Standard Deployment

The bump-in-the-wire deployment. Wirebump sits between your modem and router, handling VPN encryption for every device downstream. No per-device configuration. No app installs. Everything behind Wirebump gets protection automatically.

Network Topology

Before Wirebump:

    [Modem/ISP] -------- [Your Router] -------- devices
                                |
                         (no VPN protection)


With Wirebump:

    [Modem/ISP] -------- [Wirebump] -------- [Your Router] -------- devices
                             |
                        VPN tunnels
                             |
                    (all traffic encrypted)

Wirebump provides DHCP on its LAN port. Your router, access points, switches, and devices all get addresses from Wirebump and route through the VPN without knowing it exists.

What You Need

Hardware:

2 network interfaces (built-in ethernet + USB gigabit adapter works fine)
Any amd64 or ARM64 machine from the last 8 years (old laptops, mini PCs, Apple Silicon via VM)

Software:

Ubuntu 25.10 (recommended) or Ubuntu 24.04 LTS
Desktop or Server edition both work

Network access:

Physical access to your modem and router for cabling
Mullvad VPN or Proton VPN subscription

Quick Start

1. Prepare Ubuntu

For testing: Create an Ubuntu 25.10 Live USB and boot from it. Nothing persists, so you can experiment freely.

For permanent: Install Ubuntu to your dedicated machine first.

2. Connect Cables

WAN port: Connect to your modem or ISP handoff
LAN port: Connect to your router’s WAN port (the port that used to connect to your modem)

Your router becomes a downstream device. It will get its IP from Wirebump instead of from your ISP.

3. Run the Installer

Make sure your WAN interface has internet connectivity, then run:

sudo bash -c "$(wget -qO- https://wirebump.net/install.sh)"

Or with curl:

sudo bash -c "$(curl -fsSL https://wirebump.net/install.sh)"

The installer downloads the correct binary for your architecture, verifies the checksum, and runs bootstrap.

4. Assign NICs

Bootstrap prompts you to confirm which interface is WAN and which is LAN.

How to tell which is which: Your WAN interface already has an IP address from your ISP. Your LAN interface typically has no IP yet. USB adapters show with interface names like enx*.

Need to change interfaces? Rerun wirebump bootstrap to start fresh, or edit interface assignments on the Settings page. Note: if you change the NIC that hosts the admin interface, your browser may appear to hang until you plug cables into the correct ports.

5. Access the Web UI

Bootstrap displays the IP address when it finishes. Typically:

http://10.0.0.1 from devices on the LAN
http://localhost from the Wirebump machine itself

If you prefer HTTPS: https://10.0.0.1 (or https://localhost) is also available. It uses a self-signed certificate since Wirebump runs locally on your network. Your browser will show a security warning—this is expected. Click ‘Advanced’ and proceed to the site.

Default credentials: admin / wirebump

6. Add VPN and Deploy

From the web UI:

Add your Mullvad VPN or Proton VPN account credentials
Choose a circuit topology (single-hop, parallel, multi-hop)
Deploy the circuit

Traffic from every device downstream now routes through your VPN tunnels.

Alternative Placement for Testing

Not ready to put Wirebump between your modem and router? You can test it downstream of your existing router instead.

    [Modem/ISP] -------- [Your Router] -------- other devices
                               |
                          (LAN port)
                               |
                         [Wirebump WAN]
                               |
                         [Wirebump LAN]
                               |
                      [Test Device or Switch]

Wirebump works anywhere it receives DHCP on its WAN port. Connect Wirebump’s WAN to a LAN port on your existing router. Wirebump gets an internal IP and provides DHCP to devices on its LAN port. Connect a spare laptop or small switch downstream to test.

Note: this places Wirebump inside your LAN. For proper isolation, put Wirebump on a separate VLAN. Without isolation, traffic from the test device still traverses your main network before reaching the VPN tunnels.

Live USB vs Permanent Install

Live USB:

Nothing persists. Reboot and everything resets.
Perfect for testing before committing hardware.
You will re-run bootstrap and re-enter VPN credentials after every reboot.

Permanent install:

Configurations survive reboots.
VPN credentials and circuit definitions persist.
Install Ubuntu first, then run the Wirebump installer.

Many users run from a Live USB for days or weeks during evaluation. When you decide Wirebump fits your setup, do a permanent Ubuntu install and run bootstrap again.

Verification

Once your circuit is deployed, verify traffic is routing through the VPN:

Check your exit IP at whatismyipaddress.com from any device on the LAN
The location should match your selected VPN exit server, not your ISP

For detailed verification steps including DNS leak testing, see Verify Your Connection.

Next Steps

Traffic Shaping to eliminate bufferbloat during large transfers
VPN Topologies for multi-hop and multi-provider configurations
Troubleshooting if something goes wrong

Mullvad and Mullvad VPN are trademarks of Mullvad VPN AB. Proton VPN is a registered trademark of Proton AG.