How to Set Up DoubleZero on a Solana Validator
Running a blockchain validator on the public internet means competing for bandwidth with billions of users and sudden surges in data flow. For validators, where milliseconds determine block production and rewards, this congestion becomes a serious bottleneck.
DoubleZero addresses this issue by creating a fast, private network dedicated to distributed systems. Instead of routing data through multiple public points, DoubleZero uses dedicated fiber links where only valid blockchain data flows. This creates a direct path between validators that drastically reduces latency.
This tutorial shows how to set up DoubleZero on a Solana validator running on an Ubuntu system.
#What is DoubleZero?
DoubleZero is a private internet built specifically for distributed systems like blockchain. It is a physical network infrastructure utilizing existing dedicated fiber-optic connections contributed by independent network providers, which connects validators directly to each other. It gives validators a faster and cleaner way to move data. Instead of relying on the public internet, it builds a private path where traffic is more predictable and less crowded. Its system cuts down on spam, reduces repeated messages, and helps nodes communicate with far less delay.
DoubleZero coordinates contributions of underutilized fiber capacity from network contributors who own or lease dedicated fiber links. It’s like building a subway system underneath a traffic-jammed city. While everyone else is stuck in gridlock up above, DoubleZero traffic is moving underground, uninterrupted, at full speed.
#How Does DoubleZero Work?
DoubleZero uses a dual-ring architecture to separate traffic filtration from data transmission.
-
The Outer Ring (Edge Filtration): The Outer Ring is the network's entry point. Here, DoubleZero uses specialized hardware (Field Programmable Gate Arrays (FPGAs)) to inspect all incoming internet traffic. This hardware filters spam, blocks DDoS attacks, and deletes duplicate transactions at line speed.
By stopping interference at the gate, DoubleZero ensures only valid, unique packets enter the network. This saves your validator's CPU power from being wasted on filtering junk.
-
The Inner Ring (Dedicated Fiber): Once the data is cleaned, it enters the Inner Ring. This is a private fiber-optic network. Because the data is already verified and spam-free, it moves across the network at light speed.
DoubleZero uses a technique called multicast, which works like a radio broadcast. Instead of sending a block of data sequentially to Validator A, then B, then C, it broadcasts the block to all validators simultaneously. Your validator, located safely inside the Inner Ring, receives only clean, valid data instantly. The result is a faster, more stable connection that supports higher performance and more reliable block production.
#Prerequisites
Before installing, please ensure your system meets the following requirements.
-
Your server needs a public IP address. NAT is not supported.
-
A 64-bit (x86_64) Intel or AMD server is required.
-
Ubuntu 22.04+, Debian 11+, or Rocky Linux/RHEL 8+.
-
rootorsudoprivileges. -
The Solana CLI must be installed and accessible in your system's
$PATH. -
Your validator must be active in the leader schedule to connect as a primary node.
-
The
soluser needs read access to yourvalidator-keypair.jsonfile. -
Your validator's identity keypair must hold a balance of at least 1 SOL.
-
Your firewall must permit outbound connections for:
-
GRE (IP protocol 47)
Note: If running on cloud providers, ensure the platform supports GRE (IP protocol 47). Many managed clouds do not.
-
BGP (TCP port 179 to
169.254.0.0/16) -
DoubleZero and Solana RPC ports.
-
-
Optional Tools:
jqandcurlare recommended for setup and debugging.
For this demonstration, a server from Cherry Servers will be used. While DoubleZero works with any cloud vendor, latency is lowest via a direct interconnect. Standard providers require a tunnel over the public internet to reach the nearest DoubleZero entry node. This creates an unavoidable delay during the first stage of transmission.
In contrast, Cherry Servers is a network contributor with DoubleZero hardware installed directly in their data centers. Deploying here creates a direct cross-connect that bypasses the public internet entirely. Your data reaches the DoubleZero network almost instantly, ensuring the most stable and consistent block propagation.
Set up your Solana server in minutes
Optimize cost and performance with a pre-configured or custom dedicated bare metal server for blockchain workloads. High uptime, instant 24/7 support, pay in crypto.
#How to Set Up DoubleZero
This guide walks you through installing and connecting to DoubleZero. DoubleZero must be installed directly on your validator host and not in a container. Ensure you have met all prerequisites before beginning the steps below.
#Step 1: Update your system packages
Before installing new software, ensure your existing system packages are current. This process prevents compatibility issues and applies the latest security patches to your OS.
Run the following command to refresh your package list and apply updates:
sudo apt update && sudo apt upgrade -y
OutputHit:1 http://security.ubuntu.com/ubuntu noble-security InRelease
Hit:2 http://us.archive.ubuntu.com/ubuntu noble InRelease
Hit:3 http://archive.ubuntu.com/ubuntu noble InRelease
Hit:4 http://us.archive.ubuntu.com/ubuntu noble-updates InRelease
Hit:5 http://archive.ubuntu.com/ubuntu noble-updates InRelease
Hit:6 http://us.archive.ubuntu.com/ubuntu noble-security InRelease
Hit:7 http://archive.ubuntu.com/ubuntu noble-backports InRelease
Hit:8 http://us.archive.ubuntu.com/ubuntu noble-backports InRelease
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
All packages are up to date.
