Deploy UserGate VE on a cloud server

Last update: July 28 2026

1. Save the firewall image.
2. Upload the image to the image storage.
3. Optional: change the virtual network adapter type.
4. Optional: enable the multi-queue property for the virtio virtual network adapter.
5. Create a cloud server from the image.
6. Assign an IP address to access the firewall.
7. Initialize the firewall.
8. Specify the DNS and NTP servers.
9. Activate the license.

1. Save the firewall image

1. Go to the ticket that was created when ordering the firewall.
2. Save the firewall image to the device you will use to configure it.

2. Upload the image to the image storage

1. In the control panel, in the top menu, click Products and select Cloud Servers.
2. Go to the Images section.
3. Click Create image.
4. Enter the image name.
5. Select the location where you want to deploy the firewall.
6. In the Operating system field, select — Other.
7. In the Source field, select — File.
8. Click Upload and select the firewall image file on your device.
9. Select the image format and container format.If you are not sure which formats to specify, enter image format raw, container format — bare.
10. Click Create.

3. Optional: change the virtual network adapter type

By default, the UserGate firewall image properties have the virtio network adapter installed.You can change the adapter type to improve compatibility with your infrastructure.The cloud server will inherit the adapter type set in the image properties at the time of server creation.Changing the adapter type will not apply to already created cloud servers.

To change the adapter type:

1. Open OpenStack CLI.

2. Change the virtual network adapter type:

   openstack image set --property hw_vif_model=<vif_model> <image>

   Specify:

   • <vif_model> — the virtual network adapter type:

     • vmxnet3;
     • e1000;
     • e1000e.

   • <image> — image ID or name. You can view the list of images using the openstack image list.

4. Optional: enable the multi-queue property for the virtio virtual network adapter

warning

Enabling the multi-queue property will increase the load on all vCPUs.

By default, the UserGate firewall image properties have the virtio network adapter installed.If you have not changed the adapter type, you can enable the multithreading property, which allows the use of multiple vCPUs.

1. Open OpenStack CLI.

2. Enable the multi-queue property:

   openstack image set --property hw_vif_multiqueue_enabled=true <image>

   Specify <image> — image ID or name. You can view the list of images using the openstack image list.

5. Create a cloud server from the image

1. In the control panel, in the top menu, click Products and select Cloud Servers.

2. In the Servers section, click Create server.

3. Enter the cloud server name — it will only be displayed in the control panel.

4. Select the location where you uploaded the firewall image.

5. In the Source block, open the Images tab and select the firewall image.

6. Select the cloud server configuration.The configuration must comply with the requirements for the selected firewall model.

7. Select the internet access type.You will need at least one public address to access the firewall from the internet:

   • public floating IP address — a private subnet and one static public IP address;
   • direct public IP address — one static public IP address;
   • public subnet — all IP addresses in the subnet will be accessible from the internet.

8. If you selected Public floating IP address in step 7, select or create a private subnet to which the server will be connected.

9. Select the remaining server settings — see the Create Cloud Server instructions for details.

10. Click Create.

6. Assign an IP address to access the firewall

UGOS 6

1. Open the CLI.

2. Connect to the firewall:

   • login — Admin;
   • password — utm.

3. Switch the internet port to static mode:

   iface config -name port0 -mode static

4. Assign an IP address to the port:

   iface config -name port0 -ipv4 <ip_address>/<mask>

   Specify:

   • <ip_address> — the IP address of the server's internet port. You can copy the IP address in the control panel: in the top menu, click Products → Cloud Servers → Servers section → server page → Ports tab → in the port card, click next to the IP address. The address is specified without a mask;
   • <mask> — the subnet mask.

5. Create a default route to the internet:

   gateway add -ipv4 <gateway> -weight 1 -enabled true -default true

   Specify <gateway> — the gateway of the server subnet where the internet port is located. The subnet gateway can be viewed in the control panel: in the top menu, click Products → Cloud Servers → Servers → server page → Ports tab → subnet name → Subnets tab → subnet card → Subnet Gateway field.

UGOS 7

1. Open the CLI.

2. Select UGOS NGFW (serial console) mode.

3. Connect to the firewall:

   • login — Admin;
   • password — leave the field empty.

