Default values & credentials
Quick reference for the defaults baked into a stock Waveshift
deployment — credentials, network CIDRs, ports, instance types,
and AWS resource names.
Change default credentials immediately
Default credentials are public on this page. Change them as
soon as you finish first-time setup.
Credentials
Web Console
| Field |
Default value |
| URL |
https://console.waveshift.internal (default; configurable during the TUI) |
| Username |
admin |
| Password |
admin123 |
A fresh deploy ships with the admin / admin123 default. Sign in
with those, change the password immediately from
Profile → Change password, then create
your remaining users from
Users administration.
Kasm Workspaces
| Field |
Default value |
| URL |
https://workspaces.waveshift.internal (default; configurable during the TUI) |
| Username |
admin |
| Password |
Waveshift2025! |
Configure Kasm via
Integrations administration;
the credentials in the Web UI are write-only after first save.
Control Hub router
| Field |
Default value |
| Username |
root |
| Password |
Waveshift2025! |
| Default IP |
10.34.0.1 |
| SSH port |
22 |
| Web UI |
http://10.34.0.1 |
Used by wsctl hub during initial Hub configuration. After
configuration, the Hub's SSH access is restricted to the
orchestrator.
URLs and endpoints
| Service |
Default URL |
| Web Console |
https://console.waveshift.internal |
| Kasm Workspaces |
https://workspaces.waveshift.internal |
wsctl proxy |
https://localhost:8443 (console), https://localhost:8444 (Kasm) |
| Internal Route 53 zone |
waveshift.internal |
Network CIDRs
VPC and subnets (per region)
| Component |
Default CIDR |
| VPC |
10.32.0.0/23 |
| Public subnet |
10.32.0.0/24 |
| Private subnet |
10.32.1.0/24 |
Control Hub network
| Component |
Default value |
| Hub CIDR |
10.34.<site-number>.0/24 (10.34.0.0/24 out of the box) |
| Hub IP |
10.34.<site-number>.1 (10.34.0.1 out of the box) |
wsctl hub configure <site> re-addresses the Hub's LAN to its
site's number, so the first site keeps 10.34.0.1.
WireGuard
| Setting |
Default value |
| Port |
51820/UDP |
| Interface |
wg0 |
| MTU |
1360 (Hub ↔ infrastructure server), 1280 (client and egress tunnels) |
Ports
Waveshift services
| Service |
Port |
Protocol |
Purpose |
| Web Console |
443 |
TCP |
Web UI (HTTPS) |
| Kasm Workspaces |
443 |
TCP |
Web UI (HTTPS) |
| AWS SSM |
n/a |
SSM |
Shell into EC2 instances |
Control Hub
| Service |
Port |
Protocol |
Purpose |
| SSH |
22 |
TCP |
Hub administration |
| HTTP |
80 |
TCP |
Hub Web UI |
| WireGuard |
51820 |
UDP |
VPN tunnel |
| DNS |
53 |
UDP/TCP |
Local DNS |
| DHCP |
67 |
UDP |
DHCP server |
Infrastructure server
| Service |
Port |
Protocol |
Purpose |
| WireGuard |
51820 |
UDP |
Tunnel to Hub |
| AWS SSM |
n/a |
SSM |
Shell access (no SSH) |
EC2 instance types
| Component |
Default |
Configurable |
| Orchestrator |
t3a.small |
Yes (TUI / wsctl config waveshift --instance-type) |
| Kasm Workspaces |
m6a.2xlarge |
Yes (TUI / wsctl config kasm --instance-type; must be x86_64) |
| Infrastructure server |
t4g.nano |
Yes (TUI infrastructure-server settings) |
| Egress server |
t4g.nano |
No |
| Egress UDP ingress proxy |
t4g.nano |
No |
The orchestrator and Kasm host run Ubuntu 24.04 LTS (x86_64);
infrastructure servers, egress servers and their UDP proxies run
Amazon Linux 2023 (arm64).
| Type |
vCPUs |
Memory |
t3a.small |
2 |
2 GiB |
m6a.2xlarge |
8 |
32 GiB |
t4g.nano |
2 |
0.5 GiB |
Configuration file
| Property |
Default |
| Path |
wsctl.json in the current working directory |
| AWS region |
Set during wsctl config init |
| AWS profile |
default if not specified |
| Identity provider |
Set during wsctl config init |
One directory per deployment
wsctl always reads wsctl.json from the current directory.
Keep separate directories for production / staging / lab
deployments to keep their config files isolated.
Timeouts
| Operation |
Typical duration |
Initial deploy (wsctl deploy all) |
10–15 min |
| Infrastructure server provisioning |
3–5 min |
| Egress server provisioning |
3–5 min |
| Region enablement (Web UI) |
5–10 min |
Hub configuration (wsctl hub) |
2–3 min |
IAM roles and policies
| Role |
ARN pattern |
| Orchestrator |
arn:aws:iam::<account>:role/waveshift_controller_role |
| Kasm host |
arn:aws:iam::<account>:role/waveshift_kasm_role |
| Infrastructure / egress servers |
arn:aws:iam::<account>:role/waveshift-pop-ec2-role |
| Shared access role |
arn:aws:iam::<account>:role/waveshift_access_role |
| SSM policy |
arn:aws:iam::<account>:policy/waveshift-ssm-policy |
| Instance profile |
Attached to |
waveshift_controller_profile |
Orchestrator EC2 |
waveshift_kasm_profile |
Kasm EC2 |
waveshift-pop-ec2-instance-profile |
Infrastructure and egress server EC2 (created by the orchestrator) |
DNS records
wsctl creates a private Route 53 hosted zone for the
deployment. The default zone name is waveshift.internal; you
can change it during the TUI but it doesn't need to be a domain
you own publicly — it only resolves inside the WireGuard network.
For the default zone:
| Record |
Type |
Target |
console.waveshift.internal |
A |
Orchestrator |
workspaces.waveshift.internal |
A |
Kasm host |
Clients connected via a Hub, a Node, or a direct WireGuard config
resolve these names through the VPC's DNS resolver. The
orchestrator never exposes a public HTTPS endpoint.
Object storage
| Bucket purpose |
Naming pattern |
| User files |
waveshift-filestore-{unix-timestamp} |
| Deployment assets |
waveshift-assets-{unix-timestamp} |
| Kasm persistent profiles |
{hhmmssddmmyy}-waveshift-workspaces-persistent-profiles |
| Setting |
Default |
| Encryption |
Enabled (SSE-S3) |
| Versioning |
Disabled |
| Public access |
Blocked |
| Default user storage quota |
Set in Storage administration |
CloudWatch logging
| Setting |
Default |
| CloudWatch Logs |
Enabled |
| Private DNS |
logs.<region>.amazonaws.com private hosted zone created in the VPC |
| Log retention |
AWS default (indefinite) |
Quick-reference card
Print-friendly summary
Default credentials
- Web Console:
admin / admin123
- Kasm Workspaces:
admin / Waveshift2025!
- Control Hub router:
root / Waveshift2025!
URLs
- Console:
https://console.waveshift.internal
- Kasm:
https://workspaces.waveshift.internal
wsctl proxy: https://localhost:8443 (Kasm :8444)
Networks
- VPC:
10.32.0.0/23
- Hub:
10.34.<site>.0/24 (first site: Hub IP 10.34.0.1)
Ports
- WireGuard:
51820/UDP
- SSH:
22/TCP
- HTTPS:
443/TCP
See also