Documentation

Install the VIGIL-MESH client on Windows

This guide explains how to install the VIGIL-MESH mesh VPN client on Windows, from the signed download to the first connection to the network. In a few minutes, your workstation or a site machine joins the encrypted mesh: it receives a stable address, resolves the other devices by name and opens no inbound port. You download a verified build, install it, enroll with a pre-authorized key or an invitation, then verify connectivity.

Prerequisites

Before installing the VIGIL-MESH client on Windows, gather what you need. The installation creates a TUN network interface and a small service that manages the session: it therefore requires administrator rights, for the duration of the installation only.

Windows 10 or Windows 11 (64-bit), up to date.
Administrator rights on the workstation, only to install the TUN interface and the service.
An invitation to join a workspace, a pre-authorized key, or the agreement of an administrator who will validate your request in the approval queue.
Ordinary outbound Internet access: no inbound firewall rule or port forwarding to prepare.

Download the client

The client is downloaded from the site's download page. The general guide is on /download; per-platform builds are listed on /download/client, from a signed manifest that publishes the version number and the SHA-256 fingerprint of each file.

1
Open the builds pageGo to /download for the guide, then to /download/client to pick the Windows build matching your workstation.
2
Get the installer and its fingerprintDownload the Windows installer along with the SHA-256 fingerprint published next to it, in the signed manifest.
3
Verify integrity before runningIn PowerShell, compute the fingerprint of the downloaded file with Get-FileHash, then compare it, character by character, to the one in the manifest. If the two SHA-256 values are not identical, do not run the installer and download it again.

Install

1
Run the installerRun the verified installer. Windows asks for privilege elevation: it is needed to create the TUN interface and register the service.
2
Let it create the network interfaceThe installer adds a TUN interface dedicated to the mesh and installs the service that keeps the session open. No manual network configuration is required.
3
Finish and launch the clientAt the end of the installation, the client starts. An icon in the notification area gives access to the connection status and to enrollment.

Connect and enroll

Installing the client is not enough to join a network: your machine must first be enrolled, that is, recognized by the workspace. VIGIL-MESH offers three enrollment paths, depending on how your organization invited you.

Pre-authorized key

An administrator hands you a pre-authorized key. You paste it into the client: the machine is enrolled with no further intervention. It is the fastest path, ideal for batch deployment.

Invitation

You receive an invitation to join a workspace. Opening it from the client, you authenticate and then join the network.

Approval queue

You ask to join the workspace from the client; an administrator then validates your request in the approval queue. The connection is established once the request is accepted.

Once enrolled, the client opens its session to the mesh. The connection always goes from your workstation to the infrastructure: you have nothing to open or forward on your router or firewall.

Verify connectivity

Once the workstation is connected, check that everything works. A few simple checks confirm the machine is a proper member of the mesh.

Stable address: the TUN interface received an IPv4 address in the 100.64.0.0/10 space (for example 100.64.x.x) and an IPv6 ULA address. This address does not change from one session to the next.
Name resolution: thanks to MagicDNS, the other devices of the network are reached by name, resolved locally without any query leaving the machine.
Reachability: a simple test (for example a ping to the mesh address of another node, then access to a shared service) confirms the path is open.

For a detailed verification procedure and diagnosis of edge cases, follow the page dedicated to verification after enrollment.