WatchYourLAN

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B2s (2 vCPU / 4 GiB RAM) is a comfortable starting size, because WatchYourLAN is very light on resources.

In the network security group (NSG), allow inbound 22/tcp from your management network, 80/tcp for the web UI, and 443/tcp if you add TLS.

WatchYourLAN scans the network the VM is attached to, so deploy it on the VNet and subnet whose hosts you want to see. It serves plain HTTP on port 80. Terminate TLS in front of it with your own domain (see Maintenance).

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for WatchYourLAN by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80).

Select Review + create, then Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:watchyourlan-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name watchyourlan \
  --image sac1647283583153:watchyourlan-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name watchyourlan --port 80 --priority 1010

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

systemctl is-active watchyourlan.service nginx.service

Both services report active. WatchYourLAN serves its web UI and REST API on the loopback connector 127.0.0.1:8840, and nginx fronts the UI on port 80 with HTTP Basic Auth. The SQLite datastore lives at /var/lib/watchyourlan/scan.db.

Step 5 - Retrieve your web UI password

WatchYourLAN has no built-in login, so the image protects its web UI and REST API with nginx HTTP Basic Auth. The username is admin. A unique password is generated on the first boot of your VM and written to a root-only file. Read it with:

sudo cat /root/watchyourlan-credentials.txt

The file contains WATCHYOURLAN_USERNAME, WATCHYOURLAN_PASSWORD and the WATCHYOURLAN_URL to open in a browser. The password is stored on disk only as a bcrypt hash in /etc/nginx/.watchyourlan.htpasswd, so no plaintext password ships in the image. Store the password somewhere safe.

Step 6 - Confirm the health endpoint

nginx serves an unauthenticated health endpoint for load balancers and probes:

curl -s http://localhost/healthz

It returns ok. This endpoint never requires authentication, so you can use it for an Azure Load Balancer health probe.

Step 7 - Confirm authentication is enforced

A password is set on first boot, so an unauthenticated request to the web UI returns HTTP 401. Nobody reaches your dashboard without the password. The commands below read the per-VM password from the credentials file and test both cases: an unauthenticated request is rejected, and the correct password authenticates.

PW=$(sudo grep '^WATCHYOURLAN_PASSWORD=' /root/watchyourlan-credentials.txt | cut -d= -f2-)
echo "unauth: $(curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1/)"
echo "authed: $(curl -s -o /dev/null -w '%{http_code}' -u admin:$PW http://127.0.0.1/)"

The output is unauth: 401 followed by authed: 200. The REST API sits behind the same Basic Auth. For example, the discovered hosts are available at /api/all and the running version at /api/version.

Step 8 - Sign in to the web UI

Browse to http://<vm-public-ip>/. Your browser prompts for a username and password. Enter admin and the password from Step 5.

WatchYourLAN opens on its dashboard, a table of every host it has discovered on your network. Each row shows the host's name, IP address, MAC address, hardware vendor and whether it is currently online. On a freshly deployed cloud VM, the table starts small and fills in as the periodic scan runs. On a busy LAN, it lists every device on the subnet.

Step 9 - Inspect a discovered host

Click any host to open its detail page. It shows the device's identity (name, IP, MAC and vendor) alongside the record of when it has been seen. Use this page to name and annotate the devices you recognize, so that unknown arrivals stand out.

Step 10 - Review the scan history

Open the History page to see how many hosts have been online over time. This timeline turns WatchYourLAN from a one-off scan into a continuous record of who is on your network and when.

Step 11 - Review the configuration page

Open the Config page to see the active settings: the interface being scanned, the scan interval, the theme and the datastore in use. The image writes these settings on first boot, and it detects the interface automatically from the VM's default route.

Step 12 - How scanning works

WatchYourLAN scans the VM's primary network interface on a fixed interval (120 seconds by default) using arp-scan, and records everything it finds in its SQLite datastore. Because it runs continuously, hosts that appear or disappear are captured in the history, and any new device on the subnet shows up on the next scan.

On a solo cloud VM, the scanner sees only a handful of neighbors. Deploy it on a subnet with the devices you care about to get the full picture.

