Complete Deployment Guide

This is the master guide for deploying KyberGate. It covers every deployment method, helps you choose the right one for each part of your environment, and ends with a verification checklist.

If you're new to KyberGate, read this page top to bottom once, then follow the linked step-by-step articles for the methods you need.

The Big Picture

KyberGate filters web traffic three ways. Most schools use a combination, matched to their devices:

Rule of thumb: Use the proxy or agent on devices you manage. Use DNS filtering as a network-wide safety net for everything else. They work well together.

Your Organization ID

Almost every method needs your Organization ID. Find it under Settings → Workspace → Setup, or on the Devices → Add Device page (it's pre-filled into each platform's steps). It looks like a long string of letters and numbers.

Key URLs (per organization)

Replace YOUR_ORG_ID with your Organization ID:

• PAC (proxy auto-config): https://proxy.kybergate.com/api/pac/YOUR_ORG_ID
• Root CA certificate: https://proxy.kybergate.com/api/ca.pem
• Apple MDM profile (.mobileconfig): https://proxy.kybergate.com/api/mdm/YOUR_ORG_ID

Step 0: Before You Deploy

• Confirm you have the Admin role in KyberGate
• Know your device inventory (iPads, Chromebooks, Windows, macOS, unmanaged)
• Know your MDM (Jamf, Mosyle, Kandji, Google Admin, Intune) and your firewall/router
• Always start with a small test group — one OU or one VLAN — before rolling out school-wide

Step 1: Set Your Organization Basics

In Settings, confirm:

1. School Info — name, contact, logo (shown on your block page)
2. Schedule — school hours and bell schedule (drives time-based policies)
3. Network → Campus Network IPs — add your school's public IP(s). Required for DNS filtering, and used to identify on-campus devices for all methods. Visit whatismyip.com from your network to find your public IP.

Step 2: Choose and Deploy Your Filtering Method(s)

Path A — DNS Filtering (network-wide, fastest)

Best for guest networks, unmanaged devices, and a network-wide baseline.

1. Settings → Network → Campus Network IPs — register the public IP of each network you'll filter (required, or DNS requests are refused)
2. Point that network's DNS at your KyberGate DNS resolvers (on your firewall, router, or DHCP server)
3. Test on one network segment first

Full walkthrough: Setting Up DNS Filtering.

Blocked HTTPS sites on DNS filtering: Sites in a blocked category (gambling, adult, etc.) will show the browser's own "This site can't be reached" error rather than KyberGate's branded block page. This is expected — the site is blocked. A branded block page over HTTPS requires the device to trust KyberGate's inspection certificate, which happens with the proxy or agent below. On Chromebooks, the KyberGate Chrome extension also shows the branded block page in-browser.

Path B — iPads (Proxy via MDM)

Best for 1:1 managed iPads. Requires supervised devices (most school-enrolled iPads are supervised by default).

1. Download the configuration profile from Devices → Add Device → iPad, or use the profile URL: https://proxy.kybergate.com/api/mdm/YOUR_ORG_ID. This profile includes the proxy settings, root CA certificate, and anti-bypass restrictions.
2. Upload to your MDM and scope it to your iPads:
   • Jamf Pro: Devices → Configuration Profiles → + New → Upload → select the .mobileconfig → set Scope → Save
   • Mosyle: Management → Profiles → + Add new profile → iOS/iPadOS → Upload Custom Profile → assign to device groups → Save
   • Kandji: Library → Add New → Custom Profile → upload → assign to a Blueprint
3. Confirm the CA certificate is trusted. The MDM-pushed profile trusts it automatically on supervised devices. To verify: Settings → General → About → Certificate Trust Settings — the KyberGate CA toggle should be on.
4. (Optional) Install the KyberGate iOS Agent from the App Store for screen viewing and deeper monitoring.

For the full per-MDM walkthrough and dynamic device identification (email/UDID variables in the PAC URL), see Network and Proxy Settings.

Path C — Chromebooks (Extension + Proxy via Google Admin)

Best for 1:1 managed Chromebooks. This is a three-part setup: extension, certificate, and proxy.

