How to Use Twingate: The Beginner's Guide (First Network, the Resource-Group Lesson, the Connector Arc, and First Connect)

CodexFuse Team · 2026-11-07T05:57:43.226Z · 24 min read min read

How Do I Use Twingate?

Learning how to use twingate takes seven moves: create a free account, name your first remote network, add a resource, assign that resource to a group, deploy a connector on a machine that can reach the resource, install the client on your device, and connect for the first time. Twingate is a zero-trust remote access service that lets you reach private servers and apps from anywhere without opening ports, without a traditional VPN, and without changing firewall rules. This twingate tutorial follows the official Twingate documentation, the pricing page, and the client and connector changelogs, with every fact checked as of November 2026.

CodexFuse offers no Twingate tool, so this guide teaches the real service on your own account and machines, not a web version of it. No Facebook promotion applies to this guide. Twingate is the zero-trust lane opener in our network-access cluster, and the mesh-VPN sibling is covered in our Tailscale beginner guide, which you should read if you want every device to see every other device instead of reaching named resources only.

1. Create a free Twingate Starter account and pick a network name, which becomes your network address.
2. Create your first remote network in the Admin Console and note its two pre-created connectors.
3. Add a resource, such as a home server or an internal web app, with its address and port.
4. Assign the resource to a group, because a resource with no group is invisible to everyone.
5. Deploy a connector on a host that can actually reach the resource, using Docker or systemd.
6. Install the Twingate client on your laptop or phone and join your network by name.
7. Open the resource exactly as if you were on the same local network, and check the green connected dot.

What Is Twingate, Exactly?

Twingate is a zero-trust network access service, which means it grants access to specific named resources instead of putting your device onto a whole private network. The service has four parts: a cloud-hosted Controller that holds the configuration and issues signed authorizations, Connectors that live behind your firewall on each remote network, Clients on your devices, and Relays that help Clients and Connectors find each other. No single component can allow traffic on its own, and authentication is delegated to an identity provider such as Google, GitHub, Microsoft, or Okta, so Twingate never stores your password.

The mental model to hold onto is simple: the connector dials out to Twingate, and nothing on your network listens for incoming connections. That is the whole trick, and it is why there is no port forwarding and no firewall rule to write. The client on your laptop sets up only a local VPN connection to 127.0.0.1 so it can intercept traffic headed for your private resources, which is local-only and not a listening port on your network.

Twingate supports any TCP or UDP protocol, so the same setup reaches a web dashboard, an SSH server, a database, or a file share.

Twingate was founded in 2019 and is headquartered in Redwood City, California, according to company profiles from Forge, PitchBook, CB Insights, and CRN, and it raised a 42 million dollar Series B round in April 2022 led by BOND Capital. The core product is closed source, so there is no public core repository with a star count to quote, although Twingate does publish open tooling such as a Kubernetes operator, a Terraform provider, and Helm charts on GitHub. For a home lab, the free Starter plan is the natural starting point, and the limits section later in this guide shows exactly what it covers.

Step 1: Create Your Free Account and First Remote Network

A twingate setup starts with a free Starter account, which you create by signing up with Google, GitHub, or another existing account and answering a short questionnaire. During signup you choose a network name, and that name becomes your network address in the form of your name followed by twingate.com, for example jlhome.twingate.com in the official Starter guide. Choose carefully, because a Twingate network name cannot be changed after the network has been created.

Once you are inside the Admin Console, open the Network tab and add a remote network if signup did not already create one for you. A twingate remote network is a logical segment that represents one place your resources live, such as your home, an AWS virtual private cloud, or an office. Give it a plain name such as Home Lab or AWS Production VPC, pick its location, and save it.

Every remote network arrives with two pre-created connectors already listed, which saves you a step when you reach the connector stage.

The free Starter plan covers up to 5 users, 50 resources, 10 remote networks, 5 devices per user, and 1 admin user, according to the official pricing page fetched this run. Those limits are generous for a home lab or a small team trial, and they shape the worked example later in this guide. If you outgrow them, the paid plans are Teams at 5 dollars per user per month on yearly billing or 6 dollars monthly, and Business at 10 dollars per user per month yearly or 12 dollars monthly.

