Install the Perpetual License step by step

1. Prepare the machine

A PC, mini PC or server running Debian 12 or Ubuntu 24.04 (amd64 or arm64) with the distribution’s own kernel, and root (sudo) access.
Two wired network ports. Gateway can make do with one when guests are on a VLAN through a managed switch; Transparent always needs two.
Disk space for at least 90 days of log, and somewhere off the machine to back it up.
A virtual machine is fine, but never clone an installed one: the Hardware ID changes and the license stops working. Containers are not supported.
Gateway: stop any other DHCP or DNS server on the machine (such as dnsmasq), since the machine hands out guests’ addresses itself.

2. Wiring

	First port (WAN)	Second port (LAN)	Who gives guests addresses
Gateway	The Internet line, or the office LAN	The guest Wi-Fi’s access points or switch	This machine (by default 10.77.0.0/22, the machine at 10.77.0.1)
Transparent	Your existing router or switch	The access points or switch	Your existing router

For Gateway, plug the first port into a working Internet connection before installing: the installer takes the port with the default route as WAN and the other wired port as LAN. See Set up equipment for how the two modes differ.

3. Install the software

In the Console › Wi-Fi Hotspot › Perpetual License, copy the command under Getting started and run it on the machine:

Shell

curl -fsSL https://console.thailandhosting.com/install/thwifi.sh | sudo bash -s -- --onprem

It installs thwifi as a system service and prints the machine’s Hardware ID (XXXX-XXXX-XXXX-XXXX). Note it down to buy the license; sudo thwifi hwid shows it again. Add any of these options to the command:

Option	Use it when
`--transparent`	Placing the machine as Transparent; it never hands out addresses over your router
`--wan eth0` `--lan eth1`	Choosing the ports yourself, when the installer picks wrong or there are more than two
`--vlan 20`	Gateway: the guest network is on this VLAN of the LAN port; repeat for more. Transparent: VLANs to watch besides the untagged network
`--address 192.168.50.1/24 --dhcp-from 192.168.50.20 --dhcp-to 192.168.50.250`	Gateway: your own guest address range instead of 10.77.0.0/22
`--license FILE.lic`	You already have this machine’s license file, e.g. reinstalling the same machine
`--binary FILE --manifest FILE`	The machine has no Internet (below)

All of the network settings can be changed later under Network on the admin pages, with no reinstall.

4. Buy the license

In the Console › Wi-Fi Hotspot › Perpetual License, click Buy a license.
Choose the devices at once (30 to 5,000), enter The machine’s Hardware ID and a name if you like, tick to accept the terms, and buy. The license is paid from the Project’s wallet.
On the license, click License file to download the .lic file, and copy it to the machine (with scp or a USB stick, for example).

5. Turn it on

Shell

sudo thwifi license FILE.lic
sudo thwifi admin-password
sudo systemctl restart thwifi

The first command checks and keeps the license, the second sets the admin password (choose the username with sudo thwifi admin-password NAME), and the third restarts it. sudo thwifi status shows how it is doing.

6. Open the admin pages the first time

From a computer on the WAN port’s network (the office network, for example), open https://<the machine’s WAN address>:8443. Wi-Fi guests can’t reach this page.
The browser warns about the certificate the first time, because the machine signs its own. Compare the fingerprint in the warning with certificateSha256 from sudo thwifi status, and go on only if they match.
Sign in with the admin name and password you set.
Under System, fill in Addresses allowed to the admin pages (your IT network, say), above all in Transparent mode where guests share the machine’s network.

7. Get it ready

Sign-in page: the place’s name, welcome text, colours, background, terms, contact details, and the sign-in page’s HTTPS certificate if you have one.
Wi-Fi codes: make and print codes for guests.
Users: add staff one by one or import a CSV, with groups, devices and speed.
Active Directory: let staff sign in with their company account. Enter the domain controllers (the machine must reach them on port 636 LDAPS or 389 StartTLS), the domain, the Base DN and the groups allowed, and click Test before turning it on.
802.1X: company Wi-Fi over WPA2/WPA3-Enterprise, staff joining with their own account or certificate. See Connect WPA2/WPA3-Enterprise (802.1X).
Devices online: add the MACs of printers, POS terminals and other devices that get on without signing in (they count towards the license).
Network: VLANs, several Internet lines, reservations and DNS. After saving, click Confirm within 5 minutes (from the new address if it changed) or the machine goes back by itself.
Usage log: how long the log is kept (90 days or more), search, export and a check that no file was altered. System holds the license, updates, the daily update check and the admin password.

8. Check it works

Join a phone to the access points’ Wi-Fi. The sign-in page should open by itself (or open any http:// website).
Sign in with a Wi-Fi code or a user you made, then browse.
On the admin pages, Devices online should list the phone and the Usage log should show its connections.

A machine with no Internet

On another computer, download the installer, the program for the machine’s type (amd64 or arm64) and the manifest of the same version from No Internet on the machine? on the Perpetual License page.
Copy the three files to the machine and run sudo bash thwifi.sh --onprem --binary thwifi-linux-amd64 --manifest thwifi-linux-amd64.manifest (with the names you downloaded).
Buy the license with the Hardware ID it shows, then load the license file as in step 5. Later update files (.thpkg) are uploaded under System the same way.

A machine with no Internet must already have nftables, conntrack and iproute2 (most Debian and Ubuntu server installs do). If one is missing, the installer names it.

If something goes wrong

It says “no default route” or “found no second network port”

The WAN port has no Internet yet, or the machine can’t find a second port. Fix the cables and run it again, or name the ports with --wan and --lan (ip link lists them).

It warns that another DNS or DHCP server is running

In Gateway mode the machine hands out addresses itself. Stop the other one, e.g. sudo systemctl disable --now dnsmasq, and restart thwifi.

Transparent mode says there is no nftables bridge filtering

The machine’s kernel lacks it. Use Debian 12 or Ubuntu 24.04 with the distribution’s standard kernel (WSL and custom kernels won’t do).

Guests see that the Wi-Fi isn’t available and should ask the staff

There is no license, or it is for another machine. Check System on the admin pages or sudo thwifi status, and load the license bought with this machine’s Hardware ID.

Can’t reach the admin pages after a network change

Run sudo thwifi network reset then sudo systemctl restart thwifi; the machine goes back to the install’s settings. If you set addresses allowed to the admin pages, open them from one of those.

Forgot the admin password

Run sudo thwifi admin-password on the machine to set a new one.

The sign-in page doesn’t open by itself

Check the access points are on the LAN port and don’t hand out addresses themselves (turn their DHCP off, or set them to access point/bridge mode), then open a website starting with http://.