macOS CLI
The firezone CLI can be used to control the tunnel from a terminal.
It is automatically shipped as part of the macOS Client from version 1.5.21 and above.
Putting firezone on the PATH
The CLI lives inside the app bundle at /Applications/Firezone.app/Contents/Resources/bin/firezone.
When installed via the .pkg installer, the system-wide PATH is automatically modified to include the firezone CLI.
The App Store and .dmg installs cannot do this due to sandbox restrictions.
For installations via the App Store or the .dmg, you can add it yourself:
echo /Applications/Firezone.app/Contents/Resources/bin | sudo tee /etc/paths.d/firezone
firezone-cli is the previous name of the CLI. It is still installed as an
alias in the same directory and prints a deprecation warning. It will be
removed in a future release.
System extension
The tunnel runs in the same system extension the graphical Client uses.
On first install, the extension needs to be approved in System Settings.
Launch Firezone.app once to do that, or allowlist the extension via MDM. See Allowlisting the macOS System Extension.
Once approved, run firezone extension status to verify it has been installed correctly.
Controlling the tunnel
To bring up the tunnel, run firezone connect.
By default, this will use the token stored in the keychain.
Without a token in the keychain, one must be supplied on standard input or via the FIREZONE_TOKEN environment variable.
For a Mac that runs unattended, use a service account token and read it from a file only the Client's user can read:
firezone connect < /path/to/token
Never put a token on the command line itself, for example by prefixing
firezone with FIREZONE_TOKEN=. Your shell writes the whole command to its
history file, where the token stays readable long after the session ends.
Service account tokens are long-lived, so treat one as you would a password.
By default, firezone connect returns as soon as the tunnel is up.
Use the --foreground flag to keep it running instead.
SIGINT and SIGTERM will then automatically shut the tunnel down.
Need help? See all support options.