← Back to Docs

Quick Start

From zero to a connected client in 5 minutes.

Prerequisites

  • • An active WireZTNA partner account (admin panel access)
  • • A Linux machine on your client's network for the publisher (any VM, bare metal, or cloud instance)
  • • A workstation (macOS, Windows, or Linux) for the client
1

Install the Publisher

In the admin panel, go to Publishers and click "+ Add Publisher". This generates a one-time enrollment token and shows you a one-liner command.

SSH into your client's Linux machine and run the command:

curl -fsSL https://your-tenant.wireztna.com/api/v1/publishers/install.sh | sudo bash

This downloads the publisher binary (8 MB), enrolls it with the broker using the embedded token, creates a WireGuard tunnel, and installs a systemd service. Takes ~10 seconds.

What happens under the hood:

  1. Downloads wireztna-publisher static binary
  2. Generates a WireGuard keypair locally (private key never leaves the machine)
  3. Registers with the broker via the enrollment token
  4. Establishes a persistent WireGuard tunnel to the broker
  5. Installs as a systemd service (auto-starts on boot)
2

Create a User and Generate Enrollment Token

In the admin panel:

  1. Go to Users → + New User — enter the user's email
  2. Go to Groups — assign the user to a group that has access to the publisher
  3. Click the user → Enrollment tab → Generate Token
  4. Copy the enrollment URL and send it to the user

The enrollment URL looks like: https://your-tenant.wireztna.com/api/v1/clients/enroll?token=abc123...

Tokens are one-time use, expire in 24h, and can be revoked from the admin panel.

3

Enroll and Connect the Client

On the user's workstation, run these three commands:

Enroll (registers the device with the broker):

wireztna enroll "https://your-tenant.wireztna.com/api/v1/clients/enroll?token=abc123"

Login (authenticates the user):

wireztna login

Connect (establishes the tunnel):

sudo wireztna connect

On Windows, use an elevated PowerShell instead of sudo. On macOS/Linux, sudo is needed for creating the network interface.

4

Verify Connectivity

Once connected, the client can reach resources on the publisher's network:

# Ping a host on the publisher's LAN
ping 10.50.1.100

# Access a service
curl http://10.50.1.100:8080

# Check tunnel status
wireztna status

The client only has access to the CIDRs exposed by publishers in their assigned groups. All other traffic stays on the user's default network (split tunnel).

What's next?

Understand the architecture Check network requirements Automate with the API Review security practices