some file

Quickstart Guide

This guide takes you from your first sign-in to a connected device. You sign in to the dashboard, add your first device with the Add Peer dialog, connect the Netzilo client and check that the device shows up under Endpoint > Peers. It takes about ten minutes.

The walkthrough uses a Windows laptop. Every other platform, the Enterprise Browser, the AI Gateway and servers are covered in Install Netzilo.

On Netzilo Cloud the dashboard is at https://go.netzilo.com. On a self-hosted Netzilo Server it is https://<your-domain>, the domain you gave the installer. Everything else in this guide is the same.

How it works

  1. You receive an account, either by invitation from an administrator or as the first owner of a new account, and sign in to the dashboard.
  2. The dashboard opens the Add Peer dialog on your first sign-in. It picks the tab for the operating system you are using.
  3. You install the Netzilo client on the device and click Connect. The client opens your browser so you can sign in with the same account.
  4. The device becomes a peer of your account. It gets an address in 100.64.0.0/10 and can reach the other peers that your policies allow.

Step 1: Sign in to the dashboard

If an administrator invited you by e-mail, open the invitation and click Finish Activation.

The Activate Netzilo Account e-mail with the user name, an activation code and the Finish Activation button

The activation page fills in the code for you. Enter a new password twice. The checklist under the fields turns green when the password meets every rule, and Next becomes active.

The Activate Netzilo Account page with the activation code filled in, empty New Password and Confirm Password fields and the password rules

When the account is active, click Next to go to the sign-in page.

The confirmation page saying the user account was activated, with a Next button

Enter your e-mail address and click Next, then enter your password and click Next again.

The Netzilo sign-in page with the Login Name field filled in and the Next button

The password step of the Netzilo sign-in page

The first time you sign in you are offered two-factor authentication: an authenticator app or a device method such as Windows Hello. Set it up now, or click Skip and set it up later.

The 2-Factor Setup page offering an authenticator app or a device-dependent method, with Skip and Next buttons

Self-hosted servers send no e-mail until SMTP is configured, so invitations do not arrive. Until then an administrator adds people under Team > Users > Add User with Create password, and hands the password over. See Identity provider and SSO.

What you see after sign-in depends on your role:

  • Owners and administrators land on the Dashboard: tiles for Users, Devices, Agents and Tokens, and the Agentic Activity panel. The first owner of a new account is also asked for the company name, website, employee count and how they heard about Netzilo. The form appears once and you can close it without filling it in.
  • Regular users land on the Workplace, with the tabs Applications, Devices and Agentic Access. See Workplace.

While the account has no peers, the Dashboard shows the card Get Started with Netzilo ("It looks like you don't have any connected machines.") with an Add Peer button.

Step 2: Add your first device

On your first sign-in the dashboard opens the dialog Hello there! It's time to add your first device. by itself. Later you open the same dialog from Endpoint > Peers > Add Peer.

The first-run Add Peer dialog headed Hello there! It's time to add your first device, with the Windows tab and its Netzilo Client sub-tab open, showing four steps: Install Extension, Download Netzilo, Connect from the tray, Sign up

The top row has one tab per platform: Linux, Windows, macOS, iOS and Android. Each tab has sub-tabs:

Sub-tabWhat it installsPlatforms
Netzilo Clientthe Netzilo client, which joins the device to your networkall
Enterprise BrowserNetzilo's own managed browserWindows, macOS, iOS, Android
Gatewaythe Netzilo AI Gateway, for servers that route AI trafficLinux, Windows, macOS

For a laptop, stay on Netzilo Client and follow the four steps.

Install the browser extension

Click Install Extension. The button opens the extension store for the browser you are using: the Chrome Web Store, Microsoft Edge Add-ons or Firefox Add-ons. For Safari it opens the Netzilo Secure Browser app in the App Store, which carries the Safari extension. In Chrome, click Add to Chrome.

The Netzilo Secure Browser extension page in the Chrome Web Store with the Add to Chrome button

Confirm with Add extension.

The Chrome confirmation pop-up asking to add the Netzilo Secure Browser extension, with the Add extension button

The Netzilo icon appears in the browser toolbar. Back in the dialog, the button turns green and reads Installed once the dashboard detects the extension.

