narrowin/open

Try our open tools.

Four browser tools: an OT protocol explorer, plus VLAN, subnet, and communication-matrix planning. Two GitHub repositories: networka (multi-vendor CLI) and ansible-mikrotik (RouterOS playbooks).

[ Browser tools ]

Plan VLANs, subnets, and zone-to-zone policy in the browser.

Single-purpose tools for OT network and segmentation work. No login, no tracking, no data leaves the page.

[ Tool ]
VLAN Planner
Zone and VLAN design from a Purdue template (ISA-95 / IEC 62443) or blank. Per-zone VLANs, subnets, host-isolation flags, CSV export.
Open VLAN Planner
[ Tool ]
Subnet Calculator
CIDR maths, equal split into N subnets, find next available inside a parent block. Handles /31 (RFC 3021) and /32 correctly.
Open Subnet Calculator
[ Tool ]
Communication Matrix
NxN matrix of zone pairs with a default policy per pair and specific protocol rules as exceptions. Export the result as a firewall ruleset.
Open Communication Matrix
[ Tool ]
OT Protocol Explorer
Every OT and industrial protocol mapped to its OSI layer, ports and security posture. Search by name, port or EtherType, and filter by industry.
Open OT Protocol Explorer

When narrowin runs a segmentation engagement with you, six more tools join these into one design: Security Zones, microsegmentation, network hardening, IPAM, operating-model planner, and a multi-quarter roadmap. They live at toolbox.narrowin.ch behind a login. How the toolbox supports a project →

[ Open source ]

Two projects narrowin maintains on GitHub.

Apache 2.0. Used in production at narrowin and by other operators. Both install in seconds.

[ Repository ]
networka
apache-2.0 python 3.11+ multi-vendor cli

Multi-vendor CLI for running commands, backups, file transfers, and firmware operations.

  • Vendors — MikroTik RouterOS, Cisco IOS / IOS-XE / NX-OS, Arista EOS, Juniper JunOS
  • Concurrent by default — runs across devices and groups in parallel
  • YAML or CSV inventory with device tagging and grouping
  • Library API for programmatic use
  • One-liners against an IP, no config file required
github.com/narrowin/networka
install · networka
# isolated install $ uv tool install networka # or via pipx $ pipx install networka # run against an IP, no config $ nw run --platform mikrotik_routeros \ 192.0.2.10 "/system/identity/print"
[ Repository ]
ansible-mikrotik
apache-2.0 ansible routeros containerlab

Idempotent playbooks for the full MikroTik RouterOS lifecycle: configure, backup, SSL-API setup, upgrade, reboot. In production at scicore.ch and elsewhere.

  • Full configuration deployment — interfaces, bridges, routing, firewall, VPN
  • Config and system backups — .rsc and .backup files
  • SSL-API setup — certificates and config in one run
  • containerlab lab included — dry-run against virtual switches
  • group_vars + host_vars inheritance — override per device
github.com/narrowin/ansible-mikrotik
install · ansible-mikrotik
# clone and set up $ git clone https://github.com/narrowin/\ ansible-mikrotik.git $ pip install -r requirements.txt # bring up a lab, then run $ clab deploy -t containerlabs/s3n.clab.yml $ ansible-playbook \ playbooks/mikrotik-configure.yml \ --limit mikrotik_s3n --check --diff

Using any of this in production?

Tell us how: issues, suggestions, contributions all welcome.

Talk to us