SecurQbitDocs

Desktop & Router Setup

Install the SecurQbit command-line client on Linux, Windows, FreeBSD or an OpenWrt router with one command, verify the download, and put an entire network behind the VPN.

SecurQbit ships a command-line client for the machines that have no app: Linux servers and desktops, Windows, FreeBSD, and OpenWrt routers. It is the same VPN and the same account as the mobile apps — see Installing SecurQbit for iOS and Android.

Two programs are installed:

ProgramWhat it is
securqbitdThe background service. It holds your session, builds the tunnel and programs the system's routing. It runs with system privileges because creating a tunnel device requires them.
sqctlThe command you type. It asks the service to do things and shows you what it is doing. It holds no credentials and needs no privileges of its own.

You interact with sqctl. See the CLI Reference for every command.

Install in one command

On Linux, macOS, FreeBSD and OpenWrt:

curl -fsSL https://cdn.securqbit.com/securqbitd/install.sh | sudo sh

That is the whole installation. The script works out which package this machine needs, downloads it, checks it against the published SHA-256 checksums, puts the two programs in place, and registers the service with whatever supervises long-running processes here — systemd, OpenRC, runit, SysV init, procd, rc.d or launchd. Nothing else has to be configured.

When it finishes:

sqctl login              # opens a link to approve in your browser
sqctl connect --fastest
sqctl status

You need an account already. The desktop client signs in by browser approval and cannot create an account. Make one in the iOS or Android app first — including a guest account, which signs in at accounts.securqbit.com with its recovery code and approves from there.

Options

The installer takes a few flags. Pass them after sh -s --:

curl -fsSL https://cdn.securqbit.com/securqbitd/install.sh | sudo sh -s -- --no-start
FlagWhat it does
--version <v>Install a specific release instead of the current one.
--from <path>Install from an archive you already downloaded, with no network.
--prefix <dir>Install somewhere other than /usr/local (/usr on OpenWrt).
--no-startRegister the service but leave it stopped.
--no-routerOn OpenWrt, install without putting the LAN behind the tunnel.
--uninstallRemove the service and the programs.

Supported platforms

SystemArchitectures
Linuxx86-64, arm64, armv7
Windowsx86-64, arm64
FreeBSDx86-64, arm64
OpenWrtx86-64, arm64, armv7
macOSApple silicon, Intel

A static build, so one Linux package covers glibc and musl alike — Debian, Ubuntu, Fedora, Arch, Alpine and Void all take the same file.

There is no MIPS build, and there will not be one. Those routers ship with 8–16 MB of flash and SecurQbit needs about 40 MB, so a package for them could only ever fail after you had waited for the download. An ARM or x86-64 router works.

On macOS, prefer the app. The Mac product is the native SecurQbit application from the App Store. The command-line client builds and runs on macOS so it can be developed there; it is not what a Mac user should install.

Verify the download

The installer already checks the archive against the checksums published beside it, and refuses to continue if they disagree. To check by hand, or to install offline:

V=$(curl -fsSL https://cdn.securqbit.com/securqbitd/latest)
BASE=https://cdn.securqbit.com/securqbitd/$V
 
curl -fsSLO $BASE/securqbit-$V-linux-amd64.tar.gz
curl -fsSLO $BASE/SHA256SUMS
 
sha256sum --check --ignore-missing SHA256SUMS

Then install from the file you just checked:

tar -xzf securqbit-$V-linux-amd64.tar.gz
sudo ./securqbit-$V-linux-amd64/install.sh

Running install.sh from inside an extracted archive installs that archive and never touches the network — which is how you install onto a machine that has no route to the internet yet.

The checksums travel over the same HTTPS connection as the package, so they prove the file arrived intact, not that the server was honest. TLS is what makes the connection trustworthy. Do not install over plain http.

Using it without sudo

The service runs as root. The socket it listens on belongs to a securqbit group that the installer creates, so members of that group can drive the VPN without a password:

sudo usermod -aG securqbit "$USER"    # Linux
sudo pw groupmod securqbit -m "$USER" # FreeBSD

Log out and back in for the new group to apply. On macOS the group is admin, which administrators are already in. On Windows the equivalent is the SecurQbit Users group, alongside SYSTEM and Administrators.

Until then, sqctl will tell you it does not have permission and print the command above.

Windows

Windows is installed from the archive rather than the one-liner.

  1. Download securqbit-<version>-windows-amd64.tar.gz from cdn.securqbit.com/securqbitd and extract it.
  2. Put wintun.dll — the tunnel adapter driver, matching your architecture — next to securqbitd.exe. It is not redistributed with SecurQbit; download it from wintun.net.
  3. From an elevated PowerShell prompt, in the extracted folder:
.\install.ps1

That copies both programs to %ProgramFiles%\SecurQbit, registers the service, and adds the folder to the machine PATH so sqctl works from any shell. Open a new terminal afterwards so it picks the new PATH up.

To remove it, run .\uninstall.ps1 from the same elevated prompt.

OpenWrt: putting a whole network behind the VPN

On a router, SecurQbit protects everything on the network — phones, laptops, consoles, a smart TV — with nothing installed on any of them.

curl -fsSL https://cdn.securqbit.com/securqbitd/install.sh | sh
sqctl login
sqctl connect --fastest

The install also programs the firewall: a zone over the tunnel with NAT, LAN traffic forwarded into it, and LAN IPv6 towards the WAN rejected. This is the default on a router, because a VPN on a router that only protected the router's own traffic is not what anyone installs one for. Use --no-router if that is genuinely what you want.

Before you start, check three things.

  • Flash. You need roughly 90 MB free. Most consumer routers do not have it, and the installer refuses rather than filling the overlay — a router with a full overlay cannot be repaired over the network. The fix is an extroot on a USB stick or SD card.
  • The tun module. OpenWrt leaves it out of the default image: opkg update && opkg install kmod-tun (or apk add kmod-tun). Without it the first connect fails, not the install.
  • curl. Some images ship neither curl nor a wget that can do HTTPS properly: opkg install curl.

Read the logs with logread -f -e securqbitd. They stay in RAM on purpose — rotating megabytes a day through a router's flash is how flash dies.

IPv6 is rejected, not dropped, on purpose. The tunnel carries IPv4, so leaving LAN IPv6 on the WAN would route half of every device's traffic around the VPN. Rejecting it makes clients fall back to IPv4 immediately instead of waiting out a timeout on every request. --allow-ipv6 turns the guard off and accepts the leak.

Connecting on boot

sqctl set autoconnect on

The service starts with the machine and brings the tunnel up as soon as it has a network. Combined with sqctl set country, a router or a server comes back from a reboot already protected, with nobody logged in.

Staying up to date

sqctl update

That downloads the current release, verifies it, replaces both programs and restarts the service. SecurQbit also checks once a day on its own and tells you when there is something new — under sqctl status:

    Update         v1.1.0 available — run: sqctl update

It only ever tells you. It never installs by itself, because finishing an update means restarting, and restarting drops whatever tunnel is up. sqctl set updates off stops it looking; sqctl update still works.

Removing it

curl -fsSL https://cdn.securqbit.com/securqbitd/install.sh | sudo sh -s -- --uninstall

This brings the tunnel down first, so your routing and DNS are put back the way they were, then removes the service and both programs. On a router it also removes the firewall configuration it added. Your configuration file and logs are left where they are.

Next steps