Install zLAN offline

Use this page when deploying a zLAN firewall on a system without internet access. NetFoundry provides an offline bundle containing all required packages and dependencies for supported OS versions and architectures.

note

This page covers offline installation of the zLAN firewall only. For offline installation of NetFoundry Self-Hosted, see the Self-Hosted documentation.

Before you start

• Confirm the bundle matches your target OS and architecture before transferring it.
• Obtain JFROG service account credentials from the NetFoundry Console at https://<orgname>.cloudziti.io. These credentials are used to download the offline bundle.

What's in the bundle

NetFoundry provides an archive named zlan-offline-<os>-<version>-<arch>.tar.gz that contains:

• All required DEB or RPM packages and their dependencies for the specified OS and architecture
• An offline installer script and README with OS-specific notes

Supported OS versions and architectures

OS	Version	Architectures	Package type
ubuntu	24.04	amd64, arm64	deb
rhel	9	x86_64, aarch64	rpm

Packages

Package	Description
zlan-installer	zLAN install script that configures the local system.
zfw	zLAN firewall module.
zlan-router	zLAN router module.
filebeat	Elastic Filebeat; gathers and ships metrics.
chronyd	System time synchronization daemon.
dhcpd	DHCP server used by zlan-router.

Additional dependencies

• RHEL/CentOS/Rocky/AlmaLinux:
  • systemd-resolved: Required for zlan-router to manage local DNS resolution.

Download the bundle

On a machine with internet access, download the offline bundle using your JFROG service account credentials. Select the package type and architecture that match your target OS:

export USERNAME=<account-username>
export PASSWORD=<account-password>
curl -fSL -u "$USERNAME:$PASSWORD" -OJ https://netfoundry.jfrog.io/artifactory/nfpax-private-tgz-stable/<package-type>/<arch>/zlan-offline-<os>-<version>-<arch>.tar.gz

For example, to download the bundle for Ubuntu 24.04 on amd64:

curl -fSL -u "$USERNAME:$PASSWORD" -OJ https://netfoundry.jfrog.io/artifactory/nfpax-private-tgz-stable/deb/amd64/zlan-offline-ubuntu-24.04-amd64.tar.gz

Install and enroll

warning

The controller must be reachable by the firewall you are about to register at enrollment time. If your environment is fully isolated and cannot reach the controller, you can't proceed until that connectivity is resolved.

1. Transfer the bundle to the target system (USB drive, external disk, or secure file transfer).

2. Extract the bundle to the standard install path. The archive contains a top-level zlan-offline directory, so extract into /opt/netfoundry:

   sudo mkdir -p /opt/netfoundry
   sudo chown ubuntu:ubuntu /opt/netfoundry
   tar -zxf ./zlan-offline-<os>-<version>-<arch>.tar.gz -C /opt/netfoundry
   cd /opt/netfoundry/zlan-offline

3. Run the offline installer from the unpacked bundle:

   sudo ./offline_install.sh

   The installer installs all required packages from the bundle. No internet access is required.

4. Enroll and configure zLAN using your JWT token:

   /opt/openziti/zlan/scripts/zlan-firewall-setup.sh <JWT_TOKEN>

Upgrade the firewall

To upgrade the zLAN firewall in an air-gapped environment, download the new offline bundle and extract it over the existing installation:

1. On a machine with internet access, download the new bundle version using your JFROG service account credentials (see Download the bundle).

2. Transfer the bundle to the target system and extract it over the existing installation path:

   tar -zxf ./zlan-offline-<os>-<version>-<arch>.tar.gz -C /opt/netfoundry
   cd /opt/netfoundry/zlan-offline

3. Run the offline installer again to upgrade the installed packages:

   sudo ./offline_install.sh

Downgrading to a previous version is possible, but not recommended. If an upgrade causes issues, contact NetFoundry support before attempting a rollback.

Troubleshoot installation issues

• Missing dependencies: Verify the bundle matches your target OS release and architecture, and that you ran the included offline installer.
• Service startup failures: Check that DNS and time synchronization services are active (chrony, systemd-resolved).
• For further assistance, collect relevant logs and configuration files and contact NetFoundry support.