Central control. Local traffic.
The central platform holds your configuration and access decisions. Each site's Linux gateway enforces them and sends client traffic to its own internet connection.
URUFI Console and platformURUFI Cloud or your serversWho runs what
The Console, Edge Agent and features are the same in both options.
| URUFI Cloud | Self-hosted | |
|---|---|---|
| Central platform | Operated and updated by URUFI | Operated and updated by you |
| Licensing | Subscription for one workspace | Signed license, verified locally |
| Site gateways | Provided and maintained by you | Provided and maintained by you |
| Edge Agent updates | Installed per site from the Console | Installed per site from the Console |
| When the term ends | Management pauses; gateways keep forwarding | Management and new portal sign-ins pause; existing access continues |
Self-hosted installations are planned with our team.Ask about self-hosted
What runs at your site
One Linux gateway per site, in the client traffic path. The Edge Agent applies your configuration there.
- DHCP
- Captive portal
- Firewall
- Bandwidth limits
- RADIUS for EAP-TLS
- Metrics
- Access points bridge clients to the gateway's LAN, without a second NAT or DHCP server.
- Separate networks reach the gateway as VLANs on access, trunk or hybrid ports.
- A failed change is rejected and the last known good configuration stays active.
If the control link drops
The gateway keeps enforcing the last configuration it validated.
Continues at the site
- Existing access, until it expires
- DHCP, firewall and bandwidth limits
- Certificate sign-ins the gateway can already verify
Waits for reconnection
- New portal sign-ins
- Policy and configuration changes
- New certificates and revocations
Expiry is enforced on the gateway and never extended while offline. After reconnection the gateway receives a complete current snapshot.
Recovery details in the docsGateway requirements
Each site needs one Linux machine in the client traffic path.
- Linux with systemd, on x86-64 or ARM64
- Separate LAN and WAN interfaces
- Placed as the clients' default gateway
- Root access to run the installer
- Outbound TCP 9090 to the URUFI platform
- Reliable time, preferably from NTP
The installer adds nftables, iproute2 and the IFB module. We do not publish minimum hardware figures, so test on your target hardware and distribution first.
Check the installation guideCommon questions
Is URUFI a Wi-Fi controller?
No. URUFI decides who can use a network and how their traffic is treated. Your access points and controllers keep managing radios and SSIDs.
Do we replace our switches or access points?
No. The gateway sits in the traffic path and your switches and access points stay. Certificate access needs access points that support WPA2 or WPA3-Enterprise.
Does client traffic pass through URUFI?
No. Traffic leaves through each site's own internet connection. The platform exchanges configuration and status with the gateway, and serves the portal sign-in pages.
What happens when a cloud subscription ends?
Management pauses until it is renewed. Gateways keep forwarding traffic and enforcing the access they already hold.
Start with one site.
Try URUFI Cloud free on one gateway, with no credit card. Prepare the gateway with the installation guide.