Get started with wzctl

Quick start

1. Download

# Linux
curl -fsSL https://wireztna.com/dl/wzctl-linux-amd64 -o wzctl && chmod +x wzctl

# macOS (requires signing — see note below)
curl -fsSL https://wireztna.com/dl/wzctl-darwin-arm64 -o wzctl && chmod +x wzctl
xattr -cr wzctl && codesign --force -s - wzctl

Why the extra step on macOS?

macOS Sequoia blocks unsigned binaries from the internet. xattr -cr removes the download flag and codesign --force -s - signs it locally. Without this, macOS kills the process on launch.

2. Register

./wzctl register --broker https://freetier.wireztna.com --email you@example.com --save

Done once. Credentials saved to ~/.wireztna/token.

3. Create a publisher token

Tell WireZTNA which subnet to expose. Use the CIDR of the network where your target resource lives:

./wzctl token --broker https://freetier.wireztna.com \
  --cidrs "192.168.1.0/24" --name my-server

The output shows the commands to install the publisher. Copy them.

4. Install the publisher

SSH into the server that can reach your private resource and run the commands from step 3:

curl -fsSL https://wireztna.com/dl/wireztna-publisher-linux-amd64 -o wireztna-publisher
chmod +x wireztna-publisher
sudo ./wireztna-publisher install --token "<url_from_step_3>"
sudo systemctl start wireztna-publisher

The publisher connects outbound to the broker. No firewall changes needed on the server.

5. Connect

Get your publisher ID, then connect to your target:

# Check your publisher is online
./wzctl publishers --broker https://freetier.wireztna.com

# Connect (specify the exact IP and port you want to reach)
./wzctl connect --broker https://freetier.wireztna.com \
  --publisher pub_a7c3f9b2 \
  --target 192.168.1.100 --port 5432 \
  --ttl 30m --local-port 5432

Done. Your resource is now on localhost:5432:

psql -h localhost -p 5432 -U myuser mydb   # Works!

Free Tier vs Pro

Contact us to upgrade.

Tips

Reuse a pass (save quota)

Each connect creates a new pass (25/month on free tier). To retry or reconnect without consuming another, use --pass:

# First attempt — creates a pass
./wzctl connect --broker ... --publisher ... --target ... --port ... --ttl 30m --local-port 5432
# → Pass created (dap_c6fe0c)

# Retry with the same pass (no new pass consumed):
./wzctl connect --broker https://freetier.wireztna.com --pass dap_c6fe0c --local-port 5432

List and revoke passes

./wzctl passes list --broker https://freetier.wireztna.com
./wzctl passes revoke dap_c6fe0c --broker https://freetier.wireztna.com

Daemon mode (CI/Docker)

Add --daemon to run in background:

./wzctl connect --broker https://freetier.wireztna.com \
  --publisher pub_a7c3f9b2 --target 192.168.1.100 --port 5432 \
  --ttl 10m --local-port 5432 --daemon &
sleep 2
psql -h localhost -p 5432  # Ready

GitHub Actions example

- name: Connect to private database
  run: |
    curl -fsSL https://wireztna.com/dl/wzctl-linux-amd64 -o wzctl && chmod +x wzctl
    ./wzctl connect --broker https://freetier.wireztna.com \
      --publisher "$PUBLISHER_ID" --target 192.168.1.100 --port 5432 \
      --ttl 10m --local-port 5432 --daemon &
    sleep 2 && pg_isready -h localhost -p 5432
  env:
    PUBLISHER_ID: ${{ secrets.PUBLISHER_ID }}

Security

• Time-limited — passes auto-expire. No lingering access.
• Scoped — one pass = one IP:port. No network-wide access.
• Revocable — revoke instantly, connections drop in 1 second.
• Audited — every connection logged with bytes and duration.
• Outbound-only — wzctl only needs port 443 outbound.

Uninstall publisher

sudo systemctl stop wireztna-publisher && sudo systemctl disable wireztna-publisher
sudo rm /usr/local/bin/wireztna-publisher /etc/systemd/system/wireztna-publisher.service
sudo rm -rf /etc/wireztna-publisher/ && sudo systemctl daemon-reload

CLI reference

wzctl register  --broker URL --email EMAIL --save
wzctl token     --broker URL --cidrs CIDR --name NAME
wzctl publishers --broker URL
wzctl connect   --broker URL --publisher ID --target IP --port PORT --ttl DUR --local-port PORT [--daemon] [--pass ID]
wzctl passes list --broker URL
wzctl passes revoke PASS_ID --broker URL

With --pass, only --broker and --local-port are required.

Env vars: WIREZTNA_BROKER, WIREZTNA_TOKEN.

Next steps

• Ephemeral Access — product overview
• How AI agents access private infrastructure