# Standard Deployment

The bump-in-the-wire deployment. Wirebump sits between your modem and router, handling VPN encryption for every device downstream. No per-device configuration. No app installs. Everything behind Wirebump gets protection automatically.

## Network Topology

```
Before Wirebump:

    [Modem/ISP] -------- [Your Router] -------- devices
                                |
                         (no VPN protection)

With Wirebump:

    [Modem/ISP] -------- [Wirebump] -------- [Your Router] -------- devices
                             |
                        VPN tunnels
                             |
                    (all traffic encrypted)
```

Wirebump provides DHCP on its LAN port. Your router, access points, switches, and devices all get addresses from Wirebump and route through the VPN without knowing it exists.

## What You Need

**Hardware:**
- 2 network interfaces (built-in ethernet + USB gigabit adapter works fine)
- Any amd64 or ARM64 machine from the last 8 years (old laptops, mini PCs, [Apple Silicon via VM](https://wirebump.net/docs/deployment-modes/single-nic#quick-start-utm-on-mac-apple-silicon))

**Software:**
- Ubuntu 25.10 (recommended), Ubuntu 24.04 LTS, or Ubuntu 26.04 LTS
- Desktop or Server edition both work

**Network access:**
- Physical access to your modem and router for cabling
- Mullvad VPN or Proton VPN subscription

## Quick Start

### 1. Prepare Ubuntu

For testing: Create an Ubuntu 25.10 or 26.04 Live USB and boot from it. Nothing persists, so you can experiment freely.

For permanent: Install Ubuntu to your dedicated machine first.

### 2. Connect Cables

- **WAN port**: Connect to your modem or ISP handoff
- **LAN port**: Connect to your router's WAN port (the port that used to connect to your modem)

Your router becomes a downstream device. It will get its IP from Wirebump instead of from your ISP.

### 3. Run the Installer

Make sure your WAN interface has internet connectivity, then run:

```bash
sudo bash -c "$(wget -qO- https://wirebump.net/install.sh)"
```

Or with curl:

```bash
sudo bash -c "$(curl -fsSL https://wirebump.net/install.sh)"
```

The installer downloads the correct binary for your architecture, verifies the checksum, and runs bootstrap.

### 4. Assign NICs

Bootstrap prompts you to confirm which interface is WAN and which is LAN.

**How to tell which is which:** Your WAN interface already has an IP address from your ISP. Your LAN interface typically has no IP yet. USB adapters show with interface names like `enx*`.

**Need to change interfaces?** Rerun `wirebump bootstrap` to start fresh, or edit interface assignments on the Settings page. Note: if you change the NIC that hosts the admin interface, your browser may appear to hang until you plug cables into the correct ports.

### 5. Access the Web UI

Bootstrap displays the IP address when it finishes. Typically:

- `http://10.0.0.1` from devices on the LAN
- `http://localhost` from the Wirebump machine itself

If you prefer HTTPS: `https://10.0.0.1` (or `https://localhost`) is also available. It uses a self-signed certificate since Wirebump runs locally on your network. Your browser will show a security warning—this is expected. Click 'Advanced' and proceed to the site.

Default credentials: **admin / wirebump**

### 6. Add VPN and Deploy

From the web UI:

1. Add your Mullvad VPN or Proton VPN account credentials
2. Choose a circuit topology (single-hop, parallel, multi-hop)
3. Deploy the circuit

Traffic from every device downstream now routes through your VPN tunnels.

## Alternative Placement for Testing

Not ready to put Wirebump between your modem and router? You can test it downstream of your existing router instead.

```
    [Modem/ISP] -------- [Your Router] -------- other devices
                               |
                          (LAN port)
                               |
                         [Wirebump WAN]
                               |
                         [Wirebump LAN]
                               |
                      [Test Device or Switch]
```

Wirebump works anywhere it receives DHCP on its WAN port. Connect Wirebump's WAN to a LAN port on your existing router. Wirebump gets an internal IP and provides DHCP to devices on its LAN port. Connect a spare laptop or small switch downstream to test.

Note: this places Wirebump inside your LAN. For proper isolation, put Wirebump on a separate VLAN. Without isolation, traffic from the test device still traverses your main network before reaching the VPN tunnels.

## Live USB vs Permanent Install

**Live USB:**
- Nothing persists. Reboot and everything resets.
- Perfect for testing before committing hardware.
- You will re-run bootstrap and re-enter VPN credentials after every reboot.

**Permanent install:**
- Configurations survive reboots.
- VPN credentials and circuit definitions persist.
- Install Ubuntu first, then run the Wirebump installer.

Many users run from a Live USB for days or weeks during evaluation. When you decide Wirebump fits your setup, do a permanent Ubuntu install and run bootstrap again.

## Verification

Once your circuit is deployed, verify traffic is routing through the VPN:

- Check your exit IP at [whatismyipaddress.com](https://whatismyipaddress.com) from any device on the LAN
- The location should match your selected VPN exit server, not your ISP

For detailed verification steps including DNS leak testing, see [Verify Your Connection](https://wirebump.net/docs/guides/verify-connection).

## Next Steps

- [Traffic Shaping](https://wirebump.net/docs/traffic-shaping) to eliminate bufferbloat during large transfers
- [VPN Topologies](https://wirebump.net/docs/vpn-topologies) for multi-hop and multi-provider configurations
- [Troubleshooting](https://wirebump.net/docs/guides/troubleshooting) if something goes wrong

---

Mullvad and Mullvad VPN are trademarks of Mullvad VPN AB. Proton VPN is a registered trademark of Proton AG.