Step 2: Add Your First Resource and Learn the Resource-Group Lesson

A twingate resource is one server or service you want to reach, defined by its address plus its ports, and adding it is the step where most beginners stumble. Open your remote network, click Add Resource, and enter a label plus the address, which can be an IP address, a fully qualified domain name, a CIDR range such as a whole home subnet, or a wildcard DNS name. A single resource can be a web app on port 443, an SSH server on port 22, or an entire subnet such as 192.168.100.0/24 labelled Everything, which is the example the official home-lab guide uses for a whole home network.

Here is the lesson that decides whether your first resource works at all: you must add the resource to a group for the resource to be accessible to users, in the words of the official Quick Start. Resources grant no permissions by default, so a fresh client shows zero accessible resources until resources exist and are assigned.

The twingate resources you define are the only destinations your users can reach, so each one deserves a clear label and the right group. The default option at creation is the Everyone group, and you can also create role groups such as Standard Users, Power Users, and Admin Users under Teams and Groups, then assign resources to them. You can grant access at creation time or later through the resource Access tab, but either way the assignment is mandatory, not optional.

Pick one small resource for your first test, such as the admin page of a home server or a single internal app, and keep the rest of your network out of Twingate until the first connection works. That narrow first resource makes troubleshooting easy, because if it fails you know the problem sits in one of four places: the address, the group, the connector, or the client. The next section covers the connector, which is the piece that actually carries traffic to the resource.

Step 3: Deploy the Connector

A twingate connector is a small piece of software that runs behind your firewall and carries traffic between your devices and your resources, and deploying one is the only server-side work in this guide. Connectors are deployed either as a Docker container or as a native Linux systemd service, and a single connector can serve every resource it can reach, so you do not need one connector per server. Deploying extra connectors on separate hosts adds load balancing, failover, and capacity, and each connector needs only 2 GB of RAM and 2 vCPUs according to the official home-lab guide.

The connector must be deployed on a host that can actually reach the resources you want to provide access to via Twingate, in the words of the official Quick Start, so put it on a machine on the same network as your resources. A Raspberry Pi, a NAS, a Linux virtual machine, or a cloud server all work, as long as that host has outbound internet access and a network path to each resource. The connector makes outbound-only connections, so it needs no inbound firewall rules, and there is still no native Windows connector, with native Windows support still on a waitlist in late 2026.

Both the Docker and systemd paths follow the same token flow, and the flow has one security step worth knowing in advance. In the Admin Console, open your remote network, click a connector, and choose Generate Tokens, which asks you to re-authenticate before it shows the pair. You receive an access token and a refresh token, and those two values go into the Docker run command as environment variables or into the systemd configuration file at /etc/twingate/connector.conf alongside your network address.

Re-provisioning a connector issues fresh tokens, so treat the tokens like passwords and never paste them into a public chat or a shared document.

docker run -d --name twingate-connector --restart unless-stopped -e TWINGATE_NETWORK=yourname.twingate.com -e TWINGATE_ACCESS_TOKEN=your-access-token -e TWINGATE_REFRESH_TOKEN=your-refresh-token twingate/connector

For the systemd path, the Admin Console generates a single install command with the tokens already filled in, and you run it once on the supported Linux host. The supported distributions on the detailed Linux connector page are Ubuntu 22.04 LTS and 24.04 LTS, Fedora 39 and 40, CentOS Stream 9, and Debian 11 and 12, with only Ubuntu LTS versions officially supported. After either install, check the connector status with the service command below, and watch the Admin Console sidebar until the connector shows connected to both the Controller and the Relay.

sudo systemctl status twingate-connector
sudo systemctl start twingate-connector
sudo systemctl enable twingate-connector

The current connector release is 1.95.0, published on 26 October 2026, 12 days before this guide was written, and Twingate publishes connector updates on an approximately monthly cadence. The Controller enforces a minimum supported connector version and rejects connectors running below that threshold, so keep the connector updated through your package manager or your container update routine. If you run two connectors, stagger their updates so one stays online while the other restarts.

