VPN Management & Access

Overview

The VPN is how you reach your devices. ARROW keeps your appliances and virtual machines off the public internet, so nothing is exposed and there is nothing to port-forward. Instead, everything lives on a private NetBird network, and you get to it by joining that network with a NetBird client. Once you are connected, an ARROW device is just another host you can SSH to, open a VNC session against, or manage as if it were sitting next to you.

You manage the VPN from the VPN section of the Console, titled NetBird VPN, which lists the VPN configured for your organization.

ARROW Platform NetBird VPN page — The VPN page showing NetBird network status

There are two ways to join the network, and picking the right one matters:

Identity Provider (IDP) authentication is for your own workstation. You sign in through your organization’s identity provider, exactly as you sign in to the Console, and you land in the users group with full access to the devices assigned to you.
Setup keys are for headless machines: servers, VMs, and infrastructure that cannot sit at a browser and log in. A setup key drops the host into a restrictive group that can be reached but cannot reach anything else.

That last point is a real trap:

Do not use a setup key on your own workstation. It isolates the host under a locked-down policy, and you will lose the ability to reach any other system on the VPN. Workstations authenticate through your IDP; setup keys are for headless devices only.

Setting Up the NetBird Client

NetBird ships a desktop GUI and a headless CLI, both from the same installer. Use the GUI on a laptop or workstation and the CLI on a server. For anything platform-specific, the official NetBird installation docs are the source of truth.

Install

On Linux or macOS, one command gets you both the GUI and CLI:

curl -fsSL https://pkgs.netbird.io/install.sh | sh

On macOS you can also use Homebrew (brew install --cask netbirdio/tap/netbird-ui), and on Windows, download the installer from NetBird or from the VPN page in the ARROW Console.

Connect a workstation (SSO / IDP)

This is the path for your own machine. The one piece of information you need is your organization’s Management URL, which you will find on the VPN page in the Console.

ARROW Console VPN page showing the NetBird management URL

Find your VPN management URL on the VPN page in ARROW Console

Install NetBird if you have not already (see above).
Point the client at your Management URL. In the desktop GUI, right-click the NetBird tray icon, open Advanced Settings, and set the Management URL to https://{your-domain}:443/.

Management URL Configuration

Click Connect. Your browser opens, you sign in through your IDP, and the tunnel comes up.

On Linux, or any headless machine you still want on SSO, do the same from the command line:

netbird up --management-url https://{your-domain}:443/

This opens a browser for authentication. On a truly headless box, copy the URL it prints and open it in a browser elsewhere.

VPN User Connection CLI

Connect a headless device (setup key)

Use a setup key when a machine cannot log in through a browser: a password-recovery server, a piece of standing infrastructure, or an automated deployment. Remember that a key-joined host lands in a restrictive group by design, so keep keys off workstations.

First, get a key from the Console:

Go to VPN and click View Details for your VPN.
Click Request Setup Key.
Give it a descriptive Key Name (for example, “Password Recovery Server”), describe what it is for, and add any notes.
Click Create Setup Key and copy the key immediately. It is shown once and never again.

Then bring the device up with it:

netbird up --management-url https://{your-domain}:443/ \
    --setup-key YOUR-SETUP-KEY-HERE \
    --hostname {device-name}

Two flags are worth knowing: --disable-dns stops NetBird from touching /etc/resolv.conf, and --allow-server-ssh opens SSH access through the VPN.

Setup keys are single-use and expire after 7 days. If a key was already used or has gone stale, request a fresh one.

Verify the connection

The fastest check is the CLI:

netbird status

A healthy connection reports Connected, your organization’s Management URL, an assigned NetBird IP in the 100.x.x.x range, and a count of reachable peers. In the desktop GUI, the tray icon shows an active state and lists the same details when you click it.

