Deployment Guide

PXE Network Boot

Wipe 50-100 devices simultaneously over your network. No USB drives, no manual intervention. Boot target machines into WipeCert directly from the network, authenticate with your API key, and erasure starts automatically.

Business plan and aboveDocker requiredx86_64 + ARM64

Overview

How PXE Boot Works

PXE (Preboot Execution Environment) allows a device to boot an operating system from the network instead of a local disk. WipeCert provides a Docker-based PXE server that serves the WipeCert erasure environment to any device on your network that requests a network boot.

Boot sequence:

  1. Target device powers on → requests network boot (PXE DHCP discover)
  2. WipeCert PXE server responds with boot image location
  3. Device downloads iPXE chainloader (~1MB) via TFTP
  4. iPXE fetches kernel + initrd + rootfs (~300MB) via HTTP
  5. WipeCert OS boots, prompts for API key (or uses pre-configured key)
  6. Agent authenticates with wipecert.com, picks up queued wipe
  7. Erasure runs, results report to dashboard, certificate generated
  8. Device powers off

Important

The PXE-booted device must have outbound internet access to reach https://wipecert.com for API authentication and wipe reporting. If your wipe network is isolated, you must configure NAT/routing to the internet. See Isolated Network Setup.

Requirements

Hardware and Software Requirements

PXE Server

Any Linux machine with Docker installed
Raspberry Pi 4/5 (recommended for up to 50 devices)
x86 server for 50-100+ simultaneous devices
Wired Ethernet connection (not WiFi)

Target Devices

x86_64 or ARM64 architecture
PXE-capable network interface (built-in or USB adapter)
Network boot enabled in BIOS/UEFI
Secure Boot disabled

Network

PXE server and targets on same subnet/VLAN
Outbound HTTPS (port 443) to wipecert.com
Gigabit Ethernet recommended for fast boot times
No firewall blocking UDP 67-69 or TCP 80 internally

WipeCert Account

Business plan or above
API key generated (Dashboard → Settings → API Keys)
Wipes queued for target devices (optional, can queue after boot)

Network

Network Requirements

The PXE server and all target devices must be on the same Layer 2 network (same subnet/VLAN). PXE boot relies on broadcast DHCP packets that do not cross subnet boundaries without a DHCP relay.

Port Requirements

Port	Protocol	Direction	Purpose
67, 68	UDP	Internal	DHCP / ProxyDHCP
69	UDP	Internal	TFTP (iPXE chainloader transfer)
80	TCP	Internal	HTTP (kernel, initrd, rootfs download)
443	TCP	Outbound	HTTPS to wipecert.com (API auth + reporting)

Warning

Port 443 outbound is mandatory. Without internet access, the WipeCert agent cannot authenticate or report wipe results. Certificates will not be generated for offline wipes.

Setup

PXE Server Setup (Docker)

The WipeCert PXE server runs as a Docker container. It handles DHCP/ProxyDHCP, TFTP, and HTTP serving of boot files. It works alongside your existing network DHCP server (router).

Step 1: Load the Docker image

curl -fL https://wipecert.com/api/pxe/files?file=pxe-docker.tar.gz | docker load

Step 2: Start the PXE server

docker run --net=host --cap-add=NET_ADMIN \
  -e WIPECERT_API_KEY=wc_live_your_key_here \
  -e IFACE=eth0 \
  -e SUBNET=192.168.1.0 \
  wipecert-pxe:latest

Note

Replace IFACE with your actual network interface name. Run ip addr to find it. Common values: eth0, enp0s3, eno1. Replace SUBNET with your LAN subnet base (e.g., 10.0.0.0 for a 10.0.0.x network).

Step 3: Verify the server is running

The container logs will show:

[wipecert-pxe] DHCP/ProxyDHCP listening on eth0 (192.168.1.100)
[wipecert-pxe] TFTP server ready on port 69
[wipecert-pxe] HTTP boot server ready on port 80
[wipecert-pxe] Waiting for PXE boot requests...

Important

The PXE server must be fully running before you power on target devices. PXE boot requests happen within the first 3-5 seconds of device POST. If the server is not ready, the device will silently fall through to local disk boot.

