Network visibility for OpenWrt — from clients and applications to flows and destinations.

English · 简体中文

NetQmon is a self-hosted network observability platform built for OpenWrt. It shows what is using your network, where traffic is going, and how that activity changes over time — without turning the router itself into a heavy analytics box.

A lightweight Agent runs on the gateway and collects flow telemetry with TC eBPF. The Controller handles storage, classification, realtime views, historical queries, and the web interface.

NetQmon focuses on observability. It is not intended to replace your firewall, QoS, or network policy system.

flowchart LR
  subgraph Gateway["OpenWrt Gateway"]
    BPF["TC eBPF"]
    Agent["NetQmon Agent"]
    BPF --> Agent
  end

  Agent -->|" Flow / DNS / device telemetry "| Collector["Collector"]
  Collector --> Classifier["Classifier"]
  Collector --> Storage[("SQLite / ClickHouse")]
  Collector --> UI["Next.js Web UI"]
  Cloud["NetQmon Cloud\nRule & update services"] -. " optional " .-> Classifier

The Agent stays focused on capture and lightweight enrichment. Expensive work — classification, aggregation, historical queries, and visualization — belongs on the Controller.

git clone https://github.com/jarvis2f/netqmon.git
cd netqmon
docker compose up -d

1. Open http://localhost:3000 after the Controller becomes healthy to complete the initial administrator setup.
2. Navigate to Settings and click Update GeoIP & ASN Database to enable geographic location and ASN enrichment for destination traffic.
3. Note or configure the Enrollment Token (default or via environment variable) to authenticate your OpenWrt Agent.

SQLite is the default storage backend. ClickHouse can be enabled when you need higher ingest volume or longer retention. See Controller Configuration for environment variables, ports, and storage options.

NetQmon currently targets OpenWrt 24.10+ on x86_64 and aarch64. Linux 6.6+ is recommended; kernels 5.15+ may work when the required eBPF/TC capabilities are available. See the Platform Support Matrix for details.

Install the required kernel modules first:

opkg update
opkg install kmod-sched-core kmod-sched-bpf

Then install the NetQmon Agent package and, if wanted, the LuCI app from a release. Configure the Controller address and verify the router with:

netqmon-agent doctor

See Agent CLI Reference for command-line options, diagnostics, UCI configuration, and environment variables.

NetQmon Community and Pro use the same monitoring engine and interface. The difference is the classification data available to them.

Pro extends recognition coverage; it does not unlock a different capture engine or a separate set of monitoring features.

More information is available at netqmon.com.

NetQmon is designed for traffic metadata and network observability, not content inspection. Protocol identification may use small, bounded samples from the beginning of a flow when needed. NetQmon does not decrypt TLS.

The standard deployment keeps the Controller and traffic database on infrastructure you operate.

See Privacy for the implementation details and probe limits.

bpf/                         TC eBPF data plane
crates/agent/                OpenWrt userspace Agent
crates/collector/            Ingestion, DPI, realtime and query pipeline
crates/classifier-client/    Classification client
crates/classifier-manager/   Rule lifecycle and updates
crates/storage/              SQLite / ClickHouse storage
apps/controller-ui/          Next.js Controller UI
packaging/openwrt/           OpenWrt packages and LuCI app
deploy/docker/               Controller container build
docs/                        Architecture, deployment and protocol docs

Backend:

cargo test --workspace

Controller UI:

pnpm install
pnpm lint
pnpm typecheck
pnpm build
pnpm e2e

NetQmon is licensed under the Apache License 2.0.

Live Demo · Website · Releases