# Desktop & Router Setup

SecurQbit ships a command-line client for the machines that have no app: Linux servers and desktops, Windows, FreeBSD, and OpenWrt routers. It is the same VPN and the same account as the mobile apps — see [Installing SecurQbit](/installation) for iOS and Android.

Two programs are installed:

| Program | What it is |
| --- | --- |
| `securqbitd` | The background service. It holds your session, builds the tunnel and programs the system's routing. It runs with system privileges because creating a tunnel device requires them. |
| `sqctl` | The command you type. It asks the service to do things and shows you what it is doing. It holds no credentials and needs no privileges of its own. |

You interact with `sqctl`. See the [CLI Reference](/cli-reference) for every command.

## Install in one command

On Linux, macOS, FreeBSD and OpenWrt:

```bash
curl -fsSL https://cdn.securqbit.com/securqbitd/install.sh | sudo sh
```

That is the whole installation. The script works out which package this machine needs, downloads it, checks it against the published SHA-256 checksums, puts the two programs in place, and registers the service with whatever supervises long-running processes here — systemd, OpenRC, runit, SysV init, procd, rc.d or launchd. Nothing else has to be configured.

When it finishes:

```bash
sqctl login              # opens a link to approve in your browser
sqctl connect --fastest
sqctl status
```

> **You need an account already.** The desktop client signs in by browser approval and cannot create an account. Make one in the [iOS or Android app](/installation) first — including a [guest account](/anonymous-accounts), which signs in at accounts.securqbit.com with its recovery code and approves from there.

### Options

The installer takes a few flags. Pass them after `sh -s --`:

```bash
curl -fsSL https://cdn.securqbit.com/securqbitd/install.sh | sudo sh -s -- --no-start
```

| Flag | What it does |
| --- | --- |
| `--version <v>` | Install a specific release instead of the current one. |
| `--from <path>` | Install from an archive you already downloaded, with no network. |
| `--prefix <dir>` | Install somewhere other than `/usr/local` (`/usr` on OpenWrt). |
| `--no-start` | Register the service but leave it stopped. |
| `--no-router` | On OpenWrt, install without putting the LAN behind the tunnel. |
| `--uninstall` | Remove the service and the programs. |

## Supported platforms

| System | Architectures |
| --- | --- |
| Linux | x86-64, arm64, armv7 |
| Windows | x86-64, arm64 |
| FreeBSD | x86-64, arm64 |
| OpenWrt | x86-64, arm64, armv7 |
| macOS | Apple silicon, Intel |

A static build, so one Linux package covers glibc and musl alike — Debian, Ubuntu, Fedora, Arch, Alpine and Void all take the same file.

> **There is no MIPS build, and there will not be one.** Those routers ship with 8–16 MB of flash and SecurQbit needs about 40 MB, so a package for them could only ever fail after you had waited for the download. An ARM or x86-64 router works.

> **On macOS, prefer the app.** The Mac product is the native SecurQbit application from the App Store. The command-line client builds and runs on macOS so it can be developed there; it is not what a Mac user should install.

## Verify the download

The installer already checks the archive against the checksums published beside it, and refuses to continue if they disagree. To check by hand, or to install offline:

```bash
V=$(curl -fsSL https://cdn.securqbit.com/securqbitd/latest)
BASE=https://cdn.securqbit.com/securqbitd/$V

curl -fsSLO $BASE/securqbit-$V-linux-amd64.tar.gz
curl -fsSLO $BASE/SHA256SUMS

sha256sum --check --ignore-missing SHA256SUMS
```

Then install from the file you just checked:

```bash
tar -xzf securqbit-$V-linux-amd64.tar.gz
sudo ./securqbit-$V-linux-amd64/install.sh
```

Running `install.sh` from inside an extracted archive installs *that* archive and never touches the network — which is how you install onto a machine that has no route to the internet yet.

> The checksums travel over the same HTTPS connection as the package, so they prove the file arrived intact, not that the server was honest. TLS is what makes the connection trustworthy. Do not install over plain `http`.

