Deployment Modes
Wirebump runs on amd64 and ARM64 hardware with Ubuntu. How you deploy it depends on what you want to protect and what network interfaces you have available.
Quick Comparison
Section titled “Quick Comparison”| Mode | NICs Required | Protects | Best For |
|---|---|---|---|
| Standard | 2 (wired) | Entire LAN | Permanent home/office gateway |
| Single-NIC | 1 | Host only | Testing, research, cloud VMs |
| On-the-Go | 1-2 (WiFi WAN) | Host + optional LAN | Travel, untrusted networks |
Which Mode?
Section titled “Which Mode?”I want to protect my whole network
Section titled “I want to protect my whole network”Standard Mode - The classic setup. Wired WAN upstream (to your modem or ISP handoff), wired LAN downstream (to your router or switch). Every device behind Wirebump gets VPN protection without any per-device configuration. This is the “bump in the wire” deployment the name comes from.
Hardware: Any amd64 or ARM64 machine with two ethernet ports. A USB ethernet adapter works fine for the second port.
I want to test Wirebump quickly
Section titled “I want to test Wirebump quickly”Single-NIC Mode - Try it on any Ubuntu desktop, laptop, Live USB, or VM. Perfect for privacy researchers exploring topologies, developers testing integrations, or anyone kicking the tires before committing hardware.
The host machine gets full VPN protection. Your existing network stays untouched.
I’m traveling and want protection on untrusted WiFi
Section titled “I’m traveling and want protection on untrusted WiFi”On-the-Go Mode - Use WiFi as your upstream (hotel, coffee shop, airport). The Wirebump host connects to the untrusted network, and all its traffic goes through your VPN circuits.
Optionally connect a wired LAN port to bring your own private network for other devices. Plug in a travel router or small switch and you have a portable protected network segment.
All Modes Share
Section titled “All Modes Share”Regardless of deployment mode, you get the same capabilities:
- Same installer - One command installs Wirebump
- Same web UI - Full dashboard access from any device that can reach the Wirebump host
- Same VPN topologies - Parallel connections, nested multi-hop, ECMP load balancing
- Same traffic shaping - CAKE-based SQM for smooth video calls during large transfers
- Same provider support - Proton VPN, Mullvad VPN, or both chained together
The mode determines what traffic flows through Wirebump. The capabilities are identical.
Hardware Requirements
Section titled “Hardware Requirements”All modes require:
- amd64 or ARM64 hardware (Intel, AMD, or Apple Silicon via VM)
- Ubuntu 25.10 or 24.04 LTS
- 2GB+ RAM (8GB recommended for complex topologies)
- Proton VPN or Mullvad VPN subscription
Tested on hardware as old as an Intel i5-8250U laptop pushing full gigabit through multiple VPN hops with post-quantum encryption.