# Single-NIC Mode

Wirebump is designed for two or more network interfaces. Single-NIC mode is a workaround for machines with only one NIC—bootstrap creates a dummy interface to handle internal routing. Useful for testing or demos before committing dedicated hardware. The web UI runs on `http://localhost` or `http://10.0.0.1` (HTTPS is also available on port 443).

## When to Use Single-NIC Mode

**Testing before committing hardware.** Boot a Live USB, run the installer, and explore the full topology builder. See exactly how circuits deploy, how hot-swapping works, and how the dashboard behaves. No dedicated box required.

**Privacy research.** Spin up complex multi-provider topologies quickly. Test nested configurations, measure latency across hops, verify leak prevention. Tear down and rebuild without touching production infrastructure.

**Cloud VMs and VPS deployments.** Your VPS has one interface. That is fine. Wirebump creates the virtual LAN interface automatically and routes all host traffic through your VPN circuits.

**Quick demos.** Show someone what Wirebump does in five minutes on any Ubuntu laptop. The installer handles everything.

## Quick Start: Ubuntu Desktop or Laptop

This works on Ubuntu 25.10 (recommended), Ubuntu 24.04, or Ubuntu 26.04 LTS. A Live USB session is fine for testing.

**1. Boot Ubuntu and connect to the network**

Open a terminal with `Ctrl+Alt+T`. Connect to WiFi or plug in ethernet. Verify you have internet access.

**2. Run the installer**

```bash
sudo bash -c "$(wget -qO- https://wirebump.net/install.sh)"
```

Bootstrap detects single-NIC mode automatically. You will see:

```
Single-NIC mode detected, creating dummy LAN interface
```

**3. Open the web UI**

Navigate to `http://localhost/` in your browser.

**Default credentials:** admin / wirebump

**4. Add your VPN account and deploy**

Go to Settings, add your Mullvad VPN or Proton VPN credentials, then deploy a circuit from the dashboard.

**5. Verify protection**

Open a terminal and run:

```bash
curl https://am.i.mullvad.net/connected
```

The response confirms whether your traffic exits through a VPN.

## Quick Start: Ubuntu Server via SSH

Server editions work the same way. The difference is how you access the web UI.
**SSH Access After Bootstrap:** Bootstrap locks down the WAN interface by design. Your current SSH session continues working, but once you disconnect, you will likely be locked out unless you planned ahead. Read the Limitations section below before proceeding.

**1. Connect with port forwarding**

```bash
ssh user@your-server -L 8080:10.0.0.1:80
```

The `-L` flag forwards your local port 8080 to the Wirebump admin interface. For HTTPS, add `-L 8443:10.0.0.1:443` to the command.

**2. Run the installer**

```bash
sudo bash -c "$(wget -qO- https://wirebump.net/install.sh)"
```

Keep this SSH session open.

**3. Access the web UI**

Open `http://localhost:8080/` in your local browser. The tunnel carries traffic to the Wirebump admin interface.

**4. Add credentials and deploy**

Same as the desktop flow. Add your VPN account, deploy a circuit, verify with curl.

## Quick Start: UTM on Mac (Apple Silicon)

UTM provides an easy way to run Ubuntu VMs on Apple Silicon Macs.

**1. Download a pre-built Ubuntu image**

Go to [mac.getutm.app/gallery](https://mac.getutm.app/gallery/) and download `ubuntu-24.04` from the community gallery.

**2. Launch the VM and find its IP**

Start the VM. UTM displays the guest IP address in the VM info panel.

**3. SSH with port forwarding**

```bash
ssh vagrant@GUEST_IP -L 8080:10.0.0.1:80
```

Replace `GUEST_IP` with the actual IP from UTM. For HTTPS, add `-L 8443:10.0.0.1:443` to the command.

**4. Run the installer and access the web UI**

Run the installer as shown above. Once bootstrap completes, open `http://localhost:8080/` in your browser to access the admin interface. For HTTPS, use `https://localhost:8443/` (expect a browser warning due to the self-signed certificate).

## Important Limitations

Single-NIC mode has constraints you should understand before deploying.

### SSH Lockout is Expected

The firewall locks down the WAN interface after bootstrap. This is intentional. Wirebump is designed to be accessed from the LAN side (which does not exist in single-NIC mode for external devices) or via a management interface (which requires a third NIC).

**Your options:**

- **Port forwarding:** Establish the SSH tunnel before bootstrap and keep it open. Access the UI through the tunnel.
- **Console access:** Use the VM console, physical keyboard/monitor, or out-of-band management (IPMI, iLO, iDRAC).
- **Treat it as temporary:** Great for testing and demos. When done, reboot without Wirebump or destroy the VM.

If you need persistent remote access, consider [Standard Mode](https://wirebump.net/docs/deployment-modes/standard) with a dedicated management interface on a third NIC.

### Host Protection Only

Single-NIC mode protects the Wirebump machine itself. It does not protect other devices. There is no downstream LAN port for clients to connect to.

If you want whole-network protection, use [Standard Mode](https://wirebump.net/docs/deployment-modes/standard) with two NICs.

### Session Persistence

On a Live USB, your configuration does not survive reboot (that is how Live USB works). On a persistent installation, the configuration and VPN circuits persist normally.

## Verification

After deploying a circuit, confirm VPN protection is active:

```bash
# Check if Mullvad sees you as connected
curl https://am.i.mullvad.net/connected

# See your exit IP
curl https://ifconfig.me

# Compare latency before/after enabling VPN
ping -c 5 1.1.1.1
```

Disable the VPN from the dashboard (click VPN in the header) and run these commands again. Your original IP and lower latency should return.

---

Mullvad and Mullvad VPN are trademarks of Mullvad VPN AB. Proton VPN is a registered trademark of Proton AG.