The box's software, on hardware the site already has
The software agent is the Relayant box's own software, installed on a Linux PC, a Raspberry Pi or a router you own. It enrols, connects out, finds and monitors devices, and reaches them the same way as a box. It does not own or change the network it runs on.
Two forms
Two forms, compared
A service on a Linux machine, or a package on the site's router. Neither needs hardware from us.
| Linux service | Router package | |
|---|---|---|
| Runs on | Debian, Ubuntu or Raspberry Pi OS, on x86-64, arm64 or 32-bit ARM, so every Raspberry Pi. | A router you own running OpenWrt up to 24.10 or Teltonika RutOS. Four package architectures cover the Teltonika range and most routers. |
| Installed with | One command from the portal, run with sudo. It needs systemd. | A few commands over SSH as root. The wrong architecture cannot be installed. |
| What it needs | A wired connection to the site's network, and the setup code the portal issues. | Room on the router (on a Teltonika, about 9 MB of free flash and 128 MB of RAM) and the setup code the portal issues. |
| How it is updated | Over the air, with releases we sign, like a box. | By installing the next package. It does not update itself. |
| What it changes on the host | Installs WireGuard tools and a service, and adds its own tunnel interface. A host firewall may need one rule. | Adds its own tunnel interface and one firewall zone of its own. Nothing else on the router changes. |
| Where the log is | journalctl -u relayant-agent -f |
logread -e relayant-agent |
Installing
Three steps to a running agent
-
A wired host on the site's network
The agent is one more host on the network, so it must be on the same network as the devices. Use a cable: Wi-Fi client isolation hides other devices.
-
The setup code from the portal
Open the site, choose Add a box, then Install the software agent and Show the install commands. The portal issues a setup code for the site and prints every command with it filled in.
-
Run the commands
The agent enrols on its first attempt and appears under the site like a box, labelled as a software agent. Its code connects once, like a box's: a second machine with the same code is refused.
The commands
The commands, as the portal prints them
The server address is the portal's own, https://app.relayant.net. The setup code is the placeholder ABCD-EFGH-JKMN-PQRS; the portal prints yours filled in.
# The setup code comes from the portal.
$ curl -fsSL 'https://app.relayant.net/api/downloads/install-relayant-agent.sh' \
| sudo sh -s -- --server 'https://app.relayant.net' --setup-code 'ABCD-EFGH-JKMN-PQRS'The installer needs systemd. It installs WireGuard tools with apt, checks the download against the checksum the server states, and installs a service named relayant-agent. Run the same command again to upgrade or reinstall; the agent keeps its identity. If the host's firewall drops traffic on new interfaces, allow the relay's connections once; the guide has the rule.
# The setup code comes from the portal.
# opkg update && opkg install kmod-wireguard wireguard-tools ip-full
# ARCH=$(opkg print-architecture | awk '{print $2}' | grep -xE 'mips_24kc|mipsel_24kc|arm_cortex-a7_neon-vfpv4|aarch64_cortex-a53' | tail -n 1)
# wget -O /tmp/relayant-agent.ipk "https://app.relayant.net/api/downloads/relayant-agent_$ARCH.ipk"
# opkg install /tmp/relayant-agent.ipk
# uci set relayant.agent.server='https://app.relayant.net'
# uci set relayant.agent.setup_code='ABCD-EFGH-JKMN-PQRS'
# uci commit relayant && /etc/init.d/relayant-agent restartThe second line picks the package for the router's own CPU from what opkg accepts. A MIPS package is not offered to an ARM router. To update, download the next package and install it the same way; the settings are kept. OpenWrt 25.12 and later replaced opkg with apk; the same package installs there by hand, as the guide shows.
Limits
What the agent does not do
The agent is software on someone else's machine, so it must not touch that machine's network. That has consequences.
- Own the network
- It does not change the host's addresses, DHCP, DNS or routes. It adds one tunnel interface of its own and nothing else.
- See devices that are switched off
- A host sees only what is in its own network cache. A device that is switched off is absent from the list until it returns.
- Cross VLANs
- Devices on another VLAN are found and reached only if that network is routed to the host. The same is true of a box.
- Work well on Wi-Fi
- Many access points isolate their wireless clients from each other, which hides the devices. Use a wired host.
- Open the host's firewall
- The relay connects to the agent over its tunnel interface. A Linux host firewall that drops traffic on new interfaces needs one rule, which you add once.
- Update itself on a router
- The router package is updated by installing the next package. It does not flash firmware or update itself.
On a router, what the package changes and what it leaves alone
The package is built for routers that belong to someone else, so what it may change is deliberately limited.
| What it adds | What it does not touch | |
|---|---|---|
| Interfaces | Its own WireGuard tunnel interface, while it runs. | The LAN, WAN, DHCP, DNS, Wi-Fi or any existing interface. |
| Firewall | One firewall zone of its own, with one rule admitting the relay's connections on its own interface. | Any existing firewall zone, rule or forwarding. |
| Removal | Removes its zone when the package is removed. | Firmware: it does not flash the router or update itself. |
On a Teltonika router the package needs about 9 MB of free flash and 128 MB of RAM. The RUTX series has it; the RUT241 and RUT950 class does not. It runs beside Teltonika RMS and beside any WireGuard VPN already on the router, because it uses its own interface. The Teltonika-specific steps have not yet been checked on a real Teltonika router.
Tell us what the site already has
A Linux machine, a Raspberry Pi or a router: say which, and what internet the site has. We reply by email and say whether the agent fits.