Isolated Network

Isolated / Dedicated Wipe Network

If you run a dedicated wipe VLAN or isolated network (no existing internet gateway), the PXE server must provide both DHCP and internet routing for target devices.

Option A: PXE server as NAT gateway

If your PXE server has two interfaces (e.g., wlan0 for internet, eth0 for the wipe network), enable NAT forwarding:

# Enable IP forwarding
sudo sysctl -w net.ipv4.ip_forward=1

# NAT traffic from wipe network out through internet interface
sudo iptables -t nat -A POSTROUTING -o wlan0 -j MASQUERADE
sudo iptables -A FORWARD -i eth0 -o wlan0 -j ACCEPT
sudo iptables -A FORWARD -i wlan0 -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT

To persist across reboots:

# Make IP forwarding permanent
echo "net.ipv4.ip_forward=1" | sudo tee -a /etc/sysctl.conf

# Save iptables rules
sudo apt install -y iptables-persistent
sudo netfilter-persistent save

Option B: Full DHCP mode (no existing router)

Add the DHCP_MODE=full environment variable. The PXE server will act as the sole DHCP server on the network, assigning IPs and serving boot files:

docker run --net=host --cap-add=NET_ADMIN \
  -e WIPECERT_API_KEY=wc_live_your_key_here \
  -e IFACE=eth0 \
  -e SUBNET=10.0.0.0 \
  -e DHCP_MODE=full \
  -e GATEWAY=10.0.0.1 \
  -e DNS=8.8.8.8,1.1.1.1 \
  wipecert-pxe:latest

Boot Devices

Booting Target Devices

Start the PXE server and confirm it is ready

Connect target devices to the same network via Ethernet

Power on the target device and enter the boot menu

Press F12 during POST on most devices. Alternatively, enter BIOS/UEFI and set Network Boot as the first boot option.

Select Network Boot / PXE Boot from the menu

Device downloads WipeCert OS (~30 seconds on gigabit)

You will see the iPXE progress bar downloading the kernel and root filesystem.

WipeCert boots, enter your API key when prompted

The API key is shown at Dashboard → Settings → API Keys. Keys start with wc_live_.

Agent authenticates and picks up the queued wipe automatically

USB Ethernet

Devices Without Built-in Ethernet

Many modern laptops (Surface, MacBook, ultrabooks) lack a built-in Ethernet port. PXE boot requires a USB or USB-C Ethernet adapter with PXE ROM firmware built in. Not all adapters support this.

Adapter Requirements

Must have PXE boot ROM (firmware-level network boot support)
Realtek RTL8153-based USB-C gigabit adapters generally include PXE ROM
Microsoft Surface USB-C to Ethernet adapter (confirmed working)
ASIX-based adapters typically do NOT have PXE ROM; avoid these
Generic "no-brand" adapters under $15 usually lack PXE support

Important

The USB Ethernet adapter must be plugged in before powering on the device. The UEFI firmware only enumerates USB network devices during POST. If you plug it in after boot, it will not appear as a boot option.

How to verify adapter PXE support

Plug the USB Ethernet adapter into the device (with Ethernet cable connected)
Power on and enter UEFI/BIOS settings
Navigate to Boot Configuration or Boot Order
If "Network Boot" or "USB Ethernet" appears as a boot option, the adapter has PXE ROM
If it does not appear, the adapter is not PXE-capable and will not work

Surface

Microsoft Surface Devices

Surface devices (Pro, Laptop, Go, Book) do not have built-in Ethernet. PXE boot is supported through USB-C Ethernet adapters with PXE ROM.

Surface PXE Boot Steps

Connect a PXE-capable USB-C Ethernet adapter (with cable to PXE network)
Power off the Surface completely
Hold Volume Up + press Power to enter Surface UEFI
Go to Boot Configuration
Enable Network Boot (drag it above the internal SSD in boot order)
Save and exit
Surface will PXE boot on next restart

Note

Surface UEFI is not a standard BIOS. There is no F12 boot menu. You must enter Surface UEFI (Volume Up + Power) and explicitly enable and prioritize Network Boot in the boot order.