Step 4: Install the Twingate Client

A twingate client is the app on your laptop, phone, or server that authenticates you and routes traffic for your private resources, and it exists for Windows, macOS, Linux, iOS, Android, and ChromeOS. The fastest route to the right download is get.twingate.com, which serves the client for whatever platform visits it, and the client is free to install on every platform. Twingate is always on once installed, and split tunneling means your regular internet traffic is untouched, which the next section explains in full.

Windows users must know one current requirement before installing, because it changed two weeks before this guide was written. Windows clients from 22 October 2026 onward, starting with version 2026.288, require the .NET Desktop Runtime 10.0 for x64 or higher, while versions from November 2024 up to that release require the .NET Desktop Runtime 8.0 or higher. The EXE installer and in-place updates install the right .NET runtime automatically, but MSI installs require you to install the .NET Desktop Runtime manually alongside the client, so prefer the EXE installer unless your environment demands MSI.

On macOS, download the PKG installer directly from the Twingate download page, because the Mac App Store version of the macOS client is no longer supported. The standalone client uses a system extension for its VPN adapter, so allow the system software from Twingate.app in System Settings under Privacy and Security, and keep Twingate.app in the Applications folder or the extension will not work. The onboarding wizard walks through notifications, the VPN configuration, and the system extension, and local-admin users receive automatic updates.

On Linux, the one-line install script below works on the supported distributions, which are Ubuntu 22.04 LTS, 24.04 LTS, and 26.04 LTS, Debian 11 or later, Fedora 41 or later, CentOS Stream 9 or later, and Oracle Linux 8 or later, plus Arch Linux, HP ThinPro, NixOS, and Gentoo on x86 only. The Linux client needs either systemd-resolved running or NetworkManager configured as the client DNS service, and it needs a notification service for interactive authentication. Run the setup command after installing, and if you run a headless server, use the headless mode with a service key instead of the interactive flow.

curl -s https://binaries.twingate.com/client/linux/install.sh | sudo bash
sudo twingate setup
twingate start
twingate status

If you deploy connectors with Docker, our Docker beginner guide covers the container half of that setup, including the install and first-run commands. If the machine hosting your connector is a rented server rather than a box at home, our VPS hosting guide explains what a virtual private server is and how to pick one. Both guides pair with this one, because the connector needs a reachable host and the host needs an operating system you understand.

Step 5: Connect for the First Time

Connecting for the first time is the payoff step, and it takes about a minute once the earlier steps are done. Open the Twingate client, enter your network name, click Join Network, and sign in through your identity provider, such as Google or GitHub. The client then shows a green dot next to your email address when the connection is active, along with the list of resources you can reach, and a grey dot means you need to re-authenticate before reaching a resource.

Once connected, open your resource exactly as you normally would, whether that means a browser address, an SSH command, or a remote desktop app. If a resource needs extra authentication under its security policy, Twingate triggers a notification, and clicking it opens a browser window to complete that step, or you can authenticate manually from the resource menu in the client.

Access to a resource expires after the time set in its security policy, and you can renew it from the client menu without disconnecting and reconnecting. The client supports multiple accounts and lets you switch between them, but only one account is active at a time.

Split tunneling is the default, and it is the lesson that keeps beginners from worrying that Twingate will slow down or reroute their whole internet connection. By default, Twingate uses split tunneling, so it only captures and routes traffic destined for the private resources you defined, and all other traffic, such as public websites or a local printer, follows the device's normal network path. Full-tunnel mode is opt-in through Exit Networks, which route all traffic through a chosen network, with sessions lasting up to 12 hours, and Exit Networks need the Home plan or above, so they are not on the free Starter plan.

If the first connection fails, work through the four checkpoints in order: the resource address and port, the group assignment from Step 2, the connector status in the Admin Console, and the client connection dot. The most common failure is a resource with no group, followed by a connector on a host that cannot reach the resource, so check those two first. The official Quick Start was last updated on 2 July 2026, which is 128 days before this guide, and its flow still matches the current Admin Console, so it is a reliable cross-check when a step looks different on your screen.

