Deploying VYREON as your gateway firewall

1. Plan the gateway

VYREON is the gateway between your internet uplink and your internal networks, so it needs at least two network ports: one towards the internet and one towards your internal network. A separate management port or VLAN for the web console is recommended. Note which port goes where before you start; the setup asks for the role of every port (internet uplink, internal network, DMZ, management or unused).

• Keep console or out-of-band access to the machine (a keyboard and screen, a remote management card or the virtual machine console) in case a network change cuts you off.
• Decide which networks may reach the web console. By default only the management network may.
• If you plan an active/standby pair, read the high availability guide first: both nodes need the same release and the same port layout.

2. Choose how to install

VYREON is delivered in two forms. Installing either one changes nothing on the network: nothing is enforced until an administrator applies a configuration in the web console.

• Debian / Ubuntu package for an existing Debian 13 or Ubuntu 24.04 (or later) host on amd64. Install it with apt; VYREON runs as a system service and prints the console address and the location of the setup token at the end.
• VYREON appliance image: a minimal, hardened Debian system with VYREON preinstalled, as a raw disk image or qcow2 (VMDK on request), for Proxmox VE, KVM, VMware or bare metal. In a virtual machine, give it at least 2 vCPUs, 4 GB RAM, 8 GB of disk and two or more network cards. On first boot it creates its own secrets; you then give it a management address from the machine console.

Installation files and system requirements are on the download page.

Size the hardware for the features you plan to use: intrusion prevention needs considerably more CPU cores and memory than filtering alone. Benchmark on the target hardware before you commit to a throughput figure.

3. Sign in for the first time

1. Open https://<gateway-address>:8443/ in a current browser.
2. Expect a certificate warning: the console uses a self-signed certificate until you install your own or a Let's Encrypt certificate. Check the address, then continue.
3. Read the one-time setup token on the gateway (the installer tells you where it is) and create the first administrator account with a password of at least 12 characters.

The setup token exists only on the gateway, so only someone with access to the machine can create the first administrator.

4. Run the guided setup

After the first sign-in, the gateway setup wizard opens. It reads what it finds on the gateway, lets you correct it and saves your progress as you go; nothing is applied before the last step.

1. Welcome and checks: guided or manual setup, and pre-flight checks of the host.
2. Interfaces and VLANs: the role of every port and any VLANs.
3. Internet uplink: addresses, DNS and an optional backup uplink.
4. Internal networks: zone names, internet access and DHCP.
5. Public IPs and servers: your public address block, servers with their own public address and port forwards.
6. Access and security: who may open the console and SSH, two-factor sign-in, protections and intrusion detection.
7. Review and apply: a summary, then the network and the firewall policy are applied in order, each with a confirmation timer.

5. Apply and confirm changes safely

Every later change to the firewall policy or the network goes to a draft first. When you apply it, the gateway runs the new configuration on a confirmation timer (by default 60 seconds for the firewall and 2 minutes for the network). Check that you can still reach what you need, then confirm. If you do not confirm in time, for example because the change locked you out, the gateway returns to the previous configuration on its own, and your edits stay in the draft so you can fix them. The console reports a change as applied only after the gateway confirms it. See how VYREON works for the full picture.

6. After the first setup

• Restrict which addresses may reach the console under Settings, Access control. VYREON refuses a list that would lock out your current address.
• Turn on two-factor sign-in, and give your colleagues their own accounts with the Admin, Operator or Viewer role.
• Install a trusted certificate: upload your own or issue one from Let's Encrypt.
• Configure backups and notifications, and decide how software updates are installed (notify only by default).
• Install your licence under Settings, Licence. Until then the 30-day trial includes every feature; no licence state ever reduces protection.

Troubleshooting the first steps

The browser cannot connect to the console

Check that the gateway has a management address (on the appliance, set it from the machine console), that your computer has a route to it and that you use port 8443. If the connection is reset immediately, your address is probably not on the console access list; an administrator can add it from the gateway's own console.

The browser shows a certificate warning

Expected until you install a trusted certificate, or when you browse to a different name than the certificate was issued for.

A change was rolled back

It was not confirmed in time, or the gateway could not apply it. Your edits are still in the draft: correct them and apply again.

The setup token is rejected

Copy the whole token again from the gateway; it contains no spaces. It is valid only until the first administrator exists.

Still stuck? Contact us; customers with a licence can open a support ticket in the customer portal. Explore all firewall features before you deploy.