Deploy UserGate VE on a cloud server

Last update: October 05 2026Open in Markdown

1. Save the firewall image.
2. Upload the image to the image repository.
3. Optional: change the virtual network adapter type.
4. Optional: enable the multiqueue feature for the virtio virtual network adapter.
5. Create a cloud server from the image.
6. Assign an IP address to access the firewall.
7. Initialize the firewall.
8. Specify DNS and NTP servers.
9. Activate the license.

1. Save the firewall image

1. Go to the ticket that was created when ordering the firewall.
2. Save the firewall image to the device you will use to configure it.

2. Upload the image to the image storage

1. In the control panel, in the top menu, click Products and select Cloud Servers.
2. Go to the Images section.
3. Click Create image.
4. Enter the image name.
5. Select a location for the image where you want to deploy the firewall.
6. In the Operating system field, select Other.
7. In the Source field, select File.
8. Click Upload and select the firewall image file on your device.
9. Select the image format and container format. If you do not know which formats to specify, set the image format to raw and container format to bare.
10. Click Create.

3. Optional: change the virtual network adapter type

By default, the UserGate firewall image properties are set to use the virtio virtual network adapter. You can change the adapter type to improve compatibility with your infrastructure. The cloud server will inherit the adapter type defined in the image properties at the time of server creation. Changing the adapter type will not apply to already created cloud servers.

To change the adapter type:

1. Open the OpenStack CLI.

2. Change the virtual network adapter type:

   openstack image set --property hw_vif_model=<vif_model> <image>

   Specify:

   • <vif_model> — virtual network adapter type:

     • vmxnet3;
     • e1000;
     • e1000e.

   • <image> — ID or name of the image. You can view the list of images using the openstack image list command.

4. Optional: enable the multi-queue property for the virtio virtual network adapter

warning

Enabling the multi-queue property will increase the load on all vCPUs.

By default, the UserGate firewall image properties are set to use the virtio virtual network adapter. If you have not changed the adapter type, you can enable the multithreading property, which allows the use of multiple vCPUs.

1. Open the OpenStack CLI.

2. Enable the multi-queue property:

   openstack image set --property hw_vif_multiqueue_enabled=true <image>

   Specify <image> — ID or name of the image. You can view the list of images using the openstack image list command.

5. Create a cloud server from the image

1. In the control panel, in the top menu, click Products and select Cloud Servers.

2. In the Servers section, click Create server.

3. Enter the cloud server name — it will only be displayed in the control panel.

4. Select the location where you uploaded the firewall image.

5. In the Source block, open the Images tab and select the firewall image.

6. Select a cloud server configuration. The configuration must meet the requirements for the selected firewall model.

7. Select the type of internet access (inbound and outbound). You will need at least one public address to access the firewall from the internet:

   • public floating IP address — a private subnet and one static public IP address;
   • direct public IP address — one static public IP address;
   • public subnet — all IP addresses in the subnet will be accessible from the internet.

8. If in step 7 you selected Public Floating IP, select or create a private subnet to which the server will be connected.

9. Select the remaining server settings — for more details, see the Create a cloud server instructions.

10. Click Create.

6. Assign an IP address to access the firewall

UGOS 6

1. Open the CLI.

2. Connect to the firewall:

   • login — Admin;
   • password — utm.

3. Switch the Internet port to static mode:

   iface config -name port0 -mode static

4. Assign an IP address to the port:

   iface config -name port0 -ipv4 <ip_address>/<mask>

   Specify:

   • <ip_address> — IP address of the server Internet port. You can copy the IP address in the control panel: in the top menu, click Products → Cloud Servers → Servers section → server page → Ports tab → in the port card, click next to the IP address. The address is specified without a mask;
   • <mask> — subnet mask.

5. Create a default route to the internet:

   gateway add -ipv4 <gateway> -weight 1 -enabled true -default true

   Specify <gateway> — gateway of the server subnet where the Internet port is located. You can view the subnet gateway in the control panel: in the top menu, click Products → Cloud Servers → Servers → server page → Ports tab → subnet name → Subnets tab → subnet card → Subnet gateway field.

UGOS 7

1. Open the CLI.

2. Select UGOS NGFW (serial console) mode.

3. Connect to the firewall:

   • login — Admin;
   • password — leave the field empty.