What the Free Starter Plan Covers

The free Starter plan covers a real home lab without a credit card, and its limits are small enough to understand at a glance. You get 5 users, 50 resources, 10 remote networks, 5 devices per user, and 1 admin user, which is enough for a household or a small team trial. The plan includes split tunneling, enterprise peer-to-peer connections, and conditional access controls, and it covers every client platform, so the whole beginner arc in this guide runs on the free plan.

The worked numbers below are original arithmetic from the official limits and prices, computed for this guide, and they show how the free tier and the first paid tier scale. Five users with five devices each means 25 devices at most on Starter, and 50 resources spread evenly across 10 remote networks averages 5 resources per network. A 20-user team on Teams yearly billing pays 100 dollars a month, while the same team on monthly billing pays 120 dollars a month, which is a 20 percent premium for paying month to month.

Starter maximum devices
5 users times 5 devices per user = 25 devices
Starter resources per remote network, spread evenly
50 resources divided by 10 remote networks = 5.0 resources per network
Teams, 20 users, yearly billing
20 users times 5 dollars = 100 dollars per month
100 dollars times 12 months = 1200 dollars per year
Teams, 20 users, monthly billing
20 users times 6 dollars = 120 dollars per month
120 dollars times 12 months = 1440 dollars per year
Monthly billing premium over yearly billing
1440 minus 1200 = 240 dollars per year
240 divided by 1200 = 0.2, which is 20 percent
Home plan, flat rate
15 dollars times 12 months = 180 dollars per year

Two warnings from the pricing research belong here, because stale third-party pages get them wrong. One price-comparison site claims Teams starts at 10 dollars per user per month and that Starter includes unlimited resources, and both claims contradict the official pricing page fetched for this guide, so ignore them. Always quote the billing period with the price, because Teams is 5 dollars yearly but 6 dollars monthly, and Business is 10 dollars yearly but 12 dollars monthly.

Twingate vs Tailscale: Which One Fits Your Setup?

Twingate vs tailscale is the comparison most readers ask about, and the honest answer is that the two tools solve different problems with different shapes. Twingate is resource-centric: an admin defines remote networks, resources, and groups, and each user reaches only the specific resources their groups allow, with no device-to-device mesh and no stable device addresses. Tailscale is a WireGuard mesh: every device joins one tailnet, gets a stable 100.x.y.z address, and can reach every other device directly, subject to access controls.

Choose Twingate when you want least-privilege access to specific apps, especially for a team or a compliance setting where each person should see only their own resources and nothing else. Choose Tailscale when you want your own devices to form one private network, such as reaching a home server, a NAS, and a laptop from anywhere as if they shared a LAN. The free tiers are close enough in size that price should not decide the question: Starter allows 5 users while Tailscale Personal allows 6 users with unlimited devices, a difference of one user.

Our Tailscale beginner guide walks through the mesh setup if that shape fits you better, and our Headscale beginner guide covers the self-hosted coordination option for the Tailscale shape. If your goal is browsing privacy rather than reaching your own machines, a commercial privacy VPN is the right tool instead, and our Proton VPN beginner guide covers that case.

One transport note matters for accuracy, because a 2026 comparison article claims Twingate uses WireGuard, and that claim conflicts with Twingate's own documentation. Twingate's own docs describe its transport as TLS version 1.2, with direct peer-to-peer connections over QUIC and relays that cannot decrypt the traffic, and the company makes no WireGuard claim for its own tunnel. The independent dbtechreviews home-server guide is the only independent walkthrough in the field, and it was published on 2 April 2025 and never updated, which makes it 584 days old as of this guide, so treat it as motivation rather than a current step-by-step.

Seven Mistakes Beginners Make

Most first-time Twingate setups fail for one of seven small reasons, and every one of them is avoidable once you know where to look. The table below lists each mistake, what it looks like, and the fix, and the first two rows alone solve the majority of support threads.