You can trigger an immediate rescan from the web UI, or from the authenticated REST API:

PW=$(sudo grep '^WATCHYOURLAN_PASSWORD=' /root/watchyourlan-credentials.txt | cut -d= -f2-)
curl -s -o /dev/null -w '%{http_code}\n' -u admin:$PW http://127.0.0.1/api/all

The command prints 200, which confirms that the hosts API is reachable behind the Basic Auth proxy.

Maintenance

• Password: the web UI password is set on first boot and stored as a bcrypt entry in /etc/nginx/.watchyourlan.htpasswd. To change it, run sudo htpasswd -B /etc/nginx/.watchyourlan.htpasswd admin, then sudo systemctl reload nginx.
• Scanned interface and interval: the image writes the detected interface and defaults into /var/lib/watchyourlan/config_v2.yaml. To change the interface, the scan interval (TIMEOUT) or the history retention (TRIM_HIST), edit that file or use the Config page in the UI. Then run sudo systemctl restart watchyourlan.
• Datastore: all WatchYourLAN state lives in /var/lib/watchyourlan/scan.db. Back up that file to preserve your host history.
• Upgrades: WatchYourLAN is a single static binary at /usr/local/bin/watchyourlan. To upgrade, download a newer pinned release, verify its checksum, replace the binary and run sudo systemctl restart watchyourlan. Your datastore is preserved.
• TLS: nginx fronts WatchYourLAN on plain HTTP port 80. Add TLS, for example with certbot and your own domain, before you expose it beyond a trusted network.
• Security patches: unattended-upgrades stays enabled, so the OS continues to receive security updates automatically.

Support

SecureAnyCloud provides 24/7 expert support for this image. Contact sales@secureanycloud.com.

Deploy on Azure

Launch WatchYourLAN on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Connecting to your instance

Connect over SSH on port 22 as the default login user for the AMI variant you launched:

OS variant SSH login user

Ubuntu 24.04 ubuntu

ssh ubuntu@<instance-public-ip>

Use the key pair you selected at launch. The dashboard is served over the network, as described below.

Prerequisites

You need an AWS account, an EC2 key pair, and a VPC with a subnet in your target region.

m5.large (2 vCPU / 8 GiB RAM) is the recommended instance type. WatchYourLAN itself is lightweight, so this gives comfortable headroom.

In the security group, allow inbound 22/tcp from your management network and 80/tcp from the networks that need the dashboard. Do not expose the dashboard to the whole internet. Restrict 80/tcp to your own address ranges. The dashboard is authenticated, but a network inventory tool should be reachable only by people you trust.

To get a useful inventory, launch the instance onto the subnet whose devices you want to track. If the devices you care about live on premises, connect that network to your VPC over a VPN or AWS Direct Connect first (see Step 12).

Step 1 - Launch from the AWS Marketplace

Subscribe to the listing, choose the Ubuntu 24.04 version, and launch it with Launch through EC2.

Pick the m5.large instance type, select your key pair, and choose the subnet whose devices you want WatchYourLAN to inventory. In the security group, allow 22/tcp and 80/tcp from your own networks only.

Step 2 - Launch from the AWS CLI

To deploy from the CLI, create a security group scoped to your own networks and launch the AMI. Replace the values in angle brackets with your own:

aws ec2 create-security-group --group-name watchyourlan-sg \
  --description "WatchYourLAN dashboard + SSH"
# SSH and the dashboard, from YOUR networks only (not 0.0.0.0/0)
aws ec2 authorize-security-group-ingress --group-name watchyourlan-sg \
  --protocol tcp --port 22 --cidr <your-admin-cidr>
aws ec2 authorize-security-group-ingress --group-name watchyourlan-sg \
  --protocol tcp --port 80 --cidr <your-admin-cidr>
aws ec2 run-instances --image-id <ami-id> --instance-type m5.large \
  --key-name <your-key> --security-groups watchyourlan-sg \
  --subnet-id <the-subnet-you-want-to-inventory>

Step 3 - Connect to your instance

ssh ubuntu@<instance-public-ip>

Step 4 - Confirm the services are running

Two services make up the appliance: WatchYourLAN itself and the nginx reverse proxy. Confirm that both are active and check what is listening.