4. Enter configuration mode:

   configure

5. Assign an IP address to the port:

   set network interface adapter port0 ip-addresses [ <ip_address>/<mask> ]

   Specify <ip_address>/<mask> — IP address of the server Internet port with the subnet mask. You can copy the IP address in the control panel: in the top menu, click Products → Cloud Servers → Servers section → server page → Ports tab → in the port card, click next to the IP address. Square brackets [ ] must be separated by spaces on both sides.

6. Create a gateway:

   create network gateway interface port0 enabled on ip <gateway> weight 1 default on

   Specify <gateway> — gateway of the server subnet where the Internet port is located. You can view the subnet gateway in the control panel: in the top menu, click Products → Cloud Servers → Servers → server page → Ports tab → click the subnet name → Subnets tab → subnet card → Subnet gateway field.

UGOS 7.1 and higher

1. Open the CLI.

2. Select UGOS NGFW (serial console) mode.

3. Connect to the firewall:

   • login — Admin;
   • password — usergate.

4. Enter configuration mode:

   configure

5. Assign an IP address to the port:

   set network interface adapter port0 ip-addresses [ <ip_address>/<mask> ]

   Specify <ip_address>/<mask> — IP address of the server Internet port with the subnet mask. You can copy the IP address in the control panel: in the top menu, click Products → Cloud Servers → server page → Ports tab → in the port card, click next to the IP address. Square brackets [ ] must be separated by spaces on both sides.

6. Create a gateway:

   create network gateway interface port0 enabled on ip <gateway> weight 1 default on

   Specify <gateway> — gateway of the server subnet where the Internet port is located. You can view the subnet gateway in the control panel: in the top menu, click Products → Cloud Servers → Servers → server page → Ports tab → click the subnet name → Subnets tab → subnet card → Subnet gateway field.

7. Initialize the firewall

1. Open the following page in your browser:

   https://<ip_address>:8001

   Specify <ip_address> — IP address of the firewall. You can copy the IP address in the control panel: in the top menu, click Products → Cloud Servers → Servers section → server page → Ports tab → in the port card, click next to the public IP address.

2. Select the system language.

3. Select the time zone.

4. Accept the license agreement.

5. Optional: change the administrator login.

6. Change your password.

7. Click Start.

8. Wait for the installation procedure to complete.

8. Specify DNS and NTP servers

1. Open the following page in your browser:

   https://<ip_address>:8001

   Specify <ip_address> — IP address of the firewall. You can copy the IP address in the control panel: in the top menu, click Products → Cloud Servers → Servers section → server page → Ports tab → in the port card, click next to the IP address.

2. Enter login and password.

3. Go to Settings → Network → DNS.

4. Click Add.

5. Enter the IP addresses of DNS servers. We recommend using Selectel recursive DNS servers, but you can specify any available DNS servers.

6. Click Save.

7. Optional: go to Settings and in the Server Time Settings block, change the value in the Primary NTP Server field. We recommend using Selectel NTP servers, but you can specify any available NTP servers.

9. Activate the license

UGOS 6

1. Open the following page in your browser:

   https://<ip_address>:8001

   Specify <ip_address> — IP address of the firewall. You can copy the IP address in the control panel: in the top menu, click Products → Cloud Servers → Servers section → server page → Ports tab → in the port card, click next to the public IP address.

2. Enter login and password.

3. At the top, click the Unregistered version button.

4. Enter the PIN received in the ticket when ordering the firewall.

5. Click Next.

6. Fill out the registration form. We recommend using the same data as in your Selectel account.

7. Click Next.

8. Wait for the firewall registration to complete. Information about the license contents and component expiration dates will be displayed in the Dashboard section in the License block.

UGOS 7 and higher

1. Open the following page in your browser:

   https://<ip_address>:8001

   Specify <ip_address> — IP address of the firewall. You can copy the IP address in the control panel: in the top menu, click Products → Cloud Servers → Servers section → server page → Ports tab → in the port card, click next to the IP address or public IP address.

2. Enter login and password.

3. Go to License Information → Registered version.

4. Enter the PIN received in the ticket when ordering the firewall.

5. Click Next.

6. Wait for the firewall registration to complete. Information about the license contents and component expiration dates will be displayed in the License Information section.