None of the commands in this guide were executed in a live testbed during writing, so every command here is documented syntax quoted from the official Twingate documentation, not output from a run on our machines. That honesty matters, because install scripts and token flows change, and the official docs are the final authority when a step looks different on your screen. The vendor home-lab guide is a useful cross-check, but it is vendor documentation, not an independent test, so verify each step against your own Admin Console as you go.

Sources

This guide was written from the official Twingate documentation fetched on 7 November 2026, including the Quick Start updated 2 July 2026, the How Twingate Works architecture page, the Linux connector deployment guide updated 23 June 2026, the connector deployment overview updated 12 May 2026, the Windows client page with its .NET 10 requirement, the macOS and Linux client pages updated 25 October 2026 and 19 May 2026, the split-tunnel and Exit Networks pages, the FAQ updated 19 May 2026, and the official pricing page with the Starter, Home, Teams, and Business limits quoted above. The version numbers come from the clients changelog, with Windows 2026.302 dated 5 November 2026 and Linux 2026.302 dated 2 November 2026, and from the connector changelog, with version 1.95.0 dated 26 October 2026.

The independent picture comes from the dbtechreviews home-server guide published 2 April 2025 and never updated, the Texada Software help-center article on joining a company Twingate network, the Texas A and M Technology Services knowledge-base article on the Twingate client for Mac updated 24 days before this guide, and the WunderTech guide to Twingate on a Synology NAS published 3 March 2024 and updated 5 May 2025. The Proxmox VE and DigitalOcean getting-started guides cited in the field are official Twingate documentation pages, not independent coverage, and they were treated as vendor sources throughout.

Company background comes from Forge, PitchBook, CB Insights, CRN, and Himalayas, which agree that Twingate was founded in 2019 in Redwood City, California, and that it raised 42 million dollars in Series B funding in April 2022. The Twingate versus Tailscale comparison draws on the technologymatch ZTNA comparison, the Pangolin comparison page, the tech-insider comparison dated 26 September 2026, the hamradio.my engineering comparison updated 7 July 2026, and Twingate's own homelab blog comparing the two services. Search volumes for the primary keyword were not available, so no volume figure is claimed anywhere in this guide.

Frequently Asked Questions

Is Twingate free for home use?

Yes, the free Starter plan covers home use with up to 5 users, 50 resources, 10 remote networks, 5 devices per user, and 1 admin user. The plan includes split tunneling and every client platform, so the whole beginner arc in this guide runs without a card. The Home plan at 15 dollars per month flat adds 7 users, Exit Networks, and advanced homelab projects for households that outgrow Starter.

Do I need to open ports or change firewall rules for Twingate?

No, the connector makes outbound-only connections, so it needs no inbound ports, no port forwarding, and no firewall rule changes. The client sets up only a local VPN connection to 127.0.0.1 to intercept traffic for your private resources, which is local to your device and not a listening port on your network. That outbound-only design is the main reason Twingate suits home labs behind a router you do not control.

Why can I not see my resource in the Twingate client?

The most common cause is a missing group assignment, because a resource with no group is invisible to everyone, including admins. Open the resource in the Admin Console, check its Access tab, and add your group, then refresh the client. If the group is set, check that the connector is online and that it runs on a host that can actually reach the resource.

Does Twingate slow down my normal internet browsing?

No, split tunneling is the default, so only traffic headed for your defined private resources passes through Twingate, and everything else follows your normal connection. Public websites, streaming, and local devices such as printers are untouched while you stay connected. Full-tunnel mode through Exit Networks is opt-in, lasts up to 12 hours per session, and needs the Home plan or above.

Can I use Twingate instead of a VPN for privacy?

No, Twingate is not a privacy VPN, because it connects you to your own private resources rather than hiding your browsing from the websites you visit. Your public internet traffic stays on your normal connection under split tunneling, so your IP address and browsing remain visible to sites as usual. If privacy is the goal, use a commercial privacy VPN instead, and use Twingate for reaching your own servers and apps.