Deploy Firezone

Firezone can be deployed on most Docker-supported platforms in a couple of minutes. Read more below to get started.

Step 1: Prepare to deploy

Regardless of which deployment method you choose, you'll need to follow the preparation steps below before deploying Firezone to production.

1. Create a DNS record
2. Set up SSL
3. Open required firewall ports

Create a DNS record

Firezone requires a fully-qualified domain name (e.g. firezone.company.com) for production use. You'll need to create the appropriate DNS record at your registrar to achieve this. Typically this is either an A, CNAME, or AAAA record depending on your requirements.

Set up SSL

You'll need a valid SSL certificate to use Firezone in a production capacity. Firezone supports ACME for automatic provisioning of SSL certificates for both Docker-based and Omnibus-based installations. This is recommended in most cases.

Open required firewall ports

By default, Firezone requires ports 443/tcp and 51820/udp to be accessible for HTTPS and WireGuard traffic respectively. These ports can change based on what you've configured in the configuration file. See the configuration file reference for details.

Resource requirements

We recommend starting with 1 vCPU and 1 GB of RAM and scaling up as the number of users and devices grows.

For Omnibus-based deployments on servers with less than 1GB of memory, we recommend turning on swap to prevent the Linux kernel from killing Firezone processes unexpectedly. When this happens, it's often difficult to debug and results in strange, unpredictable failure modes.

For the VPN tunnels themselves, Firezone uses in-kernel WireGuard, so its performance should be very good. 1 vCPU should be more than enough to saturate a 1 Gbps link.

Step 2: Deploy

You have two options for deploying Firezone:

1. Docker (recommended)
2. Omnibus

Docker is the easiest way to install, manage, and upgrade Firezone and is the preferred method of deployment.