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
Calculating upgrade... Done
The following packages were automatically installed and are no longer required:
grub-pc-bin linux-headers-6.8.0-88 linux-headers-6.8.0-88-generic linux-image-6.8.0-88-generic linux-modules-6.8.0-88-generic
linux-modules-extra-6.8.0-88-generic linux-tools-6.8.0-88 linux-tools-6.8.0-88-generic
Use 'sudo apt autoremove' to remove them.
0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
#Step 2: Install DoubleZero packages
DoubleZero is distributed via Cloudsmith. Using this official repository ensures you receive stable builds and makes future updates easier to manage.
First, add the repository to your system:
curl -1sLf https://dl.cloudsmith.io/public/malbeclabs/doublezero-testnet/setup.deb.sh | sudo -E bash
OutputExecuting the setup script for the 'malbeclabs/doublezero' repository ...
OK: Checking for required executable 'curl' ...
OK: Checking for required executable 'apt-get' ...
OK: Detecting your OS distribution and release using system methods ...
^^^^: ... Detected/provided for your OS/distribution, version and architecture:
>>>>:
>>>>: ... distro=ubuntu version=24.04 codename=noble arch=x86_64
>>>>:
OK: Checking for apt dependency 'apt-transport-https' ...
OK: Checking for apt dependency 'ca-certificates' ...
OK: Checking for apt dependency 'gnupg' ...
OK: Checking for apt signed-by key support ...
OK: Importing 'malbeclabs/doublezero' repository GPG keys ...
OK: Checking if upstream install config is OK ...
OK: Installing 'malbeclabs/doublezero' repository via apt ...
OK: Updating apt repository metadata cache ...
OK: The repository has been installed successfully - You're ready to rock!
Next, install the latest stable version of DoubleZero:
sudo apt-get install doublezero
To install a specific version instead, use the following format (e.g., for version 0.8.0-1 ):
sudo apt-get install doublezero=0.8.0-1
OutputReading package lists... Done
Building dependency tree... Done
Reading state information... Done
The following packages were automatically installed and are no longer required:
grub-pc-bin linux-headers-6.8.0-88 linux-headers-6.8.0-88-generic linux-image-6.8.0-88-generic linux-modules-6.8.0-88-generic
linux-modules-extra-6.8.0-88-generic linux-tools-6.8.0-88 linux-tools-6.8.0-88-generic
Use 'sudo apt autoremove' to remove them.
The following additional packages will be installed:
doublezero-solana
The following NEW packages will be installed:
doublezero doublezero-solana
0 upgraded, 2 newly installed, 0 to remove and 0 not upgraded.
Need to get 24.0 MB of archives.
After this operation, 53.5 MB of additional disk space will be used.
Do you want to continue? [Y/n] Y
Get:1 https://dl.cloudsmith.io/public/malbeclabs/doublezero/deb/ubuntu noble/main amd64 doublezero-solana amd64 0.3.2-1 [5,046 kB]
Get:2 https://dl.cloudsmith.io/public/malbeclabs/doublezero/deb/ubuntu noble/main amd64 doublezero amd64 0.8.0-1 [19.0 MB]
Fetched 24.0 MB in 3s (8,743 kB/s)
Selecting previously unselected package doublezero-solana.
(Reading database ... 232088 files and directories currently installed.)
Preparing to unpack .../doublezero-solana_0.3.2-1_amd64.deb ...
Unpacking doublezero-solana (0.3.2-1) ...
Selecting previously unselected package doublezero.
Preparing to unpack .../doublezero_0.8.0-1_amd64.deb ...
Unpacking doublezero (0.8.0-1) ...
Setting up doublezero-solana (0.3.2-1) ...
Setting up doublezero (0.8.0-1) ...
Created symlink /etc/systemd/system/multi-user.target.wants/doublezerod.service → /usr/lib/systemd/system/doublezerod.service.
/usr/sbin/policy-rc.d returned 101, not running 'restart doublezerod.service'
Scanning processes...
Scanning candidates...
Scanning processor microcode...
Scanning linux images...
The installation creates a systemd service called doublezerod. However, the service might not start automatically after installation.
