ARROW Device

The ARROW device is a rugged, portable mini PC built for security testing and remote network operations in the field. You drop it on a target network, it dials home over an always-on VPN, and you work it remotely as if you were sitting in front of it.

Front view with ARROW branding and cooling vent

Back view with chevron pattern design

Overview

The ARROW is the flagship hardware device in the ARROW platform. It is a custom Linux computer that ships with everything a remote engagement needs already in place:

A full Kali Linux environment with your penetration testing tools pre-installed
An always-on VPN that fails over to cellular, so the device stays reachable even without wired internet
A rugged aluminum enclosure that holds up in the kinds of places you actually deploy
Hardware-encrypted storage and Secure Boot, so a lost or seized device does not leak your data

Technical Specifications

The ARROW device is built on the LattePanda 3 Delta platform with custom modifications by VTEM Labs.

Processing & Memory

Component	Specification
Processor	Intel Celeron N5105 Quad-Core (2.0GHz base, 2.9GHz burst)
Architecture	11th Gen Intel (Jasper Lake)
RAM	8GB LPDDR4 2933MHz
Base Storage	64GB eMMC 5.1
Added Storage	1TB NVMe SSD (LUKS encrypted)
Graphics	Intel UHD Graphics (up to 800MHz)
TPM	TPM 2.0 (built-in)

Connectivity

Interface	Details
Ethernet	1x Gigabit Ethernet (RJ45)
USB	2x USB 3.2 Gen1 Type-A, 1x USB 3.2 Gen2 Type-A, 1x USB-C (PD/DP/USB 2.0)
Cellular	Sierra Wireless EM7455 / EM7565 LTE-Advanced or Quectel EM060K-GL (built-in antenna)
LTE Bands	B1, B2, B3, B4, B5, B7, B8, B12, B13, B14, B17, B18, B19, B20, B25, B26, B28, B29, B30, B32, B38, B39, B40, B41, B42, B43, B46, B48, B66, B71 (varies by modem)
3G Fallback	UMTS/HSPA+ B1, B2, B3, B4, B5, B8
Wi-Fi	Intel AX201 Wi-Fi 6 (802.11ax, 2.4GHz/5GHz 160MHz)
Bluetooth	Bluetooth 5.2
GNSS	GPS, GLONASS, BeiDou, Galileo (via LTE modem)

Video Output

Interface	Details
HDMI	HDMI 2.0b (up to 4096×2160 @ 60Hz HDR)
DisplayPort	DP 1.4 via USB-C (up to 4096×2160 @ 60Hz HDR)
eDP	Internal connector (up to 1920×1080)
Multi-Display	Supports triple display output

Physical Specifications

Attribute	Value
Dimensions	5.1” × 4.5” × 1.6” (130 × 115 × 40 mm)
Weight	0.9 lbs (420g) without enclosure
Enclosure	Custom ARROW aluminum case with heatsink
Cooling	Active (redesigned cooling fan)
Operating Temp	32°F to 113°F (0°C to 45°C)
Power Input	12V DC via barrel jack or USB-C PD
TDP	10W typical

Expansion & I/O

Interface	Details
M.2 M Key	PCIe 3.0 x2 (NVMe SSD - 1TB installed)
M.2 B Key	PCIe 3.0 x1 + USB (LTE modem installed)
Arduino	Integrated ATmega32U4 coprocessor
GPIO	12 analog inputs, up to 23 digital I/O (7 PWM)
Serial	RS232 header (COM port)
Audio	2-channel output with 2W amplifier

Software

Feature	Details
Operating System	Kali Linux (custom ARROW image)
VPN	NetBird client (always-on)
Management	ARROW Control agent
Encryption	LUKS2 full-disk encryption (1TB NVMe)
Secure Boot	UEFI Secure Boot enabled

What’s in the Box

Every ARROW device ships with:

1x ARROW device unit (with built-in LTE antenna)
1x 36W power adapter with regional plug
1x Ethernet cable (1m Cat6)
1x Quick start guide
1x Carrying case (foam-padded)

If you asked for them when you requested the device, you may also receive:

ALFA AWUS036AXM WiFi 6E adapter for wireless security testing
ALFA AWUS036ACH wireless adapter
VESA mounting bracket

Initial Setup

There is very little to do here. VTEM Labs provisions the device for your engagement before it ships, so first boot is mostly a matter of giving it power and a way to reach the internet.

1. Physical Connections

Connect the power adapter to the DC input jack, or use USB-C PD.
Optionally connect an Ethernet cable if you want wired internet during setup.
Press the power button. The LED turns blue while the device boots.

The LTE antenna is built in, so if you skip the Ethernet cable the device connects over cellular on its own.

2. First Boot

Because the device is pre-configured, first boot runs itself. Without any input from you, it will:

Boot with LUKS encryption already enabled, using your organization’s recovery key
Bring up the NetBird VPN and join your organization’s network
Register itself, so it shows up in your ARROW portal within a few minutes

There is nothing to configure. Power it on and it is ready. If it does not appear in the portal after a few minutes, see Device Not Appearing in Portal below.

3. Verifying Connectivity

The fastest way to confirm the device is online is from the ARROW Portal: open Devices, find your device, and look for an Online status with a green indicator.

If you want to check from the device itself, click Open Control on the device in the portal to launch ARROW Control, which confirms connectivity and gives you a terminal for diagnostics.

Connecting to Your ARROW Device

Most of the time you will work through ARROW Control in the browser. SSH and a direct console are there for when you need them.

