Documentation

Host a private vigie on a Freebox VM or ISP router

An ISP router is always on, sits at the edge of the home network and has a fixed connection, making it an appealing private-relay host. Very few provider-supplied gateways can actually run a customer VM, however. Freebox Ultra and the Freebox Delta family are the notable French exception. This guide separates confirmed capabilities from assumptions and gives every country a practical fallback.

Why host a vigie at home?

Sovereign relay path

When peers cannot build a direct path, encrypted packets cross a machine you control at home.

Already always on

A VM reuses the router’s power and connectivity instead of adding a computer for one permanent service.

Close to home services

Home automation, homelab and family devices get a nearby rendezvous point for relayed traffic.

LAN anchor

The same Linux guest can also run a site gateway that exposes only explicitly approved LAN hosts to the mesh.

ISP boxes grouped by subscription country

This table concerns customer VMs or containers running inside the ISP box itself. “Not documented” does not make the broadband line incompatible: place a small Linux host behind the box instead. Public operator documentation checked in July 2026.

Country	Provider box	Guest VM	Recommended host
Austria / Germany	Speedport and ISP-supplied FRITZ!Box models	Not documented	Mini-PC, NAS or Raspberry Pi
Belgium	Proximus Internet Box / Box+	Not documented	External Linux host
Canada	Bell Giga Hub, Rogers Ignite Gateway	Not documented	External Linux host
France	Freebox Ultra, Delta and Delta S	Yes, ARM64 Linux	Freebox OS VM or external host
Italy	iliadbox Wi-Fi 5/6/7	Not documented	Mini-PC, NAS or Raspberry Pi
Netherlands	KPN Box 12/14	Not documented	External Linux host
Spain	Movistar Smart WiFi 6 / 6 Go	Not documented	External Linux host
Switzerland	Swisscom Internet-Box, Sunrise Internet Box	Not documented	External Linux host
United Kingdom	BT Smart Hub 2, EE Smart Hub Plus	Not documented	External Linux host
United States	Xfinity xFi Gateway, AT&T Wi-Fi Gateway	Not documented	External Linux host

Deploy in a Freebox Ultra or Delta VM

Free officially introduced hardware-accelerated ARM64 guests on Delta and Delta S with Freebox OS 4.1.0. Freebox Ultra also exposes the VM function and provides an NVMe slot. Use a minimal ARM64 Linux guest and persistent internal storage.

1
Check model and storageConfirm that Machines virtuelles exists in Freebox OS. Fit a supported NVMe 2280 drive in an Ultra before creating an always-on guest.
2
Request full-stack IPv4A vigie needs inbound udp/443, udp/4433 and tcp/443. Request Free’s full-stack fixed IPv4 if a shared address does not allocate those ports to you.
3
Create a minimal ARM64 VMChoose Debian or Ubuntu ARM64 without a desktop, allocate the available resources and reserve its LAN address with DHCP.
4
Install the matching buildInstall an ARM64 vigie package when available for your VIGIL-MESH release. An amd64 package cannot run natively in this guest.
5
Forward exactly three listenersForward udp/443, udp/4433 and tcp/443 to the VM. Do not expose the whole guest through a DMZ.
6
Register and qualifyCreate a one-time fleet token, register the vigie and wait for the controller to probe all listeners from outside.
7
Test recoveryRestart the VM and the Freebox, then verify automatic startup, /healthz and the vigie status in the console.

For every other ISP box

Keep the provider box as the router and connect a low-power Linux host over Ethernet. The network outcome is the same: three public forwards reach the vigie while the optional site gateway reaches only approved LAN devices.

Host	Strength	Watch for
x86-64 mini-PC	Fast, SSD-backed, Proxmox/KVM capable	Hypervisor patching and power use
Synology/QNAP/TrueNAS	Often already on, VM/container support by model	Never expose NAS administration
Raspberry Pi / ARM64 SBC	Compact and efficient for a small mesh	Prefer an SSD over microSD
Public VPS	Simple public IP and availability	The physical relay path is no longer at home

The useful smart-home pair: private vigie plus LAN gateway

Home Assistant, Jeedom, a NAS or cameras stay private on the LAN. An enrolled phone reaches them through explicit gateway routes and ACLs; no public dashboard or inbound application port is required.

Sources

Frequently asked questions

Which Freebox models can host a virtual machine?

VMs are officially documented for Freebox Delta and Delta S and are available in Freebox OS on Freebox Ultra. Guest images use ARM64. Confirm the Machines virtuelles application and current firmware on your own Server.

Can Freebox Pop host the vigie directly?

No customer VM feature is documented for Freebox Pop. Connect a mini-PC, NAS or Raspberry Pi behind it and forward the three required ports to that host.

Does a private vigie let me browse with my home IP address?

Not by itself. A vigie relays mesh traffic and a LAN gateway reaches selected local hosts. VIGIL-MESH does not currently document a whole-Internet exit-node function.

Can Home Assistant and the vigie share one VM?

They can be isolated as separate services, but separating roles makes updates and recovery safer. On a constrained router, measure memory, relayed throughput and reboot behaviour.