How to install Korthveil on a firewall from a USB stick or a DVD, step by step, with every screen of the installer. It takes about ten minutes. For a firewall that is already managed by SentinelOps, a remote reinstall does the same without anyone at the machine (see Other ways to install at the end).

What you need

Step 0: Make the USB stick

1. Check the download. On Linux: sha256sum -c korthveil-<version>-installer.iso.sha256 must print OK. On Windows (PowerShell): Get-FileHash korthveil-<version>-installer.iso must show the same value as the .sha256 file.
2. Write it to the stick: - Linux: find the stick with lsblk (for example /dev/sdb; check the size: it is not your own disk), then sudo dd if=korthveil-<version>-installer.iso of=/dev/sdX bs=4M conv=fsync status=progress. - Windows: use Rufus (choose DD image mode when it asks) or balenaEtcher. - DVD: burn the .iso as a disc image.

Step 1: Start the firewall from the stick

1. Plug in the stick, the screen, the keyboard, and the network cables.
2. Start the firewall and open its boot menu (usually F7, F11, F12, or Esc while the maker's logo shows). Choose the USB stick (or the DVD), in UEFI mode.
3. Development builds are not signed: if the firewall refuses to start the stick, turn Secure Boot off in its firmware setup.

The Korthveil boot picture shows while the installer loads.

Step 2: Welcome

The installer's welcome screen. Large screens (1600×900 and up) use a large, sharp font automatically. Press Enter to start.

If more than one screen or console is connected (a serial console as well), the installer runs on the one where you press Enter; the others say where it runs.

Every screen has the same layout: the title bar, the steps (√ done, ■ the current step, ○ still to come), and the questions. A question shows its suggested answer in brackets: press Enter to take it, or type another.

Step 3: The disk

The installer lists the disks. The stick it started from is shown greyed out and cannot be chosen. Type the number of the disk to install on and press Enter.

Disks smaller than 16 GB are not offered; disks smaller than 64 GB carry a note.

Step 4: The network ports

The installer first looks at what is connected to each port: it asks for a DHCP server (without taking an address) and listens for devices. The Found column shows the result, for example DHCP offers 192.168.2.13/24.

1. Management port: the port you will open the web UI from, usually the one on your own network. The installer suggests the first port where a DHCP server answered.
2. Its IPv4 address: the suggestion follows what was found: - dhcp where a DHCP server answered (press Enter); - otherwise a static address on a free network, for example 192.168.20.1/24 (press Enter, or type another address with its prefix). You are then asked for a gateway: leave it empty on a local network.
3. IPv6: slaac (automatic) is right in most networks; none turns it off, or type a static address.
4. The other ports: answer y to Set up the other ports now to give every port its addresses and zone in one go: - the internet port usually takes dhcp from your modem, in zone WAN; - a local network takes a static address such as 192.168.20.1/24, in zone LAN (the installer suggests WAN for the first DHCP port, else LAN); - for a new zone other than WAN you are asked whether the web UI and SSH may be reached from it (usually n).

Answer n to leave the other ports for later (the web UI's Startup wizard, or the console's Configure a port).

Not sure which socket is which? After the installation, Network › Interfaces › Blink (or the console's Identify a port) flashes a port's light.

Step 5: The name

The firewall's host name on your network, for example fw-office. Press Enter for korthveil.

Step 6: The administrator

Create the first administrator now (recommended): a user name and a password of at least 12 characters, typed twice (it is not shown).

If you answer n, the console shows a setup code after the first start, and you create the administrator in the browser with that code.

Step 7: Check and install

The summary shows every setting. Check the disk especially: everything on it is erased, and the partitions that will be lost are listed in red.

To go ahead, type ERASE and press Enter. Anything else stops without changing anything.

The installer then partitions the disk, writes the system, and sets up the first configuration, with a progress bar for each part.

When it says Korthveil is installed, remove the stick and press Enter. The firewall restarts into Korthveil.

After the installation

1. Open the web UI from a computer on the management network: https://<the management address>/ (the console shows the address, also when it came from DHCP). Your browser warns about the certificate the first time: the firewall made its own; you can replace it later under System › Certificates.
2. Sign in with the administrator from step 6 (or create it with the setup code).
3. Replacing a firewall, or reinstalling? On the welcome screen press Restore from a backup (or in System › Startup wizard). Choose the backup, type its passphrase, type restore, and press Restore. The Network check then compares the backup's ports with what is connected now (DHCP or static, address conflicts, other networks, your own connection) and offers a one-click fix for each. Then Review and commit.
4. A new firewall: run System › Startup wizard to set up the internet and local networks, access, and port forwards.
5. Change a port later without the web UI: sign in on the console, choose 3) Configure a port (addresses, DHCP, zone), pick the port, and answer the same questions as in step 4. Press Enter to keep a setting.

Other ways to install

If something goes wrong