First Boot Setup

First Boot Setup

A genuinely unconfigured board opens its own open Wi-Fi, ESP32-Tailnet-Setup-XXXX (XXXX: last characters of its MAC address). There is no shared default password: you pair physically with the board.

Steps

1. Join ESP32-Tailnet-Setup-XXXX near the board. The setup page opens by itself on most phones and computers; otherwise open http://192.168.4.1/. Use one browser window.
2. Pair: when the page says Waiting for the BOOT button or the setup code, press the board's BOOT button once — or connect USB, open a serial console at 115200 baud and type the 8-digit setup code printed there. The pairing window is 10 minutes; the code changes at every restart.
3. Password: choose the admin password (at least 8 characters).
4. Wi-Fi: pick your 2.4 GHz network and press Test connection. The phone may drop from the setup Wi-Fi for a moment while the radio moves to the home channel.
5. Tailnet (optional): paste an auth key (Tailscale, or Headscale with its URL), or join later from the dashboard.
6. Roles and features: share the home network as a subnet route, share the gateway's own Wi-Fi, offer an exit node, the protected gateway Wi-Fi name and password, Simple or Advanced interface.
7. Finish: the summary shows where the gateway will be after the restart. Rejoin your home Wi-Fi and open one of the links on the last page:
   • the address received during the Wi-Fi test (routers normally keep it);
   • http://esp32-tailnet-xxxx.local/ — only this gateway answers to that name, so several gateways on one network never collide. It works on iPhone, iPad, Mac, Windows 10 and later, most Linux and recent Android.

Good to know

• Setup requests are sealed (X25519 + AES-256-GCM) and the setup Wi-Fi does not forward LAN or Internet traffic. A malicious lookalike access point is still a risk: set up your own board in a trusted place.
• Nothing typed in the wizard is stored before Finish. A restart or power loss simply reopens the setup with a new code.
• Five wrong codes lock the code until a restart.
• If the home Wi-Fi later disappears, the gateway opens its protected recovery Wi-Fi (name and password chosen in step 6) after 60 seconds — never the open setup network.
• An existing, configured gateway keeps its settings and never reopens setup.

Full guide: FIRST-BOOT-SETUP.md.