Downloads and installers

Every ntwire binary. One clear place.

Use the desktop app, automate with the client, or run the server and relay. Installers fetch the latest matching asset from GitHub Releases.

Latest release

Prefer a direct archive? Every release download below is served from GitHub.

View releases on GitHub

Quick install

Run one command

Choose the binary you need. macOS and Linux use the shell installer; Windows uses its matching batch installer.

ntwire

Command-line client.

macOS / Linuxcurl -fsSL https://ntwire.io/get.sh | sh

Windowscurl.exe -fsSLO https://ntwire.io/get.bat && get.bat

ntwire-server

Server for authorised tunnels.

macOS / Linuxcurl -fsSL https://ntwire.io/get-server.sh | sh

Windowscurl.exe -fsSLO https://ntwire.io/get-server.bat && get-server.bat

ntwire-relay

Public relay for servers behind NAT.

macOS / Linuxcurl -fsSL https://ntwire.io/get-relay.sh | sh

Windowscurl.exe -fsSLO https://ntwire.io/get-relay.bat && get-relay.bat

ntwire-gui

Desktop tray and menu-bar client.

macOS / Linuxcurl -fsSL https://ntwire.io/get-gui.sh | sh

Windowscurl.exe -fsSLO https://ntwire.io/get-gui.bat && get-gui.bat

Review a script before running it if that is your organisation’s policy. Unix installers use INSTALL_DIR (default /usr/local/bin); Windows installers use %LOCALAPPDATA%\ntwire\bin. Add the latter to PATH after installation.

First start

Start with the right command

The client needs the HTTPS address your administrator provided. Servers and relays need their configuration file first.

CLI client

ntwire connect https://server.example

See the client guide for SSH and SSO sign-in.

Desktop client

ntwire-gui

Add the server address in Settings, then connect. Start with the getting-started guide.

Server

ntwire-server --config ntwire.yaml

Create and review ntwire.yaml before exposing the server.

Relay

ntwire-relay --config ntwire-relay.yaml

Run a relay only after configuring its public listeners and approved tenants.

Operator deployment

Run it where you operate

Published containers are available for the client, server, and relay. The repository examples provide the compose and Kubernetes starting points.

Docker

docker run --rm -p 8443:8443 -p 51820:51820/udp \
  -v "$PWD/ntwire.yaml:/etc/ntwire/ntwire.yaml:ro" \
  nmaguiar/ntwire-server:build --config /etc/ntwire/ntwire.yaml

Use nmaguiar/ntwire-relay:build with a relay config for a relay deployment.

Docker Compose

docker compose -f deploy/docker/docker-compose.yml up -d

Copy and adapt the included compose configuration before production use.

Open Docker examples

Kubernetes

helm repo add ntwire https://ntwire.io/charts
helm install ntwire-server ntwire/ntwire

Review the chart values, configuration, secrets, and network policy before installing in production.

Open Kubernetes Helm instructions

Advanced setup

Generate a configuration workspace

Both operator binaries can generate a configuration skill/workspace with sample files and instructions suitable for a human or a GenAI coding assistant.

ntwire-server -print-sample-config > ntwire.yaml
ntwire-relay -print-sample-config > ntwire-relay.yaml
ntwire-server -write-config-skill ./ntwire-server-config
ntwire-relay -write-config-skill ./ntwire-relay-config

Review the generated configuration, keys, listeners, destination policies, and identity settings before deployment.

Make a decision for every client connection

Configure an authorization webhook or executable hook to assess each connection’s security risk and allow or deny that client. A hook can also narrow the tunnels it receives and shorten its session lifetime; errors and timeouts fail closed.

Open the risk-based hook example on GitHub

Read the authorization hook guide

Reference material

Use the samples, then the full docs

Start from the repository deployment examples, and use the complete configuration references for production decisions.

Deployment overview

Server configuration reference

Relay configuration reference

Server-admin essentials

Set up identities and keys deliberately

Keep every private key out of source control and give each identity only the tunnels it needs. The commands below print the configuration entries to review before you start the service.

CLI client identity

ntwire keygen

The user sends only ~/.ntwire/id_ed25519.pub. An administrator places that public key in the configured auth.authorized_keys_dir, or configures the approved SSO issuer instead.

Relay identity

ntwire-server -generate-relay-key relay_id_ed25519

Copy the printed public-key registration into ntwire-relay.yaml, configure the server to use the generated identity file, and protect its private half.

WireGuard peer key

ntwire-server -generate-wireguard-key client_wg

Add the printed peer entry to native_wireguard.peers. Transfer the private key securely to the device, then remove it from the server host.

Official WireGuard clients

Connect from iPhone, iPad, and Android

ntwire can admit unmodified official WireGuard clients, including the official iOS and Android apps. Enable native_wireguard, grant that peer only the intended tunnels, then import a profile or scan a QR code in the app.

ntwire-server -config ntwire.yaml \
  -print-wireguard-qr -wireguard-peer iphone

The mobile app connects directly; it does not need the ntwire CLI or GUI installed.

Profile export

Import a profile safely

For a desktop or mobile client, export a standard .conf file or scan the terminal QR code. The chosen peer must already be listed in native_wireguard.peers.

ntwire-server -config ntwire.yaml \
  -print-wireguard-conf -wireguard-peer iphone > client.conf

Official WireGuard client guide

Complete connection and relay setup

Release archives

Choose a platform manually

These direct downloads come from the latest GitHub release. Use them when you need an offline archive or a specific binary.

Binary	Platform	Size	Download
Loading release downloads…

View release notes and all artifacts on GitHub