network

VPN network management commands for NDCLI. These commands allow you to create and manage WireGuard-based overlay networks, add devices as members, configure links between members, and publish IP prefixes.

Command alias: net

Commands

Command	Description
network list	List VPN networks
network describe	Show VPN network details
network create	Create a VPN network
network update	Update a VPN network
network delete	Delete a VPN network
network member list	List VPN network members
network member describe	Show VPN member details
network member add	Add a device as VPN member
network member update	Update a VPN member
network member remove	Remove a VPN member
network link list	List VPN connections
network link describe	Show VPN connection details
network link create	Create a VPN link between two members
network link update	Update a VPN link
network link delete	Delete a VPN link
network prefix list	List published prefixes for a VPN member
network prefix add	Publish a prefix on a VPN member
network prefix update	Update a VPN member prefix
network prefix remove	Remove a prefix from a VPN member

---

network list

List all VPN networks in the organization.

ndcli network list [flags]

Flags

Flag	Type	Default	Description
--page	int	1	Page number
--per-page	int	30	Items per page

Examples

ndcli network list

ndcli network list -f json

---

network describe

Show detailed information about a VPN network.

ndcli network describe [network]

Arguments

Argument	Required	Description
network	Yes	Network name

Examples

ndcli network describe my-network

ndcli network describe my-network -f json

---

network create

Create a new VPN overlay network.

ndcli network create [name] [flags]

Arguments

Argument	Required	Description
name	Yes	Network name

Flags

Flag	Type	Default	Description
--cidr	string		Overlay CIDR (required, e.g. 10.100.0.0/24)
--listen-port	int	51820	Default WireGuard listen port
--mtu	int		Default MTU (1280–9000)
--keepalive	int		Default keepalive interval (1–65535 seconds)
--auto-connect-hubs	bool	false	Auto-create links between HUB members

Examples

ndcli network create my-network --cidr 10.100.0.0/24

ndcli network create branch-vpn --cidr 10.200.0.0/24 --listen-port 51821 --keepalive 25

ndcli network create hub-network --cidr 10.0.0.0/24 --auto-connect-hubs

---

network update

Update an existing VPN network’s settings.

ndcli network update [network] [flags]

Arguments

Argument	Required	Description
network	Yes	Network name

Flags

Flag	Type	Default	Description
--name	string		New network name
--listen-port	int		Default WireGuard listen port
--mtu	int		Default MTU (use 0 to clear)
--keepalive	int		Default keepalive interval (use 0 to clear)
--auto-connect-hubs	bool		Auto-create links between HUB members
-y, --yes	bool	false	Skip confirmation prompt

Examples

ndcli network update my-network --name new-name

ndcli network update my-network --keepalive 25

ndcli network update my-network --mtu 0

---

network delete

Delete a VPN network.

ndcli network delete [network] [flags]

Arguments

Argument	Required	Description
network	Yes	Network name

Flags

Flag	Type	Default	Description
-y, --yes	bool	false	Skip confirmation prompt

Examples

ndcli network delete my-network

ndcli network delete my-network --yes

Danger

This permanently deletes the network, all its members, links, and prefix configurations. Member devices are not removed from the organization.

---

network member list

List all members in a VPN network.

ndcli network member list [network] [flags]

Arguments

Argument	Required	Description
network	Yes	Network name

Flags

Flag	Type	Default	Description
--page	int	1	Page number
--per-page	int	30	Items per page

Examples

ndcli network member list my-network

ndcli network member list my-network -f json

---

network member describe

Show detailed information about a VPN network member.

ndcli network member describe [network] [device]

Arguments

Argument	Required	Description
network	Yes	Network name
device	Yes	Device name

Examples

ndcli network member describe my-network my-firewall

---

network member add

Add a device to a VPN network as a member.

ndcli network member add [network] [device] [flags]

Arguments

Argument	Required	Description
network	Yes	Network name
device	Yes	Device name

Flags

Flag	Type	Default	Description
--role	string	SPOKE	Member role: HUB or SPOKE
--overlay-ip	string		Overlay IPv4 address (auto-allocated if empty)
--endpoint-host	string		Public hostname or IP for incoming connections
--endpoint-port	int		Public endpoint port
--listen-port	int		WireGuard listen port override
--mtu	int		MTU override
--keepalive	int		Keepalive interval override (seconds)
--transit-via-hub	string		Route through this HUB device name
--enabled	bool	true	Enable the member

Member Roles

Role	Description
HUB	Acts as a relay; auto-connects to all SPOKE members and (if auto-connect-hubs is on) other HUBs
SPOKE	Connects to HUBs automatically; spoke-to-spoke requires a manual link

Examples

# Add a spoke member (auto-allocated overlay IP)
ndcli network member add my-network branch-firewall

# Add a hub member with a public endpoint
ndcli network member add my-network datacenter-fw \
  --role HUB \
  --endpoint-host vpn.example.com \
  --endpoint-port 51820

# Add a spoke with a specific overlay IP
ndcli network member add my-network remote-fw --overlay-ip 10.100.0.5

---

network member update

Update a VPN network member’s settings.

ndcli network member update [network] [device] [flags]