The Chrome Web Store page after the install, with the confirmation Netzilo Secure Browser has been added to Chrome and the Netzilo icon in the toolbar

Install the Netzilo client

Click Download Netzilo. The file is netzilo_setup.exe, a small online installer: it downloads the client while it runs, so the computer needs internet access. Open the downloaded file from the browser's downloads list.

Click I Agree on the licence page.

The Netzilo Client Setup licence agreement page with the I Agree button

Windows shows a User Account Control prompt. Accept it. The installer starts without administrator rights and asks for them for the part that installs the service and drivers. If you cancel the prompt, the install fails.

The Netzilo Client Setup progress bar while the client installs

When the installer shows Completed, click Close.

The Netzilo Client Setup page reporting Completed, with the Close button active

The client is installed in %ProgramData%\Netzilo Client. It runs as the Windows service Netzilo, and its tray app starts at sign-in. In the dialog, the Download Netzilo button turns into Installed once the dashboard detects the running client.

Connect and sign in

The client usually signs in on its own after the install, and your browser shows Login successful.

The Login successful page: Your device is now registered and logged in to Netzilo

If it does not, click the Netzilo icon in the system tray and choose Connect. Your browser opens the sign-in page. Sign in with the same account, and the browser shows Login successful.

The tray menu has these entries: Connect, Disconnect, Refresh, Admin Panel (opens the dashboard), Workspaces (Windows), Network Routes, Advanced, Support (Collect Data, Open Logs Folder), Version and Quit. Windows also has Record Session.

On a Mac the first start asks for three separate approvals in System Settings: a network extension, a security extension, and Full Disk Access for the security monitor. Approve all three. With only the first one, the connection works but the AI security features stay off.

Step 3: Check that the device is connected

The tray icon turns blue, and hovering over it shows Netzilo (Connected).

The Windows notification area with the Netzilo tray icon and the tooltip Netzilo (Connected)

From a terminal you can check the same thing:

netzilo status

The output shows Management: Connected, Signal: Connected and the device's Netzilo IP. Open a new terminal after the install, because terminals opened before it do not have netzilo on their PATH yet. See CLI for every field.

In the dashboard, go to Endpoint > Peers. The device is listed with a green dot, its Netzilo address and its groups.

Step 4: Decide who can reach what

A new account has a Default policy that lets every peer reach every other peer. That is convenient for a first test and too open for production. Next steps:

  1. Create groups, such as developers and servers, and put peers and users in them.
  2. Write policies between the groups under Network > Policies, then disable the Default policy. See Policies.
  3. Invite your colleagues under Team > Users. See Users.

Servers and containers

A server has no one to sign in, so you enrol it with a setup key instead of SSO. Create one under Endpoint > Setup Keys > Create Setup Key, then run:

netzilo up --setup-key <SETUP_KEY>

On a self-hosted server, add --management-url https://<your-domain>. A peer enrolled with a setup key does not expire with the login session. For containers, Kubernetes and headless machines that act as a user, see Install Netzilo and Setup Keys.

What users see

  • People you invite get an activation e-mail (Netzilo Cloud, or a self-hosted server with SMTP configured), sign in, and land on the Workplace. Their Devices tab shows Start Netzilo on this computer to see your devices. until the client runs on the computer they are using.
  • SSO devices are asked to sign in again when their login expires. The default is 24 hours and you change it under Settings > Authentication.

Troubleshooting

The client connects to the wrong server, or a self-hosted device never appears in the dashboard. Without --management-url, the client connects to Netzilo Cloud (https://srv.netzilo.com:443). To point it at your own server, run:

netzilo down
netzilo up --management-url https://<your-domain>

netzilo down logs the device out and resets its keys, so it registers again as a new peer. Delete the old entry under Endpoint > Peers.

The Windows install fails right after the UAC prompt. The prompt was cancelled or refused. The installer does not fall back to a limited install. Run it again and accept the prompt, or ask an administrator to deploy the MSI. See Installer command lines.

netzilo is not recognised in a terminal. The terminal was opened before the install. Open a new one, or call "%ProgramData%\Netzilo Client\netzilo.exe" on Windows or /Applications/Netzilo.app/Contents/MacOS/netzilo on macOS.

The browser does not show "Login successful". Click Connect in the tray menu to start the sign-in again. If the browser shows an error from the sign-in page, see Troubleshooting client issues.

On a Mac the connection works but AI features do nothing. One of the three approvals is missing. Check System Settings for the network extension, the security extension and Full Disk Access.