. All copy buttons now fall back to the old execCommand path and tell you if even that fails.
  • Leftover netpulse group: the uninstaller only removed the user, and useradd refused to create it again on reinstall. The installer now reuses the group if it is already there, and the uninstaller removes it too.
  • v2 package format error: honest answer, that .apk was actually an .ipk with a different extension. apk-tools v3 was right to reject it. The LuCI app is now built as a real signed apk package with the 25.12 SDK. Note the new asset name: luci-app-netpulse-2.26.1-r1.apk.
  • No packages in v2.25.0: the release workflow ran the Go tests before building the embedded agent binaries, failed, and nothing got published. Fixed, and v2.26.1 has the full set of tarballs, checksums and OpenWrt packages back, so the one-liner install works again.

If you get a chance to try v2.26.1 on the same router, feedback welcome. Thanks again for the push, several of these would have stayed broken much longer without it.

19

This now works as expected, although it still fails to start the agent: there is no Settings-Agents option in the WEB UI where you could add a device...

20

Devices --> Agents, should manage from there.