Skip to Content
InstallationLinux

Install on Linux

Rabtly bundles its own WireGuard implementation. You do not need to install wireguard-tools or the kernel module.

One command installs the binary, registers the systemd service, and starts it:

curl -fsSL https://dl.rabtly.cloud/install.sh | sh

The script:

  • Downloads the correct binary for your arch (amd64 or arm64)
  • Verifies the SHA256 checksum
  • Installs to /usr/local/bin/rabtly
  • Runs sudo rabtly service install to register and start the systemd unit

Then sign in and connect:

rabtly login                                          # sign in (browser, password, or token)
sudo rabtly up --token enrt_...                      # connect to your network
rabtly status                                         # verify connection

Get your enrollment token from app.rabtly.cloud  → Settings → Access Tokens.

Step-by-step install

Install the binary

curl -fsSL https://dl.rabtly.cloud/install.sh | sh

To install a specific version:

curl -fsSL https://dl.rabtly.cloud/install.sh | sh -s -- --version 0.3.0

To install without registering a service (e.g. containers):

curl -fsSL https://dl.rabtly.cloud/install.sh | sh -s -- --no-service

Sign in

rabtly login

This opens an interactive menu — choose browser (recommended), password, or paste a personal access token.

Connect

sudo rabtly up --token enrt_...

The daemon starts in the background, registers with Rabtly, and brings up the VPN interface. Status is printed on success:

  ✓  Connected
  Node    my-linux-box
  IP      100.64.0.3
  Control https://api.rabtly.cloud

Verify

rabtly status     # show connection + peer table
rabtly ip         # print your VPN IP

Service management

The installer registers a systemd service that starts automatically at boot:

sudo rabtly service install     # register + start (done by install script)
sudo rabtly service uninstall   # stop + remove service
sudo rabtly service start       # start manually
sudo rabtly service stop        # stop manually

View logs:

journalctl -u rabtly -f

One-command device enrollment

If you already have an enrollment token, you can install and connect in a single command:

curl -fsSL https://dl.rabtly.cloud/install.sh | sh -s -- \
  --token enrt_... \
  --control https://api.rabtly.cloud

Manual binary download

curl -fsSL https://dl.rabtly.cloud/latest/rabtly_linux_amd64 -o /usr/local/bin/rabtly
chmod +x /usr/local/bin/rabtly

After a manual install, register the service manually:

sudo rabtly service install

Update

Re-run the install script — it fetches the latest binary, verifies its checksum, and replaces the existing one in place. The systemd service restarts automatically:

curl -fsSL https://dl.rabtly.cloud/install.sh | sh

To pin a specific version:

curl -fsSL https://dl.rabtly.cloud/install.sh | sh -s -- --version 1.4.10

Your keys, config, and enrollment under /var/lib/rabtly stay intact across updates. Confirm the new version with rabtly version.

Uninstall

curl -fsSL https://dl.rabtly.cloud/install.sh | sh -s -- --uninstall

Or step by step:

sudo rabtly service uninstall   # stop + remove systemd unit
sudo rm -f /usr/local/bin/rabtly
sudo rm -rf /var/lib/rabtly     # removes keys, config, state — skip to keep data

Subnet routing (optional)

To expose a local subnet (e.g. 192.168.1.0/24) to all VPN peers, pass the routes when connecting:

sudo rabtly up --token enrt_... --advertise-routes 192.168.1.0/24

Advertise multiple subnets with a comma-separated list, and stop advertising with an empty value:

sudo rabtly up --advertise-routes 192.168.1.0/24,10.0.0.0/24   # advertise
sudo rabtly up --advertise-routes ""                            # stop advertising

The routes are stored in the daemon’s config, so the systemd service re-advertises them automatically on every restart — no env vars or unit edits needed.

Troubleshooting

Permission denied when running rabtly up The daemon needs root to create network interfaces. Use sudo rabtly up.

rabtly up says “not logged in” Run rabtly login first, or pass --token enrt_... directly.

Daemon starts but node shows offline Check logs: journalctl -u rabtly -f. Confirm you have internet access and the enrollment token is valid.

macOSWindows