Installing DNClient Server

This guide describes how to install the dnclient binary and use it to enroll a computer into your Managed Nebula network.

Linux

On Debian-, RPM-, and Arch-based distributions, install dnclient from a package. The package puts the binary at /usr/bin/dnclient, registers a systemd service, and lets you pick up new versions through your normal system updates. On other distributions, use the standalone binary.

Install from the package repository

APT

For Debian, Ubuntu, Linux Mint, Pop!_OS, and other APT-based distributions.

1. Add the Defined Networking signing key. The install command creates the keyring directory if your distribution doesn’t already have one.

sudo install -m 0755 -d /etc/apt/keyrings
sudo curl -fsSL https://dl.defined.net/gpg.asc -o /etc/apt/keyrings/defined-net.asc

2. Add the repository:

echo "deb [signed-by=/etc/apt/keyrings/defined-net.asc] https://dl.defined.net/stable/apt stable main" \
  | sudo tee /etc/apt/sources.list.d/defined-net.list > /dev/null

3. Install dnclient and enable the service so it starts on boot:

sudo apt-get update
sudo apt-get install dnclient
sudo systemctl enable --now dnclient

RPM

For RHEL, Fedora, Rocky Linux, Alma Linux, CentOS Stream, Amazon Linux, and other dnf-based distributions.

1. Add the repository:

sudo curl -fsSL https://dl.defined.net/stable/rpm/defined-net.repo -o /etc/yum.repos.d/defined-net.repo

2. Install dnclient and enable the service so it starts on boot:

sudo dnf install dnclient
sudo systemctl enable --now dnclient

Arch (AUR)

For Arch Linux, Manjaro, EndeavourOS, and other Arch-based distributions, Defined Networking maintains the dnclient package in the Arch User Repository.

1. Install the package with your AUR helper, or build it manually with makepkg:

# with an AUR helper
yay -S dnclient

# or manually
git clone https://aur.archlinux.org/dnclient.git
cd dnclient
makepkg -si

2. Enable the service so it starts on boot:

sudo systemctl enable --now dnclient

With the service running, enroll the host, replacing <ENROLL_CODE> with the enrollment code you receive from the admin panel after creating or re-enrolling the host.

sudo dnclient enroll -code <ENROLL_CODE>

Confirm the service is running and the host has a certificate:

systemctl status dnclient
sudo dnclient info

Your computer is now running dnclient and will be able to communicate with other machines on your Managed Nebula network.

Note

The package ships its own systemd unit, so the packaged build has no install, uninstall, start, or stop subcommands. Manage the service with systemctl instead. To connect the host to more than one network, use the dnclient@.service template unit, for example sudo systemctl enable --now dnclient@production.

Service configuration

The packaged service takes its settings from environment variables, which it reads from a file whose location depends on the distribution:

Distribution	Environment file
Debian, Ubuntu, and other APT-based	/etc/default/dnclient
RHEL, Fedora, and other RPM-based	/etc/sysconfig/dnclient
Arch-based	/etc/conf.d/dnclient

The package ships this file with every setting commented out, so the defaults below apply until you edit it. A named instance reads its own file with the instance name appended, such as /etc/default/dnclient.production for dnclient@production.service. That file is optional and the package doesn’t create it.

Variable	Default	Description
DNCLIENT_STATE_DIR	/var/lib/defined	Directory holding enrollment state. A named instance stores its state in a subdirectory, such as /var/lib/defined/production/.
DNCLIENT_LOG	unset	File to write logs to. When unset, logs go to stdout, where journald captures them.
DNCLIENT_SERVER	https://api.defined.net	API server used for enrollment, certificate rotation, and configuration updates.
DNCLIENT_NAME	unset	Instance name. The template unit sets this per instance, so enable dnclient@<name>.service rather than setting it here.

Restart the service to apply a change:

sudo systemctl restart dnclient

Only the service reads this file. dnclient commands you run yourself use the defaults unless you set the variable in your own shell or pass the matching flag (-config, -log, -server, -name).

Install the standalone binary

Use this method on distributions the package repository doesn’t cover, or where you don’t want a system package. You’ll need to repeat these steps by hand for each upgrade.

1. Obtain the URL for the latest version of the dnclient binary for your architecture from https://admin.defined.net/downloads.
2. From a directory where you wish to download dnclient, run the following curl command, replacing <DL_URL> with the link you obtained from the downloads page.

curl -O <DL_URL>

3. Make dnclient executable:

sudo chmod +x dnclient

4. Install dnclient as a service. This will use the dnclient binary in its current directory, so move it first if you’d like it somewhere else.

sudo ./dnclient install

5. Start dnclient. As a service, it will be started automatically on future reboots.

sudo ./dnclient start

6. Enroll the host, replacing <ENROLL_CODE> with the enrollment code you receive from the Managed Nebula admin panel after creating or re-enrolling the host.

sudo ./dnclient enroll -code <ENROLL_CODE>

Your computer is now running dnclient and will be able to communicate with other machines on your Managed Nebula network.

macOS

For macOS, we offer DNClient Server in two formats—a standalone binary and packaged into a .dmg. The version in the .dmg is suitable for use in offline installations, since the signing information does not need to be retrieved from Apple servers. Otherwise, they are identical in functionality.

1. Obtain the URL for the latest version of the dnclient binary or .dmg from https://admin.defined.net/downloads.
2. From a directory where you wish to download dnclient, run the following curl command, replacing <DL_URL> with the link you obtained from the downloads page.

curl -O <DL_URL>

3. If you downloaded DNClient-Server.dmg, mount the image and copy the binary to your filesystem. Otherwise if you downloaded the binary directly, make it executable:

sudo chmod +x dnclient

4. Install dnclient as a service. This will use the dnclient binary in its current directory, so move it first if you’d like it somewhere else.

sudo ./dnclient install

5. Start dnclient. As a service, it will be started automatically on future reboots.

sudo ./dnclient start

6. Enroll the host, replacing <ENROLL_CODE> with the enrollment code you receive from the Managed Nebula admin panel after creating or re-enrolling the host.

sudo ./dnclient enroll -code <ENROLL_CODE>

Your computer is now running dnclient and will be able to communicate with other machines on your Managed Nebula network.

Windows

1. Find the latest version of the DNClient-Server.msi installer for your architecture from https://admin.defined.net/downloads.

2. Download the installer directly from the downloads page, or in a PowerShell terminal started as Administrator on the host, run the provided curl command, replacing <DL_URL> with the link from the downloads page.

curl.exe -O <DL_URL>

3. The MSI you downloaded can be double-clicked to be run and will install DNClient as a service. This will install dnclient, set it up as a service, and start it.

4. In a PowerShell terminal run as administrator, run the following command to enroll the host, replacing <ENROLL_CODE> with the enrollment code you receive from the Managed Nebula admin panel after creating or re-enrolling the host.

& 'C:\Program Files\Defined Networking\DNClient\dnclient.exe' enroll -code  <ENROLL_CODE>

Your computer is now running dnclient and will be able to communicate with other machines on your Managed Nebula network.