FOG is a free and open-source computer imaging platform. It can capture a reference computer, store the image on a central server, and deploy that image to other computers over the network.

This guide installs the stable FOG release on a dedicated Ubuntu 24.04 LTS server. It assumes that an existing router or Windows/Linux DHCP server assigns addresses to clients. If FOG will provide DHCP instead, select that option during installation and make sure no other DHCP server is active on the same network.

Official references:

• FOG installation guide
• FOG DHCP settings
• FOG firewall requirements
• FOG security guidance
• FOG source repository

Environment

The examples use the following values. Replace them with addresses and names from your network.

Use a dedicated server or virtual machine with a static address, reliable storage, and at least a gigabit network connection. Size /images for the number and size of the images you plan to retain. RAID and tested backups are recommended for production installations.

FOG relies on PXE, TFTP, HTTP, NFS, and related services. Place it on a trusted imaging VLAN rather than exposing it directly to the Internet.

Plan the Network

Before installing FOG, confirm the following:

1. The server has a static address and working forward and reverse DNS where possible.
2. Only one DHCP server will be active on the imaging network.
3. You know whether the clients use legacy BIOS, 64-bit UEFI, ARM64 UEFI, or a mixture.
4. DHCP relay or IP helper settings can reach the required DHCP and FOG services when clients are on another subnet.
5. The imaging VLAN permits the required unicast and multicast traffic.

Do not create a local Linux account named fogproject. The FOG installer manages its own service accounts and credentials.

Prepare Ubuntu 24.04 LTS

Update the server and reboot it before installation.

sudo apt update
sudo apt full-upgrade -y
sudo systemctl reboot

After reconnecting, verify the hostname, address, route, time, and available storage.

hostnamectl
ip -brief address
ip route
timedatectl
df -h /

If the server still uses DHCP, assign a static address through your network management system or Netplan. The following example is for a directly configured Ethernet interface. Run sudo netplan try from a local console so that an incorrect network configuration can be rolled back safely.

sudoedit /etc/netplan/01-fog.yaml

network:
  version: 2
  ethernets:
    enp1s0:
      dhcp4: false
      addresses: [192.168.50.10/24]
      routes:
        - to: default
          via: 192.168.50.1
      nameservers:
        addresses: [192.168.50.2, 1.1.1.1]
        search: [example.com]

Test and apply the configuration.

sudo netplan try
sudo netplan apply

Install Git and the certificate bundle. Do not preinstall Apache, MariaDB, PHP, TFTP, NFS, or FTP packages; the FOG installer installs and configures the versions it requires.

sudo apt install -y git ca-certificates

Download and Install FOG

The stable branch receives the latest supported patch releases and is the recommended branch for most installations. Development and working branches may contain unfinished changes.

Become root, clone the stable branch, review the latest commit, and start the installer.

sudo -i
cd /root
git clone --branch stable --single-branch https://github.com/FOGProject/fogproject.git fogproject-stable
git -C /root/fogproject-stable log -1 --oneline
cd /root/fogproject-stable/bin
./installfog.sh

Answer the installer prompts carefully:

1. Select Normal Server unless this machine will only add storage capacity to an existing FOG installation.
2. Confirm Ubuntu as the operating system.
3. Select the interface connected to the imaging network.
4. Confirm the server address, gateway, and hostname.
5. If another device already provides DHCP, answer No when asked whether FOG should provide DHCP. Configure that existing DHCP server in the next section.
6. Decide whether to enable HTTPS after reviewing the installer notes for your FOG version. In the stable 1.5 series, HTTPS and the network boot chain are linked, so this choice can affect Secure Boot compatibility.
7. Review the summary before allowing the installer to make changes.

During installation, the script pauses and asks you to update the database schema. Open the management URL printed in the terminal, select Install/Update Now, wait for it to finish, and then return to the terminal and press Enter.

When the installer completes, open the displayed management URL. If the installation still uses the documented default login, sign in with fog and password, then change the password immediately.

The installer stores its settings in /opt/fog/.fogsettings. This file may contain database and service credentials, so restrict access to it and include it in a protected backup.

Configure an Existing DHCP Server

When DHCP runs on another server, configure these PXE options for the imaging scope:

• Option 66 / next-server: the FOG server address, such as 192.168.50.10.
• Option 67 / boot file: the correct boot file for the client architecture.

Use the following current FOG boot files:

A single scope-wide Option 67 cannot correctly serve a mixture of legacy BIOS and UEFI computers. Create DHCP policies or classes that select the boot file from the PXE client architecture reported in the DHCP request.

Do not set DHCP Option 60 unless Windows Deployment Services and DHCP run on the same Windows server and the design specifically requires it. An unnecessary Option 60 can prevent UEFI clients from booting.

If the existing DHCP server cannot set PXE options, use FOG’s documented ProxyDHCP configuration. For clients on another subnet, configure the router’s DHCP relay or IP helper to forward requests to the DHCP server and the relevant FOG or ProxyDHCP service.

