1. Getting started

1.1 What Zedmos runs on

Zedmos installs on ordinary 64-bit x86 hardware — an appliance, a rack server, or a virtual machine. There is no hardware dongle and nothing to activate before the firewall works.

	Minimum	Recommended	Notes
CPU	64-bit x86 (amd64), 2 cores	4 cores	AES-NI raises VPN throughput considerably. ARM is not supported.
Memory	2 GB	4 GB	8 GB or more if you enable the security engine, IDS/IPS or file scanning. The virus scanner alone holds about 1 GB of signatures in RAM.
Storage	8 GB	32 GB or more	The installed system is about 1.1 GB. The rest is logs, packet captures, IDS rule sets and virus signatures — all of which grow.
Network	2 interfaces	2 or more	One uplink (WAN), one internal (LAN). A single interface works only with a managed switch and VLANs.
Firmware	UEFI or legacy BIOS	UEFI	Every download is hybrid: the same file boots either way, and the firmware decides.

Virtual machines are fully supported. Give the VM two network adapters, at least 4 GB of RAM if you plan to run the security engine, and use a disk controller the guest sees as a plain SATA or SCSI disk.

1.2 Which download do I take?

There are five downloads. They differ along two axes only — whether the file is a ready-made system or an installer, and whether it talks to a VGA screen or a serial line.

Download	What it is	Console	Take it when
`zedmos-installer.iso.xz`	Installer, ISO	VGA	Start here. Burn to a DVD or write to a USB stick; it boots on BIOS and UEFI alike.
`zedmos-installer-vga.img.xz`	Installer, disk image	VGA	Your firmware refuses to boot a USB stick that carries an ISO9660 filesystem. Same installer, plain GPT/UFS layout.
`zedmos-installer-serial.iso.xz`	Installer, ISO	Serial (115200 8N1)	The machine has no VGA header — a headless appliance driven over its serial port.
`zedmos.img.xz`	Ready-made system, disk image	VGA	You write the system straight onto the target disk (or a CF/SSD card) and skip the installer. The image expects a disk of at least 8 GB.
`zedmos-serial.img.xz`	Ready-made system, disk image	Serial	The same, for a machine with no screen.

Serial is not cosmetic. An appliance without a VGA header shows nothing at all on a VGA build: you can neither see nor drive the installer, and on an installed system you cannot reach the console menu either. If your hardware has a serial port and no video, take a serial download.

The installer downloads leave you a menu where you choose the disk, the layout (single disk, mirror, RAID-Z, encrypted, or manual partitioning) and the root password. The ready-made images are faster but always use the layout baked into the image.

1.3 Download and verify

All five files and their checksums live at:

https://www.zedmos.com/repo_zedmos_iso/

The directory also holds a SHA256 file with one line per download. Verify before you write — a truncated download produces an appliance that boots halfway and fails in ways that are hard to read.

$ curl -O https://www.zedmos.com/repo_zedmos_iso/zedmos-installer.iso.xz
$ curl -O https://www.zedmos.com/repo_zedmos_iso/SHA256
$ sha256sum -c --ignore-missing SHA256
zedmos-installer.iso.xz: OK

On Windows PowerShell:

Get-FileHash .\zedmos-installer.iso.xz -Algorithm SHA256
# compare the hash with the matching line in the SHA256 file

1.4 Unpack and write the medium

Every download is xz-compressed. Decompress it first.

$ xz -d zedmos-installer.iso.xz          # -> zedmos-installer.iso

On Windows, 7-Zip opens .xz files; on macOS, xz comes with Homebrew.

Writing a USB stick

The write erases the stick completely. Check the device name twice: naming the wrong disk overwrites it with no confirmation and no way back.

Linux:

# lsblk                                   # find the stick, e.g. sdb
# dd if=zedmos-installer.iso of=/dev/sdb bs=4M status=progress conv=fsync

macOS:

$ diskutil list                           # find the stick, e.g. disk4
$ diskutil unmountDisk /dev/disk4
# dd if=zedmos-installer.iso of=/dev/rdisk4 bs=4m

FreeBSD:

# dd if=zedmos-installer.iso of=/dev/da0 bs=4m conv=sync

Windows: use a tool that writes a raw image — Rufus in DD image mode, balenaEtcher, or Win32 Disk Imager. A tool that "extracts the ISO onto a FAT32 stick" produces a stick that does not boot.

Writing the ready-made system directly

The same command, pointed at the target disk instead of a stick, and using zedmos.img. Everything on that disk is destroyed. On first boot the appliance expands to fill the disk and generates its own keys and certificate.

1.5 What you need in front of you

A network cable from the appliance's uplink port to your existing router or modem. Out of the box the uplink asks for an address by DHCP.
A second cable from the internal port to a switch, or straight to the laptop you will configure from. The internal port answers on 192.168.1.1/24 and hands out addresses from 192.168.1.100 upward.
A screen and keyboard, or a serial cable, for the first few minutes. You can skip this only if you are happy with the default addressing.

Once the box is up and your laptop has an address from it, the control panel is at https://192.168.1.1/ — user root, password zedmos.

PreviousZedmos Administrator Manual Next2. Installation