Document a client network in one place.
Network Builder is a free, open-source network documentation tool for MSPs and internal IT teams. Map the topology, record assets, plan IP addresses and VLANs, and show the current and future network design.
A useful network record connects the diagram to the details.
A topology diagram helps you see how a network is connected. The technician still needs the asset, addressing and VLAN information behind each component before they can troubleshoot it or plan a change. Network Builder keeps those records together.
We built it for the point between discovery and delivery. You can record what exists, mark the details that still need verification, and draw the future design without losing the current one. The same register can then produce a cleaner report for management.
What the network register holds.
Topology
Place firewalls, switches, access points, servers and other components on a snapping grid, then label the connections between them.
Asset register
Keep the identifying and operational information for each item beside the diagram where it appears.
IP and VLAN plan
Record addressing and network segmentation in the same register instead of maintaining another spreadsheet.
Current and future state
Mark each record as Current or Future so an existing environment and the proposed design can be documented together.
Verification status
Use Known, Needs Verification, Planned or Retired to show what has been confirmed and what still needs work.
Management report
Create a print-ready report with a rendered topology while keeping public WAN addresses and management IPs out of it.
A practical workflow for documenting a network.
Build what exists today
Start with the sites, network components and connections you can confirm. Mark anything uncertain as Needs Verification so an assumption cannot quietly become part of the design.
Connect the records
Add the asset details, IP ranges and VLANs beside the topology. This gives the next technician one place to check how a device fits into the network.
Plan the future state
Add proposed equipment and links as Future and Planned. The existing network stays visible while the replacement design is being prepared and reviewed.
Hand over the useful view
Generate the management report for review, then export the full register as JSON when another technical team needs a portable copy.
You host the register in your own Cloudflare account.
Cloudflare Workers serves the application and its API. D1 holds the shared register and its revision history. Cloudflare Access decides who can open it and the Worker verifies the Access token again for every API request.
The browser keeps the current state in memory and doesn't store a copy of the register. Closing the tab or reaching the end of the Access session leaves no register data saved in browser storage.
- Cloudflare Workers
- Hosts the interface and the API used to load and save the register.
- Cloudflare D1
- Stores the shared JSON document and a snapshot of each version it replaces.
- Cloudflare Access
- Controls who can sign in. The application doesn't maintain a separate user database.
- Version checks
- Reject a save when another person has already changed the register, then reload the newer version.
Know what the tool isn't built to do.
Network Builder is intentionally a documentation and planning tool. These boundaries matter before you put client information into it.
| Boundary | What it means |
|---|---|
| No live discovery | Network Builder records what your team enters. Verify the real configuration before relying on it during an outage or change. |
| No secret storage | Don't put passwords, VPN keys or pre-shared keys in the register. Use a proper credential manager. |
| One register per deployment | Each deployment holds one shared register. Separate client environments should use separate deployments. |
| No role separation | Anyone admitted by the Cloudflare Access policy can edit the register. |
| Clear-text exports | JSON exports contain the full register and should be handled as client-confidential files. |
Install it in your own Cloudflare account.
The repository includes the application, the D1 schema and the Worker configuration. You clone it, create the D1 database, attach your own hostname, place Cloudflare Access in front and deploy it with Wrangler.
Create the database
Create D1, add its database ID to Wrangler and initialise the tables.
Protect the hostname
Add a Cloudflare Access application and decide which people or domain can sign in.
Deploy the Worker
Deploy to the custom hostname and check the Access policy before adding real data.
Common questions.
Is Network Builder free?
Yes. The source code is available under the MIT licence. You still need your own Cloudflare account and domain to deploy it.
Does it discover the network automatically?
No. Your team enters and verifies the information. This keeps the register useful for documenting planned networks as well as equipment that already exists.
Can it document more than one client?
Each deployment holds one shared register. Use a separate deployment when client environments need to remain separated.
Can we store passwords in it?
No. Keep passwords, VPN keys and pre-shared keys in a credential manager. Network Builder is built for network documentation.
Can we export the documentation?
Yes. The full register can be exported as portable JSON. The management view can also be printed to PDF with its rendered topology diagram.
Who can edit the register?
Anyone allowed through the Cloudflare Access policy can edit it. The current release doesn't provide separate viewer and editor roles.
Build the network record your team needs.
Review the source, deploy it in your Cloudflare account and adapt the starting data to the environment you are documenting.
Free, and no obligation. If an audit is not right for you, we will say so.