For one person’s personal, non-commercial use.
NetSmart 1.0.12
Manage essential network services from one self-hosted web panel.
Deploy DNS, DHCP, NTP, directory services, Kerberos, mail, monitoring, and WireGuard or AmneziaWG from one Docker-based administration panel for small organizations, MSPs, labs, and private networks.
One infrastructure layer
Replace separate setup paths with one deployable stack.
Instead of maintaining separate DNS, DHCP, VPN, identity, mail, and monitoring tools, NetSmart provides one self-hosted administration layer for common infrastructure services in labs, private networks, and small organizations.
You keep the stack and its data in infrastructure you control, with no cloud dependency required for core services.
NetSmart Web Administration
DNSRecords & DoH
DHCPPools & leases
NTPTime service
IdentityLDAP / Kerberos / Samba AD
VPNWireGuard / AmneziaWG
MailSMTP / IMAP / POP3
MonitoringPrometheus / SNMP
OperationsAssistant & logs
MySQLPersistent configuration and data
Licensing
Choose the licence for how you use NetSmart.
Each annual licence covers one registered NetSmart service domain. Commercial use requires an active licence and annual renewal.
If the licence expires, DNS, DHCP, NTP, directory, Kerberos, mail, VPN, monitoring, and other core services remain active. The AI Assistant and integrations with PWAApps services—including SecurityBox, ChaparKhoneh, and PWA AI Relay—are disabled until the licence is renewed.
Get commercial licenceDeploy
Deploy on a native Linux host with Docker Compose.
The production stack includes MySQL, persistent volumes, host networking, and the permissions required by infrastructure services. Enable IPv4 forwarding before using WireGuard or AmneziaWG. Use the versioned image tag for predictable deployments.
Pull release 1.0.12
docker pull ssiroos/netsmartapp:1.0.12latest is available as a floating convenience tag; pin a version for controlled deployments.
Required after first startup: Sign in with the initial sa account and change its password immediately. Never keep the default sa123456 password on a running installation. Replace all example database passwords before deployment.
Capabilities
Operate the services a private network depends on.
One administration UI brings network foundation, identity, secure access, communications, and observability into the same operational workflow.
Network foundation
- Managed DNS records, forwarding, cache, and query logs
- DHCP pools and leases
- NTP with upstream failover
Identity and access
- LDAP-style directory with users, OUs, and policies
- Kerberos v5 KDC
- Optional Samba Active Directory domain controller
Secure remote access
- WireGuard and AmneziaWG server and peer management
- Downloadable client configurations
- NAT, handshake status, and traffic counters
Mail and protection
- SMTP, submission, SMTPS, POP3, and IMAP
- TLS, DKIM, SPF, and DMARC support
- Filtering, quarantine, trusted senders, and release workflow
Monitoring and operations
- Health dashboard and consolidated logs
- Prometheus-compatible metrics
- Read-only SNMP v2c agent
Administrator security and assistance
- CAPTCHA and optional email or authenticator-app MFA
- Optional assistant through Ollama or an OpenAI-compatible provider
Directory modes: The built-in LDAP-style directory is intended for application authentication and directory searches; it is not an Active Directory domain controller. Use the separate optional Samba AD profile when Windows domain join and a unified Windows-compatible identity domain are required.
Release and platform
Know the deployment boundary before you start.
Network-facing infrastructure protocols need direct access to the host network. A native Linux host or Linux virtual machine provides the intended runtime.
- Current release
- 1.0.12
- Deployment target
- Native Linux host or Linux VM
- Runtime
- Docker Compose with MySQL and persistent storage
- Windows Docker Desktop
- Evaluation only for network-facing features
- VPN requirements
- Host networking,
NET_ADMIN,/dev/net/tun, IPv4 forwarding, NAT, and inbound UDP 51820
Screenshots
See the NetSmart administration panel.
Operate with evidence
Plan updates, recovery, support, and limitations.
Updates
Review the changelog, take a backup, pull the pinned release, recreate the stack, and verify service health and logs. Do not treat latest as a production version pin.
Backup and restore
Back up MySQL data, data-protection keys, service logs, VPN configuration, TLS certificates, DKIM keys, and optional Samba AD data together. Test restoration on an isolated host.
Review backup guidanceSecurity and support
Restrict the admin panel, use HTTPS, expose only enabled service ports, and apply security updates after testing. Current scan results are published with release information when available.
Contact supportArchitecture limits: NetSmart is a consolidated single-stack deployment. High availability, clustering, and automatic failover are not claimed. Separate critical services or add redundancy when one-host downtime is unacceptable.
Articles
Open blog
Latest NetSmart articles.
SNMP and Prometheus Monitoring in NetSmart 1.0.7: Why Use Both?
Learn how NetSmart 1.0.7 adds a read-only SNMP v2c agent and a Prometheus-compatible metrics endpoint, what each monitoring method provides, and why teams use both.
Read article
What Is a Kerberos v5 KDC and Why Use It? NetSmart 1.0.7 Guide
Understand how a Kerberos v5 Key Distribution Center works, why ticket-based authentication matters, and what NetSmart 1.0.7 provides for managed KDC deployment.
Read article
Samba Active Directory Domain Controller for Windows with NetSmart 1.0.7
Learn how NetSmart 1.0.7 adds an optional Samba Active Directory Domain Controller for Windows domain join, integrated DNS, Kerberos, LDAP, SMB/RPC, and Global Catalog services.
Read articleFAQ
Questions before deployment.
What does the free individual licence permit?
It permits one person to use NetSmart for personal, non-commercial purposes.
What does the USD $99 commercial licence cover?
It covers commercial use for one registered NetSmart service domain for one year. Each additional registered domain requires its own annual licence.
What happens when a commercial licence expires?
Core network services are not deactivated: DNS, DHCP, NTP, directory, Kerberos, mail, VPN, monitoring, and related administration continue to operate. Commercial use is still legally subject to annual renewal. The AI Assistant and integrations with PWAApps services such as SecurityBox, ChaparKhoneh, and PWA AI Relay are disabled until renewal.
Does the commercial licence include updates and support?
It includes releases published during the active licence term. Support is available through the PWAApps contact channel; no guaranteed response time or managed-operation service is included.
Can NetSmart run on Windows Docker Desktop?
It can be evaluated there, but DHCP broadcasts, VPN routing, host networking, and practical Samba AD deployment should use a native Linux host or Linux VM.
Why does it require host networking?
DNS, DHCP, NTP, Kerberos, VPN, and other infrastructure protocols need direct access to host interfaces, broadcast traffic, privileged ports, or routing functions.
Is the built-in directory an Active Directory replacement?
No. It is a lightweight LDAP-style directory. Use the optional Samba AD profile for Windows domain join and Windows-compatible domain services.
What must be backed up?
Back up the MySQL database, data-protection keys, logs, VPN configuration, certificates, DKIM keys, and any Samba AD volumes as one recovery set.
How are security updates delivered?
Updates are delivered as versioned container images. Review release notes, back up the deployment, pull the selected tag, recreate the stack, and verify it before wider use.
Get started
Deploy NetSmart with a pinned release.
Start with the deployment guide, secure the first administrator account, and enable only the services your network needs.