Secure Boot

WipeCert's iPXE chainloader is not signed with Microsoft's Secure Boot keys. Secure Boot must be disabled for PXE boot to work.

How to disable Secure Boot

Enter BIOS/UEFI settings (F2, Del, or Volume Up + Power on Surface)
Navigate to Security or Boot tab
Set Secure Boot to Disabled
Save and exit

Warning

If devices are managed by Microsoft Intune with a Device Configuration profile enforcing Secure Boot, you must remove or exclude target devices from that policy before PXE wiping. After the wipe, Secure Boot can be re-enabled during Autopilot re-enrollment.

Configuration

Environment Variables

Variable	Required	Default	Description
WIPECERT_API_KEY	Yes	—	Your organization API key (wc_live_...)
IFACE	No	eth0	Network interface connected to target devices
SUBNET	No	192.168.1.0	LAN subnet base address
NETMASK	No	255.255.255.0	Subnet mask (change for /23 or larger)
DHCP_MODE	No	proxy	Set to "full" if no existing DHCP server
GATEWAY	No	—	Gateway IP (required in full DHCP mode)
DNS	No	8.8.8.8	DNS servers (comma-separated)
WIPECERT_SERVER	No	https://wipecert.com	API server URL (for on-prem deployments)

Performance

Boot Times and Performance

PXE boot speed depends on your network bandwidth between the PXE server and target devices. The WipeCert boot image is approximately 300MB (compressed rootfs).

Network Speed	Boot Time (approx)	Notes
Gigabit Ethernet	25-35 seconds	Recommended. Pi 4/5 saturates at ~900Mbps.
100 Mbps Ethernet	3-5 minutes	Functional but slow for large batches.
USB 2.0 Ethernet (480Mbps)	45-60 seconds	Limited by USB 2.0 bus speed.

Note

When booting multiple devices simultaneously, the PXE server's network interface becomes the bottleneck. A Raspberry Pi 4/5 with gigabit Ethernet can comfortably serve 10-20 devices booting at the same time. For 50+ simultaneous boots, use a dedicated x86 server.

Troubleshooting

Device does not PXE boot / skips to local disk

Enter BIOS/UEFI and enable Network Boot. Disable Secure Boot. Set boot order to Network first. Ensure the PXE server is running BEFORE powering on the device. PXE discover happens within 3-5 seconds of POST.

"Server unreachable" after entering API key

The device has no internet access. The PXE network must route outbound HTTPS traffic to wipecert.com. If using an isolated network, configure NAT on the PXE server (see Isolated Network Setup above).

USB Ethernet adapter not showing as boot option

The adapter must be plugged in before power-on. If still not visible in UEFI boot options, the adapter lacks PXE ROM firmware and cannot be used for PXE boot. Use a Realtek RTL8153-based adapter.

PXE server starts but devices don't find it

Verify the PXE server and target devices are on the same VLAN/subnet. Check that IFACE matches your active network interface (run 'ip addr'). Ensure no other PXE/DHCP server is conflicting.

TFTP timeout or very slow transfer

Some firewalls block TFTP (UDP 69). Disable any host firewall on the PXE server: sudo ufw disable. Check for managed switches with DHCP snooping that may block TFTP.

iPXE loads but kernel download fails or hangs

The HTTP server (port 80) on the PXE server may not be running. Check Docker container logs. Ensure no other service is bound to port 80.

Device boots but agent says 'No queued wipe'

The device serial must match a queued wipe. Queue a wipe from the dashboard first, or let the agent wait; it polls every 10 seconds until a wipe appears for that device.

Multiple devices boot but only one wipes

Each device needs its own queued wipe. Use batch wipe (select multiple devices) to queue them all at once before booting.

Boot is very slow (several minutes)

Check your network speed. 100Mbps links take 3-5 minutes to transfer the 300MB rootfs. Use gigabit Ethernet. Also verify no packet loss between PXE server and device.

Ready to deploy PXE boot?

Generate your API key and start wiping devices over the network in minutes.

Start free trial Talk to sales