You can also confirm from the Console: open VPN, click View Details, go to the Peers tab, and check that your device shows Online. To prove end-to-end reachability, ping another peer:

ping <arrow-device-vpn-ip>

When something is wrong

Most connection problems fall into a few buckets:

The client will not connect. Double-check the Management URL and confirm the machine has outbound internet. Corporate firewalls and proxies are the usual culprits, so try an alternate install method if the download itself fails.
Authentication fails. Make sure you are signing in to the correct IDP. Clearing the browser cache or using an incognito window clears up stale sessions.
A setup key is rejected. It has almost certainly expired (7 days) or already been used. Watch for typos, and request a new key if in doubt.
You are connected but cannot reach a device. This is a policy or group issue, not a client issue. Check that the device shows Online in the Console and that you are in a group with access to it.
netbird status shows Disconnected or no IP. Restart the NetBird service, re-check the Management URL, and run netbird status --detail for the full picture.

If you are still stuck, the NetBird documentation covers client internals, and ARROW support can help if you send along the output of netbird status --detail.

Viewing VPN Status in the Console

Everything about your network is visible under VPN in the Console. The landing page lists your VPN in a single searchable table with a Refresh button, showing its Name, its API URL (your management URL, like https://<id>.arrowvpn.io), its Status, and when it was Last Updated. Click View Details to go deeper.

The details view is organized into tabs:

Overview is the at-a-glance dashboard: how many peers are connected, how many users have access, how many network routes are active, and how many access policies are enabled, alongside the Management URL, configuration status, and creation dates.
Peers lists every device on the network, with its name, VPN IP, online/offline status, operating system, and when it was last seen. This is where you confirm a device actually made it onto the network.
Users shows who has VPN access, with their name, email, role, and status.
Routes lists the network routes in play, each with its network CIDR, description, and enabled/disabled state.
Groups shows the peer groups that organize devices (users, pve, pvm, vm) and how many peers are in each.
Policies shows the access-control rules that decide who can reach what. These are read-only here, since ARROW manages them for you.

Requesting Setup Keys

If you need to attach a custom device to the network, such as a password-recovery server or a piece of standing infrastructure, request a setup key from the Console. This is the right tool whenever a machine authenticates as itself rather than as a logged-in user.

Go to VPN and click View Details.
On the Overview tab, click Request Setup Key.
Give it a descriptive Key Name, describe its purpose, and add any notes.
Click Create Setup Key.

Copy the key the moment it appears; it is displayed only once. Keys are single-use and expire after 7 days. For using the key on the device, see Connect a headless device (setup key) above.

VM VPN Access

You almost never touch any of this for VMs, because ARROW handles it. When a VM is provisioned, it is registered as a peer, dropped into the right group (pvm on ARROW hardware, vm elsewhere), and covered by a policy that lets the consultants assigned to it connect in. Access is deliberately one-way: you can reach into a VM, but the VM cannot open connections back out to you.

To use a provisioned VM, make sure your own VPN client is connected, find the VM’s hostname or IP in its device details in the Console, and connect over SSH, VNC, or whatever protocol fits.

When a VM is marked complete, ARROW tears all of this down automatically: the peer registration, the access groups, and the policies are removed, so nothing lingers on your network.

How a Connection Comes Together

When you connect a workstation, NetBird hands you off to your identity provider to prove who you are, and once your IDP returns a valid token the tunnel establishes and you can reach any ARROW device your policies allow. For headless devices the setup key stands in for that browser login. In both cases the result is the same: an authenticated peer on a private network, reachable only within the access rules ARROW maintains for you.

Status Indicators

Status	Meaning
Online	Device is connected and reachable
Offline	Device is not currently connected
Active	Integration or policy is enabled
Inactive	Integration or policy is disabled
Enabled	Route or policy is in effect
Disabled	Route or policy is not currently applied

Troubleshooting

Client install and connection problems are covered in When something is wrong above. A few issues are specific to the Console side:

You cannot connect to the VPN at all. Confirm you are using the exact Management URL from the Console, that you are signed in to the right IDP, that outbound traffic to that URL is allowed through your firewall, and that your NetBird client is current.
A device shows Offline. Check that NetBird is actually running on it and that the device has internet, then hit Refresh in the Console.
You can connect but cannot reach a specific device. Verify the device is Online in the Peers tab, that you are in a group with access to it, that the access policies allow your connection, and that the device’s own VPN service is up.

Network Access Control - Understanding automatic access control
Authentication - User authentication and identity management
Device Management - Managing devices that connect to VPN
ARROW Manager Network Settings - On-device network status
NetBird Official Documentation - Detailed NetBird client documentation