Windows CLI
The firezone CLI can be used to control a running Windows GUI Client from the terminal.
It is automatically installed as part of the .msi installer from version 1.5.18 and above.
Sign in as usual using the GUI Client's tray menu.
Once you are signed in, you can access your resource list using firezone resources and toggle the Internet Resource using firezone internet-resource enable|disable.
Non-interactive sign-in
The firezone CLI allows non-interactive sign-in and control of the tunnel.
To bring up the tunnel, run firezone connect.
It uses the token stored when you signed in through the GUI Client's tray menu and returns once the tunnel is up.
firezone disconnect takes the tunnel down and keeps the token.
firezone sign-out takes the tunnel down and also removes the token.
A service account token can be used to bring up the tunnel without signing in through the browser.
The token is read from standard input when piped, otherwise from the FIREZONE_TOKEN environment variable ($env:FIREZONE_TOKEN in PowerShell).
It is never read from the command line.
The token file must be UTF-8; PowerShell 5.1's > and Out-File write UTF-16 by default.
In PowerShell:
Get-Content C:\path\to\token | firezone connect
In cmd.exe:
firezone connect < C:\path\to\token
The GUI Client stores the token, so later firezone connect reuses it.
Never put a token on the command line itself, for example by setting
FIREZONE_TOKEN in the same command. Your shell writes the whole command to its
history file, where the token stays readable long after the session ends.
Service account tokens are long-lived, so treat one as you would a password.
For a machine with no desktop session at all, such as a server, use the Windows Headless Client, which signs in with a token and runs on its own.
Need help? See all support options.