Deploy a Gateway on Debian / Ubuntu

Install the Firezone Gateway on Debian- or Ubuntu-based distributions from the Firezone APT repository. The package installs the firezone-gateway binary and a systemd service that keeps the Gateway running.

Before you start, open Sites → <your Site> → Deploy a Gateway in the admin portal and keep the token handy — you'll paste it in below. Review the sizing guidelines to choose a host first.

Step 1: Add the Firezone APT repository

sudo mkdir --parents /etc/apt/keyrings
wget -qO- https://artifacts.firezone.dev/apt/key.gpg | sudo gpg --dearmor -o /etc/apt/keyrings/firezone.gpg
echo "deb [signed-by=/etc/apt/keyrings/firezone.gpg] https://artifacts.firezone.dev/apt/ stable main" | sudo tee /etc/apt/sources.list.d/firezone.list > /dev/null

Step 2: Install the Gateway

sudo apt update
sudo apt install firezone-gateway

Step 3: Configure the account region

For an EU account, edit the package’s environment file:

sudoedit /etc/firezone/gateway-env

Add or update this entry, preserving other settings:

FIREZONE_API_URL=wss://eu.api.firezone.dev

The packaged systemd service reads this file each time it starts. US accounts use the default endpoint and do not need this entry.

Step 4: Authenticate and start the Gateway

sudo firezone-gateway authenticate

Paste the token from the matching region's admin portal when prompted. This stores the token on disk. Start the packaged service:

sudo firezone-gateway enable-service

If the service was already running when you changed its endpoint, restart it:

sudo systemctl restart firezone-gateway

In the same admin portal, open your Site’s Gateways tab and confirm that the Gateway is online. If it is not, check the service logs with sudo journalctl -u firezone-gateway -n 50 --no-pager and verify the token and endpoint belong to the same region.

Need help? See all support options.