← Back to Docs

Quick Start Guide

What You Will Need

  • A Linux machine with at least 1 GB RAM (bare-metal, Proxmox VM in bridged mode, or similar)
  • Supported OS: Ubuntu 22.04, Ubuntu 24.04+, Debian 12, or Debian 13+ — on x86_64 or aarch64
  • Root or sudo access on that machine
  • The machine must be reachable on your LAN with its own IPv4 address
  • Its default gateway must point to your upstream router, not to itself

Step 1 — Install TLSOps

Run the one-line installer as root:

curl -fsSL https://get.tlsops.com/install.sh | sudo bash

The installer verifies the signed release bundle, prepares /dev/net/tun, enables IPv4 forwarding, clears DNS conflicts (disables systemd-resolved if needed), installs AdGuard Home and sing-box, and starts the TLSOps management service.

Installation takes about 1–2 minutes. When it finishes you will see the dashboard URL printed in the terminal output.

Step 2 — Create the Admin Account

  1. Open a browser and navigate to http://<machine-ip>:8080
  2. The dashboard shows the first-run Setup screen
  3. Enter a username and a strong password, then click Create Account
  4. You are logged in and redirected to the Activation screen

Step 3 — Activate Your License (optional)

If you purchased a plan, paste your license key on the Activation screen and click Activate. All plan features unlock immediately.

The Free plan works without activation — click Continue in Free Mode on the Activation screen to skip it. You can activate later from the Settings page.

Step 4 — Point DNS to TLSOps First

Follow the onboarding flow and start with DNS only. Set your router DHCP DNS server to the TLSOps appliance IP so clients begin sending DNS traffic through TLSOps before you change network routing.

This is the safest first validation step: DNS filtering starts working, but traffic routing is not enforced yet and devices are not fully visible to the appliance.

If you want to test before changing anything network-wide, you can manually set one device to use the TLSOps appliance as its DNS server first and confirm that filtering works as expected.

Step 5 — Change the Default Gateway When DNS Looks Good

Once DNS is working correctly, set your router gateway/default route to the TLSOps appliance IP so routed traffic passes through TLSOps.

Important: the installation script already freezes the appliance host's current networking so the TLSOps machine keeps its own LAN IP and upstream router as its default gateway. You do not need to make any additional gateway changes on the appliance machine itself after installation.

This step is what enables full routing enforcement and normal device discovery.

If you want a cautious rollout, manually change one device's gateway and DNS to the TLSOps appliance first, verify that browsing and device visibility work, and then apply the same settings network-wide through router DHCP.

Step 6 — Reboot the Router and Verify Devices

After changing router DHCP DNS and gateway settings, reboot the router so clients refresh their network configuration. Then open the Dashboard and Devices pages in TLSOps and confirm devices appear correctly.

If you intentionally want DNS-only operation with no routing enforcement, stop after Step 4 and leave the gateway unchanged.

Next Steps