Via ARROW Control (Recommended)

ARROW Control is a web interface for managing the device, with a terminal, file manager, and system monitoring built in:

Log in to the ARROW Portal
Open Devices and select your ARROW device
Click Open Control

Via SSH over VPN

When you want a raw shell, SSH in over the VPN:

# Connect using the device's VPN IP
ssh arrowuser@<device-vpn-ip>

# Or use the device hostname
ssh arrowuser@arrow-<device-id>.netbird.cloud

SSH only works while your own NetBird VPN is connected, since that is the network path to the device.

Via Direct Console

If you are physically next to the device, connect a monitor over HDMI and a USB keyboard, then log in with your configured credentials.

Network Configuration

Cellular Failover

The device keeps itself online without you watching it. It falls over to cellular when primary Ethernet drops, when Wi-Fi signal falls below threshold, or when you trigger a failover by hand. The switch typically completes in under 10 seconds.

Static IP Configuration

By default the device uses DHCP. To pin a static IP instead, open ARROW Control, go to Network Settings, select the interface (eth0, eth1), choose Manual configuration, and enter the IP address, subnet, gateway, and DNS.

Firewall Rules

The device runs ufw and ships locked down: inbound traffic is denied by default, and only the ports you actually need are open.

Rule	Description
Allow SSH (22)	Inbound SSH access
Allow ARROW Control (8080)	Web management interface
Allow VPN	NetBird WireGuard tunnel
Deny all other inbound	Default deny policy

Troubleshooting

Physical Device Issues

Device won’t power on. Confirm the adapter is connected and the outlet has power, then try a different outlet or power source and check the cable and connector for damage. If you are powering over USB-C PD, make sure the charger supports 20V output; not all do.

Device is frozen or unresponsive. Try a soft restart first by holding the power button for 4 seconds and releasing. If that does nothing, force it off by holding the button for 10 or more seconds, wait 10 seconds, then power it back on. If it is still unresponsive, pull power for 30 seconds and reconnect.

LED Indicators. The front LED tells you the device’s state at a glance:

LED State	Meaning
Off	No power - check power connection
Solid blue	Normal operation
Blinking blue	Booting / activity
Solid amber	Standby / sleep mode
Blinking amber	Error - contact support

Overheating. Give the device room to breathe and do not cover the vents. Confirm the fan is spinning, which you should hear during heavy use, and move it away from heat sources or direct sunlight. If it keeps overheating, power it off and contact support.

Device Not Appearing in Portal

If the device does not show up in the portal, work from power outward: confirm the LED is solid blue, check that the cellular antenna is seated and has signal, verify the SIM is activated and has a data plan, and check the VPN with netbird status.

No Internet Connectivity

Check the Ethernet cable and cellular signal first. If the link is up but nothing resolves, test DNS with nslookup google.com, and if that fails, restart networking with sudo systemctl restart NetworkManager.

Encryption Recovery

The device ships with LUKS encryption already set up, and VTEM Labs holds recovery keys for every device. If you are locked out, contact support at [email protected]; recovery can usually be done remotely through ARROW Control.

Maintenance

Software Updates

Updates are managed through ARROW Manager. Open Devices, select your device, click Software Updates, review the changelogs for what is available, and click Install to apply.

Factory Reset

To wipe the device back to factory defaults, open ARROW Control, go to System, then Factory Reset, and confirm. The device reboots and has to be re-provisioned afterward.

A factory reset erases everything on the device, including its encryption keys, so back up anything you need before you run it.

ALFA AWUS036AXM WiFi Adapter

The ALFA AWUS036AXM is an optional WiFi 6/6E USB adapter you can request with your device. It exists for the wireless side of an engagement, where the built-in Wi-Fi is not enough: it gives you tri-band coverage and external, replaceable antennas.

When to Request This Adapter

Ask for the AWUS036AXM when your engagement involves wireless work such as:

WiFi 6/6E penetration testing, with full 802.11ax support including the 6 GHz band
Extended-range testing, using the high-gain replaceable antennas for more coverage
Monitor mode and packet injection, with a Linux-friendly chipset your tools already support
Bluetooth 5.2 assessments, using the adapter’s integrated Bluetooth

Specifications

Component	Details
Chipset	MediaTek MT7921AUN
Standards	IEEE 802.11 a/b/g/n/ac/ax
Frequency Bands	2.4 GHz / 5 GHz / 6 GHz (tri-band)
Max Data Rate	3000 Mbps (600 + 1200 + 1200 Mbps)
Bluetooth	v5.2 with integrated antenna
USB Interface	USB 3.2 Gen 1 Type-A
WiFi Antenna	2x RP-SMA connectors with dual-band dipole antennas
Power	2.7W max
Dimensions	87.4 × 28.5 × 12 mm
OS Support	Windows 10/11, Linux

Product Link: ALFA AWUS036AXM

Setup

Setup is plug and play. Connect the adapter to any USB 3.0 port, attach both high-gain antennas to the RP-SMA connectors, and Linux detects it with no driver installation. Confirm it came up with ip link show or iwconfig.

Common Use Cases

Wireless Network Discovery:

# Put adapter in monitor mode
sudo airmon-ng start wlan1

# Scan for networks across all bands
sudo airodump-ng wlan1mon

WiFi 6E Testing:

# Scan 6 GHz band specifically
sudo iw dev wlan1 scan freq 5955-7115

Device Requests - How to request an ARROW device
Device Management - Managing devices in the portal
VPN Management - VPN configuration and access
ARROW Control Overview - Web-based device management
Troubleshooting - General troubleshooting guide