4. Enter configuration mode:

   configure

5. Assign an IP address to the port:

   set network interface adapter port0 ip-addresses [ <ip_address>/<mask> ]

   Specify <ip_address>/<mask> — the IP address of the server's internet port with the subnet mask. You can copy the IP address in the control panel: in the top menu, click Products → Cloud Servers → Servers section → server page → Ports tab → in the port card, click next to the IP address. Square brackets [ ] must be separated by spaces on both sides.

6. Create a gateway:

   create network gateway interface port0 enabled on ip <gateway> weight 1 default on

   Specify <gateway> — the gateway of the server subnet where the internet port is located. The subnet gateway can be viewed in the control panel: in the top menu, click Products → Cloud Servers → Servers → server page → Ports tab → click the subnet name → Subnets tab → subnet card → Subnet Gateway field.

UGOS 7.1 and higher

1. Open the CLI.

2. Select UGOS NGFW (serial console) mode.

3. Connect to the firewall:

   • login — Admin;
   • password — usergate.

4. Enter configuration mode:

   configure

5. Assign an IP address to the port:

   set network interface adapter port0 ip-addresses [ <ip_address>/<mask> ]

   Specify <ip_address>/<mask> — the IP address of the server's internet port with the subnet mask. The IP address can be copied in the control panel: in the top menu, click Products → Cloud Servers → server page → Ports tab → in the port card, click next to the IP address. The square brackets [ ] must be separated by spaces on both sides.

6. Create a gateway:

   create network gateway interface port0 enabled on ip <gateway> weight 1 default on

   Specify <gateway> — the gateway of the server subnet where the internet port is located. The subnet gateway can be viewed in the control panel: in the top menu, click Products → Cloud Servers → Servers → server page → Ports tab → click the subnet name → Subnets tab → subnet card → Subnet Gateway field.

7. Initialize the firewall

1. Open the following page in your browser:

   https://<ip_address>:8001

   Specify <ip_address> — the IP address of the firewall. You can copy the IP address in the control panel: in the top menu, click Products → Cloud Servers → Servers section → server page → Ports tab → in the port card, click next to the public IP address.

2. Select the system language.

3. Select the time zone.

4. Accept the license agreement.

5. Optional: change the administrator login.

6. Change your password.

7. Click Start.

8. Wait for the installation procedure to complete.

8. Specify DNS and NTP servers

1. Open the following page in your browser:

   https://<ip_address>:8001

   Specify <ip_address> — the IP address of the firewall. You can copy the IP address in the control panel: in the top menu, click Products → Cloud Servers → Servers section → server page → Ports tab → in the port card, click next to the IP address.

2. Enter login and password.

3. Go to Settings → Network → DNS.

4. Click Add.

5. Enter the DNS server IP addresses.We recommend using the Selectel recursive DNS servers, but you can specify any available DNS servers.

6. Click Save.

7. Optional: go to the Settings section and in the Server Time Configuration block, change the value in the Primary NTP Server field.We recommend using the Selectel NTP servers, but you can specify any available NTP servers.

9. Activate the license

UGOS 6

1. Open the following page in your browser:

   https://<ip_address>:8001

   Specify <ip_address> — the IP address of the firewall. The IP address can be copied in the control panel: in the top menu, click Products → Cloud Servers → section Servers → server page → Ports tab → in the port card, click next to the public IP address.

2. Enter login and password.

3. At the top, click the Unregistered version button.

4. Enter the PIN code received in the ticket when ordering the firewall.

5. Click Next.

6. Fill out the registration form. We recommend using the same data as in your Selectel account.

7. Click Next.

8. Wait for the firewall to register. Information about the license composition and expiration dates of the components will be displayed in the Dashboard section in the License block.

UGOS 7 and higher

1. Open the following page in your browser:

   https://<ip_address>:8001

   Specify <ip_address> — the IP address of the firewall. The IP address can be copied in the control panel: in the top menu, click Products → Cloud Servers → section Servers → server page → Ports tab → in the port card, click next to the IP address or public IP address.

2. Enter login and password.

3. Go to License Information → Registered version.

4. Enter the PIN code received in the ticket when ordering the firewall.

5. Click Next.

6. Wait for the firewall to register. Information about the license composition and expiration dates of the components will be displayed in the License Information **** section.