Zedmos

Zedmos Administrator Manual

⌘K

Zedmos is a firewall and network security appliance: a FreeBSD data plane with pf doing the packet work, driven by a single management daemon that serves the web control panel, the REST API and the physical console. An optional security engine adds deep packet inspection, threat intelligence, TLS inspection and file scanning on top.

This manual takes you from a blank machine to a configured appliance, then through every page of the control panel, then through the deployments people actually build.

Contents

  1. Getting started — what you need, which download to take, how to verify it and write it to a USB stick.
  2. Installation — booting the installer, the installation modes, and what the first boot does on its own.
  3. The console — the menu on the physical console: assign interfaces, set an address, reset the root password, recover a box you cannot reach.
  4. First configuration — signing in, the setup steps, WAN and LAN, DHCP, DNS, and proving that traffic flows.
  5. The control panel — every menu, every page: what it is for, what to set, and what to watch out for.
  6. Use cases — worked, end-to-end recipes: office gateway, VLAN segmentation, publishing a server, site-to-site and road-warrior VPN, guest Wi-Fi with a captive portal, IDS/IPS, high availability.
  7. Maintenance — backups, firmware updates, boot environments, certificates, users and API keys.
  8. Troubleshooting — what to look at when something does not work, in the order a support engineer would look at it.

Conventions

  • Menu paths are written as they appear in the sidebar: Firewall → Rules → LAN.
  • Field names appear in italics; values you type appear in monospace.
  • Commands prefixed with # run as root on the appliance, in a console shell or over SSH.
  • Addresses in examples use the documentation ranges (192.168.1.0/24, 203.0.113.0/24). Replace them with your own.
  • Where a screenshot shows a value, it is a real value from a real appliance — yours will differ.

Interface names are per machine. em0, igb0, vtnet0, ix0 are all normal; which name your uplink has depends on your network cards, and the installer does not rename them. Everywhere this manual says "the WAN interface", it means the interface you assigned to WAN, not a fixed name.

Defaults worth knowing before you start

Web control panelhttps://<appliance address>/ (plain HTTP redirects to HTTPS)
First loginuser root, password zedmos — change it immediately
LAN address out of the box192.168.1.1/24
LAN DHCP pool out of the box192.168.1.100 – 192.168.1.199
WAN out of the boxDHCP client
SSHon, root login and password authentication permitted (System → Settings → Administration)

The certificate the panel serves on first contact is generated by the appliance itself, so your browser will warn about it. That is expected; replace it with your own certificate once you are in (System → Trust, then System → Settings → Administration).

Change the root password before you attach the appliance to a network anyone else can reach. A new appliance answers SSH on port 22 with root login and password authentication enabled, and the password is the one printed above — which means anyone who can reach the box has root until you change it. System → Access → Users changes it; the console menu (Reset the root password) does the same without a browser. If you do not need SSH, turn it off in System → Settings → Administration.

Next1. Getting started