Note the :8840 line. WatchYourLAN is bound to 127.0.0.1, not 0.0.0.0. This is deliberate: the dashboard can be reached only through nginx, which enforces authentication. You cannot bypass it by connecting to port 8840 directly.

systemctl is-active watchyourlan nginx
sudo ss -tlnp | grep -E ':80 |127.0.0.1:8840'

Expected output:

active active LISTEN 0 511 127.0.0.1:8840 0.0.0.0:* users:(("watchyourlan",pid=...)) LISTEN 0 511 0.0.0.0:80 0.0.0.0:* users:(("nginx",pid=...)) LISTEN 0 511 [::]:80 [::]:* users:(("nginx",pid=...))

Step 5 - Retrieve your per-instance dashboard password

WatchYourLAN has no login of its own upstream. The dashboard exposes your network's device inventory, so this image puts it behind HTTP Basic Auth. The password is generated on your instance, on its first boot. Nothing in the image knows it, and no other instance shares it.

Read it from the root-only credentials file:

sudo cat /root/watchyourlan-credentials.txt

Expected output. Your password will differ, because it is unique to your instance:

# WatchYourLAN - generated on first boot by watchyourlan-firstboot.service
# These credentials are unique to this VM. Store them somewhere safe. WATCHYOURLAN_URL=http://<instance-ip>/ WATCHYOURLAN_USERNAME=admin WATCHYOURLAN_PASSWORD=<generated on your instance at first boot>

To reach the dashboard from your workstation, use the instance's public IP or DNS name, and connect only from a network your security group allows (see Prerequisites).

Step 6 - Confirm the dashboard is protected

Confirm that authentication works. A request with no credentials must be rejected, and the per-instance password must be accepted. The commands read the password straight from the credentials file, a pattern you can reuse in your own scripts:

PW=$(sudo awk -F= '/^WATCHYOURLAN_PASSWORD=/{print $2; exit}' /root/watchyourlan-credentials.txt)
curl -s -o /dev/null -w 'dashboard, no credentials -> HTTP %{http_code}\n' http://127.0.0.1/
curl -s -o /dev/null -w 'dashboard, with credentials -> HTTP %{http_code}\n' -u "admin:$PW" http://127.0.0.1/
curl -s -o /dev/null -w 'healthz (anonymous probe) -> HTTP %{http_code}\n' http://127.0.0.1/healthz

Expected output:

dashboard, no credentials -> HTTP 401 dashboard, with credentials -> HTTP 200 healthz (anonymous probe) -> HTTP 200

/healthz is intentionally anonymous, so a load balancer or uptime monitor can probe the instance without credentials. It returns only the string ok and exposes nothing else.

Step 7 - Confirm the scanner is discovering devices

WatchYourLAN scans the interface it detected at first boot and records everything it sees. Query the discovered inventory through the authenticated REST API:

PW=$(sudo awk -F= '/^WATCHYOURLAN_PASSWORD=/{print $2; exit}' /root/watchyourlan-credentials.txt)
echo "scanning interface: $(grep IFACES /var/lib/watchyourlan/config_v2.yaml)" curl -s -u "admin:$PW" http://127.0.0.1/api/all \
  | python3 -c 'import sys,json; d=json.load(sys.stdin); print(f"devices discovered: {len(d)}"); [print(" -", h["IP"], h["Mac"], h["Name"]) for h in d]'

Expected output. Your devices will differ, because the scan lists whatever is reachable on your subnet:

scanning interface: IFACES: "ens5" devices discovered: 2 - 172.31.80.1 12:33:aa:d2:49:03 ip-172-31-80-1.ec2.internal. - 172.31.90.251 12:20:66:a0:ce:63 ip-172-31-90-251.ec2.internal.

A freshly launched instance in a quiet subnet may show only the subnet router. This is expected, because WatchYourLAN can see only what is reachable at layer 2 from its interface (see Step 12 to widen the view). The count grows as it discovers more of the network it is attached to.

Step 8 - Open the dashboard

Browse to http://<instance-public-ip>/ and sign in with admin and the password from Step 5.