Arguments

Argument	Required	Description
network	Yes	Network name
device	Yes	Device name

Flags

Flag	Type	Default	Description
--role	string		Member role: HUB or SPOKE
--endpoint-host	string		Public hostname or IP (use none to clear)
--endpoint-port	int		Public endpoint port (use 0 to clear)
--listen-port	int		WireGuard listen port override (use 0 to clear)
--mtu	int		MTU override (use 0 to clear)
--keepalive	int		Keepalive interval override (use 0 to clear)
--transit-via-hub	string		HUB device to route through (use none to clear)
--enabled	bool		Enable or disable the member
--regenerate-keys	bool	false	Regenerate the WireGuard keypair

Examples

ndcli network member update my-network branch-fw --endpoint-host new.ip.example.com

ndcli network member update my-network branch-fw --endpoint-host none

ndcli network member update my-network branch-fw --regenerate-keys

---

network member remove

Remove a device from a VPN network.

ndcli network member remove [network] [device] [flags]

Arguments

Argument	Required	Description
network	Yes	Network name
device	Yes	Device name

Flags

Flag	Type	Default	Description
-y, --yes	bool	false	Skip confirmation prompt

Examples

ndcli network member remove my-network branch-fw

ndcli network member remove my-network branch-fw --yes

---

network link list

List all effective VPN connections in a network. By default, shows effective connections derived from member roles. Use --raw to see only explicit link overrides stored in the database.

ndcli network link list [network] [flags]

Arguments

Argument	Required	Description
network	Yes	Network name

Flags

Flag	Type	Default	Description
--device	string		Filter connections involving this device
--raw	bool	false	Show raw link database rows instead of effective connections
--page	int	1	Page number (only with --raw)
--per-page	int	30	Items per page (only with --raw)

Connection Rules

Pair	Connected?
HUB ↔ SPOKE	Always (automatic)
HUB ↔ HUB	Automatic if auto-connect-hubs is enabled on the network
SPOKE ↔ SPOKE	Only via a manual link (network link create)

Examples

ndcli network link list my-network

ndcli network link list my-network --device branch-fw

ndcli network link list my-network --raw

---

network link describe

Show details of a specific VPN connection between two members.

ndcli network link describe [network] [device-a] [device-b]

Arguments

Argument	Required	Description
network	Yes	Network name
device-a	Yes	First device name
device-b	Yes	Second device name

Examples

ndcli network link describe my-network spoke-a spoke-b

---

network link create

Create a manual VPN link between two network members. This is required for SPOKE-to-SPOKE connections.

ndcli network link create [network] [device-a] [device-b] [flags]

Arguments

Argument	Required	Description
network	Yes	Network name
device-a	Yes	First device name
device-b	Yes	Second device name

Flags

Flag	Type	Default	Description
--enabled	bool	true	Enable the link
--generate-psk	bool	false	Generate a WireGuard pre-shared key for additional security

Examples

ndcli network link create my-network spoke-a spoke-b

ndcli network link create my-network spoke-a spoke-b --generate-psk

---

network link update

Update a VPN link between two members.

ndcli network link update [network] [device-a] [device-b] [flags]

Arguments

Argument	Required	Description
network	Yes	Network name
device-a	Yes	First device name
device-b	Yes	Second device name

Flags

Flag	Type	Default	Description
--enabled	bool	true	Enable or disable the link
--regenerate-psk	bool	false	Regenerate the pre-shared key

Examples

ndcli network link update my-network spoke-a spoke-b --enabled=false

ndcli network link update my-network spoke-a spoke-b --regenerate-psk

---

network link delete

Delete a VPN link between two members.

ndcli network link delete [network] [device-a] [device-b] [flags]

Arguments

Argument	Required	Description
network	Yes	Network name
device-a	Yes	First device name
device-b	Yes	Second device name

Flags

Flag	Type	Default	Description
-y, --yes	bool	false	Skip confirmation prompt

Examples

ndcli network link delete my-network spoke-a spoke-b

---

network prefix list

List all IP prefixes published by a VPN network member.

ndcli network prefix list [network] [device] [flags]

Arguments

Argument	Required	Description
network	Yes	Network name
device	Yes	Device name

Flags

Flag	Type	Default	Description
--page	int	1	Page number
--per-page	int	30	Items per page

Examples

ndcli network prefix list my-network branch-fw

---

network prefix add

Publish an IP prefix on a VPN network member. The prefix is defined by a variable (typically of type prefix) associated with that device.

ndcli network prefix add [network] [device] [variable] [flags]

Arguments

Argument	Required	Description
network	Yes	Network name
device	Yes	Device name
variable	Yes	Variable name that holds the prefix value

Flags

Flag	Type	Default	Description
--publish	bool	true	Advertise the prefix to other VPN peers

Examples

ndcli network prefix add my-network branch-fw lan_prefix

ndcli network prefix add my-network branch-fw lan_prefix --publish=false

---

network prefix update

Update the settings of a published prefix on a VPN member.

ndcli network prefix update [network] [device] [variable] [flags]

Arguments

Argument	Required	Description
network	Yes	Network name
device	Yes	Device name
variable	Yes	Variable name

Flags

Flag	Type	Default	Description
--publish	bool	true	Whether to advertise the prefix to peers

Examples

ndcli network prefix update my-network branch-fw lan_prefix --publish=false

---

network prefix remove

Remove a published prefix from a VPN network member.

ndcli network prefix remove [network] [device] [variable] [flags]

Arguments

Argument	Required	Description
network	Yes	Network name
device	Yes	Device name
variable	Yes	Variable name

Flags

Flag	Type	Default	Description
-y, --yes	bool	false	Skip confirmation prompt

Examples

ndcli network prefix remove my-network branch-fw lan_prefix