website/src/app/kb/client-apps/windows-gui-client/readme.mdx
import SupportOptions from "@/components/SupportOptions"; import Alert from "@/components/DocsAlert"; import { TabsItem, TabsGroup } from "@/components/Tabs";
The Windows GUI Client is designed for Windows computers where a user is present to authenticate with your identity provider interactively.
<Alert color="info"> If you're looking for a headless client suitable for server or workstation use cases where a user is not physically present, see the [Windows Headless Client](/kb/client-apps/windows-headless-client) user guide instead, which uses a long-lived Service Account token for authentication. </Alert>Download the .msi installer from our changelog page or from the
direct link below:
After downloading, run the .msi to install the Firezone GUI Client.
From a terminal, run the following command to install the GUI client.
winget install Firezone.Client.GUI
Sign in. This will open the Firezone sign-in
page in your default web browser.Always allow and open the link.Firezone connected notification, Firezone is running.The Welcome screen only appears during your first sign-in. After that, you can click on the Firezone icon in the system tray to open the tray menu and sign in.
When Firezone is signed in, web browsers and other programs will automatically use it to securely connect to Resources.
To copy-paste the address of a Resource:
Disconnect and Quit or Quit.When Firezone is not running, you can't access private Resources, and the computer will use its normal DNS and Internet behavior.
If you were signed in, then you will still be signed in the next time you start Firezone.
Sign out.When you're signed out, you can't access private Resources, and the computer will use its normal DNS and Internet behavior.
The Windows Client will automatically check for updates on launch and prompt you to upgrade when a new version is available.
To upgrade:
.msi installer package from
"Installation" above..msiFirezone writes log files to disk. These logs stay on your computer and are not
transmitted anywhere. If you find a bug, you can send us a .zip archive of
your logs to help us fix the bug.
To export or clear your logs:
Settings.Diagnostic Logs.Export Logs or Clear Log Directory.%APPDATA%/Microsoft/Windows/Start Menu/Programs/Startup/Add or remove programs and open it.Add or remove programs dialog, search for Firezone.Uninstall.If the Firezone client shows that you are signed in, but you can't access Resources, it's possible that the WinTUN driver is corrupted or in a failed state.
To fix, perform these steps:
Settings -> Network and Internet -> Additional network settings -> Network Reset -> Reset now.In the Start Menu, search for "Windows Powershell". Open it and run this command:
Get-Service -Name FirezoneClientTunnelService
Good output
Status Name DisplayName
------ ---- -----------
Running FirezoneClientI... Firezone Tunnel Service
Bad output
Status Name DisplayName
------ ---- -----------
Stopped FirezoneClientI... Firezone Tunnel Service
If the service isn't running or behaving not as expected, you can restart it with the following command:
Restart-Service -Name FirezoneClientTunnelService
Relaunch Firezone from the Start Menu afterwards.
In the Start Menu, search for "Windows Powershell". Open it and run this command:
Get-DnsClientNrptPolicy
Firezone Split DNS example:
Namespace : .
QueryPolicy :
SecureNameQueryFallback :
DirectAccessIPsecCARestriction :
DirectAccessProxyName :
DirectAccessDnsServers :
DirectAccessEnabled :
DirectAccessProxyType : NoProxy
DirectAccessQueryIPsecEncryption :
DirectAccessQueryIPsecRequired : False
NameServers : {100.100.111.1, fd00:2021:1111:8000:100:100:111:0}
DnsSecIPsecCARestriction :
DnsSecQueryIPsecEncryption :
DnsSecQueryIPsecRequired : False
DnsSecValidationRequired : False
NameEncoding : Utf8WithoutMapping
If Firezone's Split DNS is not active, the output will be empty.
If Firezone crashes and does not revert control of the system's DNS, you can revert it manually with this command:
Get-DnsClientNrptRule | where Comment -eq firezone-fd0020211111 | foreach { Remove-DnsClientNrptRule -Name $_.Name -Force }
YesThe Firezone Client is split into 2 main processes: A Tunnel service which runs the tunnel, and a GUI which allows the user to control Firezone.
%PROGRAMDATA%\dev.firezone.client\data\logs\, where %PROGRAMDATA% is
almost always C:\ProgramData%LOCALAPPDATA%\dev.firezone.client\data\logs, where
%LOCALAPPDATA% is, e.g. C:\Users\username\AppData\Local