The dashboard is the device inventory, with one row per host. Each row shows the host's name, interface, IP, MAC, hardware vendor, when it was last seen, whether you have flagged it as Known, and whether it is currently Online.

Step 9 - Inspect a device

Click a device's IP to open its detail view. It shows everything WatchYourLAN knows about the host. From here you can run an on-demand port scan against the device, send a Wake-on-LAN packet, or remove it from the inventory.

Step 10 - Curate your inventory

Select Edit on the dashboard to switch into management mode. Rename hosts to something meaningful, tick the Known flag on devices you recognize so that unfamiliar newcomers stand out, and bulk-remove stale entries with Delete selected.

Flagging your known devices turns WatchYourLAN into an early-warning system. Once the machines you expect are marked Known, anything unmarked is new on the network.

Step 11 - Review the settings

Select Config to review the active settings. The page confirms the secure-by-default setup at a glance: Host is 127.0.0.1 and Port is 8840, so the application is bound to loopback and reachable only through the authenticating nginx proxy.

From here you can also enable optional integrations: push notifications via Shoutrrr, or metrics export to InfluxDB and Prometheus.

Step 12 - Widen the scan to an on-premises network

To inventory devices that are not on the instance's own VPC subnet, such as the machines in your office or data center, give the instance a layer-2 reachable path to that network. Then point WatchYourLAN at the corresponding interface. In practice, terminate a VPN or overlay on the instance (WireGuard, an AWS Site-to-Site VPN with a software router, ZeroTier, and similar), then set the IFACES value in the config to that interface.

Edit the scanner's interface list on the instance, then restart the service. Run these commands yourself when you are ready:

$
sudo sed -i 's/^IFACES:.*/IFACES: "wg0"/' /var/lib/watchyourlan/config_v2.yaml $
sudo systemctl restart watchyourlan

ARP does not route. WatchYourLAN sees only devices in the same broadcast domain as the interface it scans, so the network you attach must be bridged or routed to the instance at the link layer, not merely reachable over IP.

Step 13 - Rotate the dashboard password

The password is generated per instance, so you rarely need to change it. To set your own, replace the nginx Basic Auth entry. Run these commands yourself:

$
sudo htpasswd -B /etc/nginx/.watchyourlan.htpasswd admin New password: Re-type new password: $
sudo systemctl reload nginx

The username stays admin. The credentials file in /root still shows the original generated password after this change, so record your new password separately.

Security

• The dashboard is authenticated and loopback-bound. WatchYourLAN listens only on 127.0.0.1:8840. nginx is the only exposed component, and it requires the per-instance password. Do not reconfigure the app to bind 0.0.0.0.
• Scope the dashboard with your security group. A network inventory tool reveals your topology. Restrict 80/tcp to your own address ranges rather than 0.0.0.0/0. If you reach the dashboard across untrusted links, consider fronting it with TLS, using a load balancer or a reverse proxy with a certificate.
• The image ships no scan data and no known password. The build wipes the SQLite store and the Basic Auth file before capture. Your instance generates a fresh empty database and a fresh password on its first boot.
• Keep the base patched. Unattended security upgrades are enabled. Apply WatchYourLAN releases as they ship.

Maintenance

• Service control: sudo systemctl restart watchyourlan and sudo systemctl restart nginx.
• Logs: journalctl -u watchyourlan -f follows the scanner, and sudo tail -f /var/log/nginx/access.log follows the proxy.
• Data: the SQLite store lives at /var/lib/watchyourlan/scan.db. Back it up to preserve discovered-device history across a rebuild.
• Scan interval and interface: both live in /var/lib/watchyourlan/config_v2.yaml (TIMEOUT and IFACES). Restart the service after you edit the file.

Support

SecureAnyCloud provides 24/7 technical support by email and chat. We help with deployment, scoping the scan to the right subnet, bridging on-premises networks over a VPN, rotating credentials, and upgrade planning.

All product and company names are trademarks or registered trademarks of their respective holders. WatchYourLAN is published under the MIT License. Use of the name identifies the software and does not imply affiliation with or endorsement by the WatchYourLAN project.

Deploy on AWS

Launch WatchYourLAN with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com