Single-NIC Mode

Wirebump is designed for two or more network interfaces. Single-NIC mode is a workaround for machines with only one NIC—bootstrap creates a dummy interface to handle internal routing. Useful for testing or demos before committing dedicated hardware. The web UI runs on http://localhost or http://10.0.0.1 (HTTPS is also available on port 443).

When to Use Single-NIC Mode

Testing before committing hardware. Boot a Live USB, run the installer, and explore the full topology builder. See exactly how circuits deploy, how hot-swapping works, and how the dashboard behaves. No dedicated box required.

Privacy research. Spin up complex multi-provider topologies quickly. Test nested configurations, measure latency across hops, verify leak prevention. Tear down and rebuild without touching production infrastructure.

Cloud VMs and VPS deployments. Your VPS has one interface. That is fine. Wirebump creates the virtual LAN interface automatically and routes all host traffic through your VPN circuits.

Quick demos. Show someone what Wirebump does in five minutes on any Ubuntu laptop. The installer handles everything.

Quick Start: Ubuntu Desktop or Laptop

This works on Ubuntu 25.10 (recommended) or Ubuntu 24.04. A Live USB session is fine for testing.

1. Boot Ubuntu and connect to the network

Open a terminal with Ctrl+Alt+T. Connect to WiFi or plug in ethernet. Verify you have internet access.

2. Run the installer

sudo bash -c "$(wget -qO- https://wirebump.net/install.sh)"

Bootstrap detects single-NIC mode automatically. You will see:

Single-NIC mode detected, creating dummy LAN interface

3. Open the web UI

Navigate to http://localhost/ in your browser.

Default credentials: admin / wirebump

4. Add your VPN account and deploy

Go to Settings, add your Mullvad VPN or Proton VPN credentials, then deploy a circuit from the dashboard.

5. Verify protection

Open a terminal and run:

curl https://am.i.mullvad.net/connected

The response confirms whether your traffic exits through a VPN.

Quick Start: Ubuntu Server via SSH

Server editions work the same way. The difference is how you access the web UI.

SSH Access After Bootstrap

Bootstrap locks down the WAN interface by design. Your current SSH session continues working, but once you disconnect, you will likely be locked out unless you planned ahead. Read the Limitations section below before proceeding.

1. Connect with port forwarding

ssh user@your-server -L 8080:10.0.0.1:80

The -L flag forwards your local port 8080 to the Wirebump admin interface. For HTTPS, add -L 8443:10.0.0.1:443 to the command.

2. Run the installer

sudo bash -c "$(wget -qO- https://wirebump.net/install.sh)"

Keep this SSH session open.

3. Access the web UI

Open http://localhost:8080/ in your local browser. The tunnel carries traffic to the Wirebump admin interface.

4. Add credentials and deploy

Same as the desktop flow. Add your VPN account, deploy a circuit, verify with curl.

Quick Start: UTM on Mac (Apple Silicon)

UTM provides an easy way to run Ubuntu VMs on Apple Silicon Macs.

1. Download a pre-built Ubuntu image

Go to mac.getutm.app/gallery and download ubuntu-24.04 from the community gallery.

2. Launch the VM and find its IP

Start the VM. UTM displays the guest IP address in the VM info panel.

3. SSH with port forwarding

ssh vagrant@GUEST_IP -L 8080:10.0.0.1:80

Replace GUEST_IP with the actual IP from UTM. For HTTPS, add -L 8443:10.0.0.1:443 to the command.

4. Run the installer and access the web UI

Run the installer as shown above. Once bootstrap completes, open http://localhost:8080/ in your browser to access the admin interface. For HTTPS, use https://localhost:8443/ (expect a browser warning due to the self-signed certificate).

Important Limitations

Single-NIC mode has constraints you should understand before deploying.

SSH Lockout is Expected

The firewall locks down the WAN interface after bootstrap. This is intentional. Wirebump is designed to be accessed from the LAN side (which does not exist in single-NIC mode for external devices) or via a management interface (which requires a third NIC).

Your options:

• Port forwarding: Establish the SSH tunnel before bootstrap and keep it open. Access the UI through the tunnel.
• Console access: Use the VM console, physical keyboard/monitor, or out-of-band management (IPMI, iLO, iDRAC).
• Treat it as temporary: Great for testing and demos. When done, reboot without Wirebump or destroy the VM.

If you need persistent remote access, consider Standard Mode with a dedicated management interface on a third NIC.

Host Protection Only

Single-NIC mode protects the Wirebump machine itself. It does not protect other devices. There is no downstream LAN port for clients to connect to.

If you want whole-network protection, use Standard Mode with two NICs.

Session Persistence

On a Live USB, your configuration does not survive reboot (that is how Live USB works). On a persistent installation, the configuration and VPN circuits persist normally.

Verification

After deploying a circuit, confirm VPN protection is active:

# Check if Mullvad sees you as connected
curl https://am.i.mullvad.net/connected

# See your exit IP
curl https://ifconfig.me

# Compare latency before/after enabling VPN
ping -c 5 1.1.1.1

Disable the VPN from the dashboard (click VPN in the header) and run these commands again. Your original IP and lower latency should return.

---

Mullvad and Mullvad VPN are trademarks of Mullvad VPN AB. Proton VPN is a registered trademark of Proton AG.