Check the Firewall

Recent FOG installers can configure the host firewall, but you should verify the result. Keep the rules limited to the trusted imaging network whenever possible.

sudo ufw status verbose
sudo ss -lntup

The official FOG firewall guide currently requires the following access from imaging clients:

Ubuntu’s firewall also needs the TFTP connection-tracking helper. Load it now and at startup.

echo nf_conntrack_tftp | sudo tee /etc/modules-load.d/fog-conntrack.conf
sudo modprobe nf_conntrack_tftp

If UFW is enabled and the installer did not add the rules, add source-restricted rules for the example imaging network.

sudo ufw allow from 192.168.50.0/24 to any port 80 proto tcp comment 'FOG HTTP'
sudo ufw allow from 192.168.50.0/24 to any port 443 proto tcp comment 'FOG HTTPS'
sudo ufw allow from 192.168.50.0/24 to any port 69 proto udp comment 'FOG TFTP'
sudo ufw allow from 192.168.50.0/24 to any port 21 proto tcp comment 'FOG FTP'
sudo ufw allow from 192.168.50.0/24 to any port 65000:65100 proto tcp comment 'FOG passive FTP'
sudo ufw allow from 192.168.50.0/24 to any port 2049 proto tcp comment 'FOG NFS'
sudo ufw allow from 192.168.50.0/24 to any port 111 proto tcp comment 'FOG RPC TCP'
sudo ufw allow from 192.168.50.0/24 to any port 111 proto udp comment 'FOG RPC UDP'
sudo ufw allow from 192.168.50.0/24 to any port 20048 proto tcp comment 'FOG mountd TCP'
sudo ufw allow from 192.168.50.0/24 to any port 20048 proto udp comment 'FOG mountd UDP'
sudo ufw allow from 192.168.50.0/24 to any port 63100:63228 proto udp comment 'FOG multicast'
sudo ufw reload

Open UDP 67 only when this FOG server provides DHCP. DHCP discovery begins before a client has an address, so this rule should not be limited to the example source subnet.

sudo ufw allow 67/udp comment 'FOG DHCP'

Do not expose MariaDB port 3306 to the whole network. If a remote FOG storage node needs database access, allow only that node’s address and follow the current storage-node documentation.

Verify the Installation

Check the web interface, listening services, NFS exports, and the required boot files.

curl -I http://127.0.0.1/fog/management/
sudo systemctl --type=service --state=running | grep -E 'apache2|mariadb|mysql|tftp|nfs|vsftpd'
sudo exportfs -v
ls -l /tftpboot/undionly.kkpxe /tftpboot/secureboot/snponly-shimx64.efi

Boot one test computer from the network. A successful initial test should:

1. Receive an address from DHCP.
2. Download the correct BIOS or UEFI boot file from FOG.
3. Display the FOG iPXE menu.
4. Register with the server and appear in the web interface.

Capture and Deploy an Image

Create an image definition in Images, register the reference computer, associate it with the image, and schedule a capture task. Prepare Windows reference systems before capture by installing updates, removing temporary data, and using Sysprep when the image will be deployed to multiple machines.

Fully decrypt BitLocker-protected volumes before capturing an image that must be resizable. Shut Windows down completely so that Fast Startup or hibernation does not leave the filesystem in an inconsistent state.

Test the first deployment on a disposable computer. A capture task reads the reference computer and writes an image to the server; a deploy task overwrites the target computer’s disk. Confirm the task direction and target before starting it.

Update FOG

Back up the FOG database, /images, and /opt/fog/.fogsettings before an upgrade. Update the local stable checkout and rerun the installer.

sudo -i
cd /root/fogproject-stable
git fetch origin
git checkout stable
git pull --ff-only origin stable
cd bin
./installfog.sh

Complete any database schema update shown in the browser, then repeat the PXE and test-deployment checks. Stay on the stable branch unless you are deliberately testing a development release in a non-production environment.

Troubleshooting

The Web Interface Does Not Open

Check Apache, the local URL, and the web server log.

sudo systemctl status apache2 --no-pager
curl -I http://127.0.0.1/fog/management/
sudo journalctl -u apache2 -n 100 --no-pager

The Client Gets an Address but Does Not Download a Boot File

Verify DHCP Options 66 and 67, confirm that the selected boot file exists, and inspect the TFTP service.

ls -l /tftpboot
sudo systemctl status tftpd-hpa --no-pager
sudo journalctl -u tftpd-hpa -n 100 --no-pager

For mixed BIOS and UEFI fleets, confirm that the DHCP architecture policy selects the correct file rather than assigning one file to every client.

Imaging Starts but Cannot Access Storage

Check the NFS exports, RPC services, routes, and firewall rules for TCP 2049 and TCP/UDP 111 and 20048.

sudo exportfs -v
sudo rpcinfo -p localhost
sudo journalctl -u nfs-server -n 100 --no-pager

The Installer Fails

Review the installer logs in the cloned repository. The main log is normally stored under /root/fogproject-stable/bin/error_logs/.

sudo ls -lah /root/fogproject-stable/bin/error_logs
sudo less /root/fogproject-stable/bin/error_logs/foginstall.log

Correct the reported problem and rerun /root/fogproject-stable/bin/installfog.sh. Avoid manually replacing individual FOG-managed packages unless the official documentation directs you to do so.