What you are looking at
One box for the server and one for every node. A line between two boxes is a real connection: blue is the link a node already holds to the server, and green is a tunnel riding over that link. A line turns red when it cannot work right now — usually because a machine it passes through is offline.
Ports
Every circle is a port. Hollow means nothing is plugged into it; filled means it is carrying something. Each one is labelled in or out, except the uplink jacks, which are the node's link to the server. A node keeps its ports on the side facing the server, and they swap sides if you drag it past it.
Rolled up, a box shows a single dark port instead — everything it carries meets there. The server keeps one at each end, since it has nodes on both sides of it.
Finding something to tunnel
Press NET on a node to slide out the network that node can see. Click a host to reveal its open ports. If nothing has been scanned yet, use the Discover tab on the right to scan that node's network first.
Building a tunnel
Drag a discovered port onto the server. That parks it as an input: the traffic can now reach the collective over the node's existing link, so no port is opened and none is asked for. The input shows an out port marked not connected underneath it.
Drag that out port onto whichever machine you want the port to appear on, and choose the port number there. That machine can be the server itself or any node. The machine now shows an in port for it, named by the port it opened.
Changing and removing
Drag a port that already has a cable on it onto a different machine to move that tunnel there. Drop it on empty space instead and it is removed — you are asked first. Clicking a cable removes it too. Removing an input removes everything it feeds; removing one delivery leaves the input parked, ready to be sent somewhere else.
Bending a line out of the way
Drag any cable and it drops a pin where you took hold of it. Move the pin and the line runs straight through it — a pinned cable is routed by hand, so it is drawn as straight runs rather than a curve, while its two ends still curve away from their ports. A pin dropped near a port lines itself up with it, so the run into that port comes in level; otherwise it takes the grid. Drag the same cable again for a second pin, and so on. Double-click a pin to take it out. Pins snap to the grid when grid is on, and are kept and restored with the rest of the layout.
Getting around
Drag the background to pan, scroll to zoom, drag a title bar to move a box, and click a title bar to roll it up or open it again. Shift-drag on the background draws a box round several nodes and any pins among them; everything caught lights up, and dragging any one of them moves the whole group.
The buttons, top right
−, the percentage, and + zoom out, reset to 100%, and zoom in. ⤢ frames everything on screen. save keeps this layout — where each box sits, which are rolled up, and the zoom — and restore puts it back; the map restores it by itself whenever you open this view. reset lays everything out fresh without touching what you saved. grid makes boxes snap to a grid as you move them.
| Node | ID | Status | Communication | Interval | Version | Desktop | GUI | Local IP | Uptime | Last seen |
|---|
| Heartbeat interval (seconds) | |
| Random 2–30s | |
| Reconnect interval (s) 0 = stay continuously connected | |
| Auto-update | |
| Temperature interval (s) how often CPU/GPU temperature is read · 0 = off | |
| GUI / system tray run the desktop tray on this node · off when the server is unreachable |
Coming soon. A gateway turns a node into a doorway onto its network: point your browser or apps at the gateway and reach hosts behind it as if you were on-site, without setting up a tunnel per service.
When this feature ships, you will pick a node, choose what it may reach (whole subnet, or selected hosts), and get a single address to connect through — with access controlled per user.
Names under this server's domain, each with its own Let's Encrypt certificate, renewed for as long as the name is here. Every name resolves already — a wildcard record points the whole domain at this server — so a certificate normally arrives within seconds of adding one.
| Hostname | Certificate | Issued | Created |
|---|
Add one to give a service its own name and certificate — vpn, say, for the VPN to answer on.
A VPN of your own, on this server. The primary is Xray speaking VLESS with REALITY: it answers on one of your hostnames, on the ordinary HTTPS port, and anything that probes it is shown the real site with its real certificate. Profiles are made here — one per phone, laptop or node.
Server
Profiles
| Profile | Network | Clients here | Clients |
|---|
Clients
| Name | Profile | Address | On | Added |
|---|
Fallback — AmneziaWG
Coming soon. A mount makes a folder on one machine appear as an ordinary drive or folder on another, over sshfs — so you can open a node’s files in your own editor and file browser instead of uploading and downloading them. For one-off transfers, use Files.
New mount
How the SSH connection is carried is still being decided: either the machine’s own SSH service, or an SSH service built into the node and reached over a tunnel — which would work without touching the machine’s configuration or opening a port.
Mounts
| Name | Direction | Node | Remote folder | Mount point | Access | State |
|---|
When this ships, a mount set up here will reconnect on its own after a reboot or a dropped link, and can be unmounted with one click.
Uptime checks run from a node against something on its network. Add one from the Map — pick a node, open its Ping tab. The reserved Excluded group keeps a host in the config but stops testing it.
| Name | Host | Method | Via node | Every | Status | Latency | Last online | Missed since | Group |
|---|
| Timestamp | Node | Action | Result |
|---|
| Username | Last login | From | Country | Signed in | Two-factor |
|---|
Change your password
Two-factor sign-in
1. Open the authenticator app and scan this code.
Can't scan? Enter the key by hand:
2. Type the six-digit code the app now shows, to prove it worked.
Require it for everyone
Add user
Run this on any Linux machine to enroll it as a node (detects arch, installs a root systemd service):
…
Windows, from PowerShell — run it as Administrator to install for the whole machine and start at boot; run it as yourself to install for your account and start at logon:
…
Windows, from cmd.exe — cmd cannot run a script straight off a pipe, so this fetches one with the curl Windows ships with, runs it and deletes it. This one is cmd syntax: in PowerShell && is not a separator and curl means Invoke-WebRequest, so it will not run there.
…
If the machine cannot reach this server at all — the installers handle a wrong DNS answer themselves, but only once they are running, and fetching one is itself a name lookup. This form carries the address () instead of asking the local resolver. TLS is unaffected: only the route is pinned, the certificate is still checked against the real name.
…
Debug install — writes a log file (for when an install succeeds but the node then won't run)
Same install, with the node's log turned on. Linux → /var/log/interlink-node.log; Windows → node.log in the install dir. Read it with journalctl -u interlink-node (Linux) or Get-Content …\node.log -Tail 40 (Windows).
…
…
Available binaries
| Platform | Arch | File | Version | glibc | Min distro | Size | Built | Checksum |
|---|
Download pinned certificate (unicomplex-cert.der)