1. Force-install the KyberGate extension (Google Admin → Devices → Chrome → Apps & extensions), set your Org ID in the extension's managed config
2. Upload the Root CA certificate and enable it for Chromebook (Devices → Networks → Certificates)
3. Configure the proxy PAC URL for your student OU's network

Full step-by-step: Deploying KyberGate on Chromebooks.

Path D — Windows (Device Agent)

Best for managed Windows 10/11 laptops and desktops.

1. Download KyberGateAgent.msi from Devices → Add Device → Windows. The installer configures the system proxy, installs the root CA, starts the monitoring service, and registers the device — no manual proxy setup.
2. Deploy using whichever fits your environment (your Org ID is the enrollment code):
   • Manual: double-click the MSI; if prompted, enter your Org ID. Device appears in ~1 minute, no reboot.
   • Intune: Apps → Windows → + Add → Line-of-business app → upload MSI → install argument ENROLLMENT_CODE=YOUR_ORG_ID → assign device groups
   • Group Policy (AD): GPMC → new GPO on the computer OU → Software Installation → assign the MSI (from a network share) → pass ENROLLMENT_CODE via an MST/Advanced properties → installs at next startup (reboot required)
   • SCCM/MECM: Create Application → MSI → install command msiexec /i KyberGateAgent.msi /qn ENROLLMENT_CODE=YOUR_ORG_ID → deploy to a Device Collection as Required

See Enrolling Windows Devices for details.

Path E — macOS (Device Agent)

Best for managed Macs.

1. Download the KyberGate macOS agent from your dashboard
2. Deploy via your MDM (custom package) or run the installer on the device — it auto-configures the proxy and trusts the inspection certificate
3. Verify the device reports under Fleet

See Enrolling macOS Devices with KyberGate Agent.

Step 3: Connect Your Roster (Recommended)

For per-user policies and student safety monitoring, connect your user directory:

• Google Workspace: Settings → Workspace — set your domain, complete domain-wide delegation, and choose which OUs to sync. See Google Workspace Integration.
• Clever / ClassLink: See Clever SSO Integration and ClassLink Integration.

Once users are synced and signing into devices, KyberGate associates each device with its user and applies that user's policy.

Step 4: Configure Your Policies

• Filtering — pick a policy template or customize blocked categories
• Block Page — customize with your school's name, logo, and contact (Settings → Block Page). See Block Page Customization.
• Schedule — apply different rules during vs. after school hours
• KyberPulse (optional) — turn on student safety scanning. See Setting Up KyberPulse Notifications.

Step 5: Verify Your Deployment

Run this on a test device for each method you deployed:

• [ ] Device appears under Fleet/Devices (proxy/agent), or resolves through KyberGate DNS (DNS method)
• [ ] A normal site (e.g. wikipedia.org) loads
• [ ] A blocked-category site is blocked (branded page on proxy/agent/Chromebook extension; browser "can't be reached" on DNS for HTTPS)
• [ ] A quick test: tiktok.com should be blocked; khanacademy.org should be allowed
• [ ] Google/Bing/YouTube are locked to SafeSearch
• [ ] The correct user shows next to the device (if roster is synced)
• [ ] Activity appears under Reports within a few minutes

Rolling Out School-Wide

Once your test group looks right:

1. Expand one OU / VLAN at a time
2. Watch Reports and the Fleet view for coverage gaps
3. Keep DNS filtering on your guest network as a permanent baseline

Common First-Day Questions

"A blocked HTTPS site shows a browser error, not the KyberGate block page." Expected on DNS filtering — the site is blocked. Use the proxy or agent (or the Chrome extension on Chromebooks) for a branded block page on HTTPS.

"My device isn't showing up in the dashboard." See Device Not Appearing in Dashboard. For DNS, confirm your public IP is registered under Settings → Network.

"Some HTTPS sites aren't being filtered by content." Confirm the KyberGate certificate is installed and trusted on the device. See Certificate Installation Issues and HTTPS Sites Not Being Filtered.

"Can I use more than one method at once?" Yes — that's the recommended setup. DNS filtering as a network baseline, plus proxy/agent on managed devices.

Need help with your specific setup? Open the live chat in your dashboard (bottom-right) — it goes to a real person on our team.