Saltar a contenido

CLI

TunGuard can be managed directly from the command line or through systemd when installed as a service.

Install⚓

Install TunGuard on a Linux server with:

curl -fsSL https://raw.githubusercontent.com/TunGuard/get/main/installer.sh | bash

The installer installs TunGuard as a systemd service and starts it automatically.

Service Management⚓

Check the service status:

sudo systemctl status tanguard

Start TunGuard:

sudo systemctl start tanguard

Stop TunGuard:

sudo systemctl stop tanguard

Restart TunGuard:

sudo systemctl restart tanguard

Enable TunGuard to start automatically on boot:

sudo systemctl enable tanguard

Logs⚓

View the TunGuard service logs:

sudo journalctl -u tanguard

Follow the logs in real time:

sudo journalctl -u tanguard -f

Show logs from the current boot:

sudo journalctl -u tanguard -b

Show the most recent logs:

sudo journalctl -u tanguard -n 100

Reset Dashboard Credentials⚓

If you forget the dashboard username or password, stop TunGuard first:

sudo systemctl stop tanguard

Run the reset command:

sudo ./tanguard --reset

The reset restores:

Username: admin
Password: tanguard

Start TunGuard again:

sudo systemctl start tanguard

The complete procedure is:

sudo systemctl stop tanguard
sudo ./tanguard --reset
sudo systemctl start tanguard

This resets the stored dashboard login without removing the configured peers or other persistent TunGuard data.

Manual Run⚓

TunGuard can also be started directly from the command line.

sudo ./tanguard

Enable the web dashboard when running manually:

sudo ./tanguard -web

Enable the SSH Gateway:

sudo ./tanguard -ssh

Enable both:

sudo ./tanguard -web -ssh

When using the systemd service installed by the installer, these options are configured through the service configuration rather than being required for normal operation.

SSH Gateway⚓

The optional SSH Gateway allows you to reach devices connected to TunGuard through the VPN.

The default SSH Gateway port is:

2222

For example, to connect to a WireGuard peer at 10.100.0.2:

ssh -J admin@YOUR_SERVER_IP:2222 root@10.100.0.2

The SSH Gateway uses the TunGuard dashboard credentials for authentication.

The jump host can be used without exposing SSH directly on the VPN device.

See SSH Access for the browser SSH terminal, the built-in ssh client, and the jump command.

Domains (HTTPS Reverse Proxy)⚓

TunGuard can publish a domain with automatic HTTPS in front of a TRP mapping or a tunneled service. Manage mappings from the console:

domain list                                     mappings: domain, backend, target, state
domain add app.example.com --trp 3              behind an existing TRP mapping
domain add api.example.com --wg 10.100.0.2 8080 behind a tunneled WireGuard service
domain update app.example.com --disable         pause without deleting
domain remove app.example.com                   by id or domain name

See Domains & HTTPS Proxy for the full guide.

AdGuard Home⚓

The built-in AdGuard Home can filter DNS for devices in an AdGuard-enabled policy group:

adguard status     state, DNS/Web listen addresses, upstream, adult filter
adguard start      launch the managed AdGuard Home instance
adguard stop       stop it
adguard config     binary, data dir and all ADGUARD_* settings

See AdGuard DNS Filtering for the full guide.

SSH Gateway With a Custom Port⚓

If the SSH Gateway is configured to use another port, specify that port in the jump host:

ssh -J admin@YOUR_SERVER_IP:CUSTOM_PORT root@10.100.0.2

Check the SSH Gateway⚓

Check whether TunGuard is running:

sudo systemctl status tanguard

Then check that the SSH Gateway is listening on port 2222:

sudo ss -lntp | grep 2222

Check the Dashboard/API⚓

The default dashboard and API port is:

9000

Check whether TunGuard is listening:

sudo ss -lntp | grep 9000

The health endpoint can be checked locally with:

curl http://127.0.0.1:9000/api/health

Check the WireGuard Port⚓

The default WireGuard port is:

13231/udp

Check whether TunGuard is listening:

sudo ss -lunp | grep 13231

Update TunGuard⚓

Run the installer again to update an existing installation:

curl -fsSL https://raw.githubusercontent.com/TunGuard/get/main/installer.sh | bash

The installer replaces the TunGuard binary while preserving the existing persistent data and service configuration.

Backup⚓

Create a backup of the TunGuard data directory:

sudo tar -czf ~/tanguard-backup.tar.gz -C /var/lib/tanguard .

The persistent data contains the server key, peer configuration, dashboard credentials, API key, and other TunGuard state.

Useful Service Commands⚓

A quick reference:

# Status
sudo systemctl status tanguard

# Start
sudo systemctl start tanguard

# Stop
sudo systemctl stop tanguard

# Restart
sudo systemctl restart tanguard

# Enable at boot
sudo systemctl enable tanguard

# Follow logs
sudo journalctl -u tanguard -f

# Last 100 log entries
sudo journalctl -u tanguard -n 100