Installation

Install the Tunnet agent on every machine you want on the mesh.

One command. Your machine joins the mesh

Pick your OS - Copy, paste, done.

Terminal

curl -fsSL https://get.tunnet.io/linux | sh

Then enroll and start the service. Needs root for the TUN interface.

Update later with tunnet update

What to do next

Join a managed network (control plane + dashboard):

sudo tunnet enroll --control-url http://your-host:8080 --token YOUR_TOKEN
sudo tunnet service start

Or start a Direct network (no server):

sudo tunnet create --name my-net --secret "a-strong-passphrase"
sudo tunnet service start

See Quick Start (Managed) or Quick Start (Direct).

Agent config lands in tunnet.toml next to sealed secrets in the state directory. See Configuration.

Options

Pin a version:

curl -fsSL https://get.tunnet.io/linux | sh -s -- --version v0.3.0

irm https://get.tunnet.io/windows -OutFile install.ps1
.\install.ps1 -Version v0.3.0

Skip the service unit:

curl -fsSL https://get.tunnet.io/linux | sh -s -- --no-service

irm https://get.tunnet.io/windows -OutFile install.ps1
.\install.ps1 -NoService

Updating

tunnet update --check
sudo tunnet update

tunnet update --check does not need root. Installing the update does (sudo on Linux/macOS, an elevated prompt on Windows). The daemon must be running for the install step.

For unattended upgrades, enable [update] in tunnet.toml (see tunnet update).

Building from source

If you are developing Tunnet or self-hosting the full stack from a checkout:

git clone https://github.com/tunnetio/Tunnet.git
cd Tunnet
cargo build --release

Binaries land in target/release/. For the management API and dashboard, also run bun install and see Self-Hosting.

Platform notes

• Linux - root (or CAP_NET_ADMIN) for the TUN interface.
• macOS - admin privileges for the TUN interface.
• Windows - Administrator privileges.
• Containers / CI - pass --no-encrypt-state (or TUNNET_NO_ENCRYPT_STATE=1) if platform secret sealing is unavailable.