Install a node
A node is the public half of ingressd, a small server with a public IP that accepts traffic and passes it down the tunnels to your homes. Install it with one command and it enrols itself with the panel.
You need a fresh Debian or Ubuntu server (amd64 or arm64) with a public IPv4 address, root access over SSH, and an ingressd account.
1. Create an enrolment token#
In the panel, open Nodes and choose Add node. Give the node a name (for example fra-1) and, if you already use PoPs, pick its PoP. The panel shows a one-line install command with a one-time token. Tokens expire after 24 hours and work once.
2. Run the installer on the VPS#
$ curl -fsSL https://app.ingressd.com/install/node.sh | sudo sh -s -- --token <token> ==> connected to the panel; firewall dead-man switch cancelled
The installer:
- installs WireGuard tools and nftables, the
ingressdandingressd-edgebinaries and their systemd units; - enrols the node with the panel (
ingressd node enroll), which pins your organisation's signing key; - starts the services. The node opens an outbound WebSocket to the panel and applies its first signed config.
Installer options:
| Option | Meaning |
|---|---|
--token T |
One-time enrolment token from the panel (needed on the first install only). |
--hostname H |
The node's public DNS name, if it has one. |
--public-ip IP |
The node's public IPv4 address, if detection picks the wrong one. |
--panel URL |
The panel to enrol with. The command copied from the panel already points at it. |
--no-firewall-guard |
Don't arm the 5-minute firewall dead-man switch (see below). |
Running the installer again upgrades the binaries and units and keeps the config, secrets and enrolment.
The node manages its own nftables firewall and always allows your SSH port. Until the node has connected to the panel, a timer deletes the ingressd firewall table after 5 minutes, so a broken firewall can never lock you out.
3. Open the ports at your provider#
The node's own firewall opens what its config needs, but many providers also have a firewall in their control panel. Allow these inbound:
| Port | Protocol | Used for |
|---|---|---|
| 80, 443 | TCP | HTTP apps and certificate issuance. 443 also carries the connector's WebSocket fallback. |
| 51820–59999 | UDP | WireGuard tunnels from homes (one port per home on each node). |
| 51900 | UDP | The mesh between your nodes, used by Smart DNS. |
| Your game ports | TCP/UDP | Whatever your game and TCP/UDP apps listen on, such as 25565/tcp. |
4. Check the node#
$ ingressd node status $ ingressd doctor
ingressd node status shows whether the node is managed and connected. ingressd doctor checks the host, config, DNS and tunnels. In the panel, the node appears on the Nodes page as connected.
If the node does not connect, see troubleshooting.
Several nodes#
Repeat these steps on each server. A home attaches to every node by default, so a second node starts serving your apps as soon as its tunnel is up. See multi-node failover and PoPs.
Leaving the panel#
ingressd node detach returns a node to standalone mode: it keeps its config and secrets and continues serving. See standalone mode.
The installer creates an age key that decrypts the node's secrets. Copy it somewhere other than the server; the installer prints its path.