## Using it without `sudo`

The service runs as root. The socket it listens on belongs to a `securqbit` group that the installer creates, so members of that group can drive the VPN without a password:

```bash
sudo usermod -aG securqbit "$USER"    # Linux
sudo pw groupmod securqbit -m "$USER" # FreeBSD
```

Log out and back in for the new group to apply. On macOS the group is `admin`, which administrators are already in. On Windows the equivalent is the `SecurQbit Users` group, alongside SYSTEM and Administrators.

Until then, `sqctl` will tell you it does not have permission and print the command above.

## Windows

Windows is installed from the archive rather than the one-liner.

1. Download `securqbit-<version>-windows-amd64.tar.gz` from [cdn.securqbit.com/securqbitd](https://cdn.securqbit.com/securqbitd/) and extract it.
2. Put `wintun.dll` — the tunnel adapter driver, matching your architecture — next to `securqbitd.exe`. It is not redistributed with SecurQbit; download it from [wintun.net](https://www.wintun.net).
3. From an **elevated** PowerShell prompt, in the extracted folder:

```powershell
.\install.ps1
```

That copies both programs to `%ProgramFiles%\SecurQbit`, registers the service, and adds the folder to the machine `PATH` so `sqctl` works from any shell. Open a new terminal afterwards so it picks the new `PATH` up.

To remove it, run `.\uninstall.ps1` from the same elevated prompt.

## OpenWrt: putting a whole network behind the VPN

On a router, SecurQbit protects everything on the network — phones, laptops, consoles, a smart TV — with nothing installed on any of them.

```bash
curl -fsSL https://cdn.securqbit.com/securqbitd/install.sh | sh
sqctl login
sqctl connect --fastest
```

The install also programs the firewall: a zone over the tunnel with NAT, LAN traffic forwarded into it, and LAN IPv6 towards the WAN rejected. This is the default on a router, because a VPN on a router that only protected the router's own traffic is not what anyone installs one for. Use `--no-router` if that is genuinely what you want.

**Before you start, check three things.**

- **Flash.** You need roughly 90 MB free. Most consumer routers do not have it, and the installer refuses rather than filling the overlay — a router with a full overlay cannot be repaired over the network. The fix is an [extroot](https://openwrt.org/docs/guide-user/additional-software/extroot_configuration) on a USB stick or SD card.
- **The tun module.** OpenWrt leaves it out of the default image: `opkg update && opkg install kmod-tun` (or `apk add kmod-tun`). Without it the first connect fails, not the install.
- **curl.** Some images ship neither curl nor a wget that can do HTTPS properly: `opkg install curl`.

Read the logs with `logread -f -e securqbitd`. They stay in RAM on purpose — rotating megabytes a day through a router's flash is how flash dies.

> **IPv6 is rejected, not dropped, on purpose.** The tunnel carries IPv4, so leaving LAN IPv6 on the WAN would route half of every device's traffic around the VPN. Rejecting it makes clients fall back to IPv4 immediately instead of waiting out a timeout on every request. `--allow-ipv6` turns the guard off and accepts the leak.

## Connecting on boot

```bash
sqctl set autoconnect on
```

The service starts with the machine and brings the tunnel up as soon as it has a network. Combined with `sqctl set country`, a router or a server comes back from a reboot already protected, with nobody logged in.

## Staying up to date

```bash
sqctl update
```

That downloads the current release, verifies it, replaces both programs and restarts the service. SecurQbit also checks once a day on its own and tells you when there is something new — under `sqctl status`:

```text
    Update         v1.1.0 available — run: sqctl update
```

It only ever tells you. It never installs by itself, because finishing an update means restarting, and restarting drops whatever tunnel is up. `sqctl set updates off` stops it looking; `sqctl update` still works.

## Removing it

```bash
curl -fsSL https://cdn.securqbit.com/securqbitd/install.sh | sudo sh -s -- --uninstall
```

This brings the tunnel down first, so your routing and DNS are put back the way they were, then removes the service and both programs. On a router it also removes the firewall configuration it added. Your configuration file and logs are left where they are.

## Next steps

- [CLI Reference](/cli-reference) — every command, and what it does.
- [Connecting to a Server](/connecting) — choosing where you appear.
- [Troubleshooting](/troubleshooting) — when something is not working.