Security

Plain-language threat model

VPN client traffic stays on your VPS. It does not transit TunnelFleet. We are a control plane: a dashboard that queues work, plus an agent on your server that polls over HTTPS.

Anyone with Owner or Admin in your organization can cause that agent to change VPN software, users, firewall rules, and files on the box. Treat those roles like root.

The secret is the token, not the script

Everyone runs the same installer. Per-server values are environment variables and Bearer-authenticated fetches — they never appear in the script URL:

TUNNELFLEET_TOKEN='…' TUNNELFLEET_URL='https://tunnelfleet.com' TUNNELFLEET_IP='…' bash <(curl -fsSL https://tunnelfleet.com/install.sh)

DigitalOcean droplets run that same file via cloud-init (curl, sha256sum -c, then bash). You do not SSH.

Do not post the token. It is sent only as Authorization: Bearer — not in the path — so it does not land in access logs the way /install/TOKEN would.

Inspect before you run

1. curl -fsSL https://tunnelfleet.com/install.sh -o install.sh
2. curl -fsSL https://tunnelfleet.com/install.sh.sha256 | sha256sum -c -
3. less install.sh
4. Export TUNNELFLEET_TOKEN, TUNNELFLEET_URL, and TUNNELFLEET_IP from the dashboard, then bash install.sh

Canonical file: https://tunnelfleet.com/install.sh

SHA-256: https://tunnelfleet.com/install.sh.sha256

8e4ac42c361b9f5e3abb7044c6a49e6e66feca8242513782c487286ca47d312e install.sh

What the installer does, in order

1. Guard. Refuses to run if /opt/tunnelfleet/.provisioned already exists. Checks that this host’s public IP matches the IP registered in TunnelFleet.
2. Bootstrap. Fetches registered IP and the expected agent SHA-256 over HTTPS with the Bearer token. Aborts if that hash does not match the hash embedded in this installer.
3. Host payload. Fetches the per-server payload (protocols you selected, optional org SSH keys, Docker pull). That payload is not this checksummed file; it is authenticated and TLS-protected.
4. Packages. ca-certificates, curl, Docker Engine + Compose (Docker’s HTTPS apt repo, GPG signed-by), WireGuard kernel module/tools. A failed apt-get install of those packages aborts the install.
5. Sysctl. Enables IPv4 forwarding and sets rp_filter=2.
6. Docker pull credential. A read-only registry token, scoped to TunnelFleet protocol images only — not your cloud account, not push access, not an API key for the dashboard.
7. Protocol containers. Starts WireGuard and/or OpenVPN TCP/UDP. Default VPN user tunnelfleet.
8. Firewall. UFW allows SSH 22/tcp first, then protocol ports you enabled. FORWARD is set to ACCEPT because Docker NAT and VPN MASQUERADE must forward packets from the tunnel to the WAN. INPUT stays default-deny; unsolicited inbound traffic is still dropped.
9. Agent. Downloads /usr/local/bin/tunnelfleet-agent with a Bearer header, verifies SHA-256, installs systemd (ProtectHome=yes, PrivateTmp=yes). A mismatch or failed start aborts — the provisioned marker is not written.
10. Marker. Writes /opt/tunnelfleet/.provisioned only after the agent is installed and verified.

Product walkthrough: Installation.

What phones home

• During install: HTTPS POST to /api/servers/status (progress) and /api/servers/installed, with the enrollment token.
• After install: the agent polls /api/agent/commands about every five seconds over HTTPS and POSTs command results. Outbound only — we do not open an inbound port to the agent.
• VPN session traffic never goes to TunnelFleet.

Downloads and updates

Install-time fetches use HTTPS. Docker’s apt repo is pinned with their GPG key (signed-by). The agent is downloaded with a Bearer token and checked with SHA-256 before systemd starts it. The expected hash is embedded in install.sh and must match the hash the control plane returns at bootstrap.

Credentials for protocol images are a read-only Docker pull token scoped to TunnelFleet images. They are not injected into the checksummed installer; they arrive in the authenticated host payload.

What the agent can do

The agent is not open source. Dashboard actions (and repairs) queue commands it applies as root:

• Read or write files used for VPN config and diagnostics (contents of a read can be posted back)
• Restart systemd units
• Tail logs (files, journalctl, Docker)
• Open or close UFW rules for protocol ports
• Run a repair script
• Exec into a protocol container
• Sync VPN users into protocol auth files

Protocol install and firewall need root. We do not pretend this is a sandbox. If you need an air-gapped box with no vendor agent, run WireGuard yourself — see manual WireGuard vs TunnelFleet.

What the agent cannot do by design

• It does not listen for TunnelFleet. No inbound control port.
• It does not proxy or inspect VPN session traffic.
• It does not manage your cloud account unless you connect DigitalOcean and create a droplet from the dashboard.
• It does not wipe the VPS on cancellation.

Credentials and keys

• Dashboard login is stored hashed. Two-factor is available.
• Enrollment / agent token authenticates install pings and later polls. Rotate the server (new token) if it leaked.
• WireGuard keys are generated on the server. Private keys are not a dashboard field. A queued file-read could still retrieve a path an Owner/Admin asked for.
• OpenVPN user passwords are written to auth files on the host when you create VPN users.
• Stripe holds card numbers. We do not store PAN.
• DigitalOcean OAuth only if you connect that provider.

Data we keep in the control plane

• Account and organization membership
• Server metadata (name, IP, provider, protocol state, agent last-seen)
• VPN user records you create in the dashboard
• Command results, including log tails you requested
• Billing records

Details and retention: Privacy Policy.

What happens if you cancel

Your VPS keeps running. You keep SSH and root. Installed protocols keep working until you change them. The agent will fail to poll; disable tunnelfleet-agent.service and manage the box by hand.

How to reduce risk

• Invite the fewest Owners and Admins you can; use Viewer for read-only
• Download install.sh, check the SHA-256, read it, then run it with env vars — never pipe unseen
• Confirm the live script only talks to https://tunnelfleet.com and Docker’s HTTPS endpoints
• Rotate the server (new token) if the enrollment token leaked
• Keep Ubuntu 22.04 or 24.04 patched