Check the service status:
sudo systemctl status doublezerod
Output○ doublezerod.service - DoubleZero client
Loaded: loaded (/usr/lib/systemd/system/doublezerod.service; enabled; preset: enabled)
Active: inactive (dead)
If the status is inactive (dead), start the service manually:
sudo systemctl start doublezerod
Check the status again to confirm it’s now active (running):
sudo systemctl status doublezerod
Output● doublezerod.service - DoubleZero client
Loaded: loaded (/usr/lib/systemd/system/doublezerod.service; enabled; preset: enabled)
Drop-In: /etc/systemd/system/doublezerod.service.d
└─override.conf
Active: active (running) since Sat 2025-12-13 22:15:09 UTC; 12s ago
Main PID: 185859 (doublezerod)
Tasks: 19 (limit: 463457)
Memory: 19.6M (peak: 22.4M)
CPU: 78ms
CGroup: /system.slice/doublezerod.service
└─185859 /usr/bin/doublezerod -sock-file /run/doublezerod/doublezerod.sock -env testnet
Dec 13 22:15:09 ubuntu systemd[1]: Started doublezerod.service - DoubleZero client.
Dec 13 22:15:09 ubuntu doublezerod[185859]: {"time":"2025-12-13T22:15:09.851625786Z","level":"INFO","msg":"network: starting network manager"}
Dec 13 22:15:09 ubuntu doublezerod[185859]: {"time":"2025-12-13T22:15:09.851951097Z","level":"INFO","msg":"bgp: starting bgp fsm"}
Dec 13 22:15:09 ubuntu doublezerod[185859]: {"time":"2025-12-13T22:15:09.852120908Z","level":"INFO","msg":"http: starting api manager"}
#Step 3: Open port 44880
Next, open port 44880 to allow DoubleZero’s liveness checks. This lets peers verify routes are working through the network.
If you are using UFW, run:
sudo ufw allow in on doublezero0 to any port 44880 proto udp
sudo ufw allow out on doublezero0 to any port 44880 proto udp
If you're using iptables, apply the same rules by running:
sudo iptables -A INPUT -i doublezero0 -p udp --dport 44880 -j ACCEPT
sudo iptables -A OUTPUT -o doublezero0 -p udp --dport 44880 -j ACCEPT
These rules apply only to the DoubleZero network interface and do not expose your public network interface.
#Step 4: Generate your DoubleZero identity
Next, you need a DoubleZero identity to interact with the network.
First, create the DoubleZero configuration directory where your identity file (id.json) will be stored:
mkdir -p ~/.config/doublezero
Next, generate a new DoubleZero identity:
doublezero keygen
OutputPubkey: 1sdA55v6QrXbeV26bfK536ktatXzsBSZq4wSvs7SzsS
Finally, confirm the key was created correctly by retrieving your address:
doublezero address
The output should match the public key shown in the previous step.
1sdA55v6QrXbeV26bfK536ktatXzsBSZq4wSvs7SzsS
#Step 5: Verify network connectivity
Before connecting, confirm that the doublezerod daemon has discovered and can ping the available network switches.
Test connectivity to the global DoubleZero Exchange (DZX) devices:
doublezero latency
Pubkey | Code | IP | Min | Max | Avg | reachable
6E1fuqbDBG5ejhYEGKHNkWG5mSTczjy4R77XCKEdUtpb | nyc-dz001 | 64.86.249.22 | 17.62ms | 17.70ms | 17.65ms | true
CT8mP6RUoRcAB67HjKV9am7SBTCpxaJEwfQrSjVLdZfD | lax-dz001 | 207.45.216.134 | 53.51ms | 53.54ms | 53.53ms | true
Cpt3doj17dCF6bEhvc7VeAuZbXLD88a1EboTyE8uj6ZL | lon-dz001 | 195.219.120.66 | 87.49ms | 87.55ms | 87.53ms | true
4Wr7PQr5kyqCNJo3RKa8675K7ZtQ6fBUeorcexgp49Zp | ams-dz001 | 195.219.138.50 | 90.94ms | 90.99ms | 90.96ms | true
hWffRFpLrsZoF5r9qJS6AL2D9TEmSvPUBEbDrLc111Y | fra-dz-001-x | 195.12.227.250 | 100.49ms | 100.57ms | 100.53ms | true
29ghthsKeH2ZCUmN2sUvhJtpEXn2ZxqAuq4sZFBFZmEs | fra-dz001 | 195.219.220.58 | 100.90ms | 100.93ms | 100.92ms | true
8jyamHfu3rumSEJt9YhtYw3J4a7aKeiztdqux17irGSj | prg-dz-001-x | 195.12.228.250 | 110.60ms | 110.70ms | 110.64ms | true
5tqXoiQtZmuL6CjhgAC6vA49JRUsgB9Gsqh4fNjEhftU | tyo-dz001 | 180.87.154.78 | 153.05ms | 153.13ms | 153.10ms | true
D3ZjDiLzvrGi5NJGzmM7b3YZg6e2DrUcBCQznJr3KfC8 | sin-dz001 | 180.87.102.98 | 204.53ms | 204.62ms | 204.58ms | true
6M72Wm35TvyhyqiN1GjaN2KVmq4ihYEPSexE4RsYq9kZ | lon-test-tve1 | 178.242.19.43 | 0.00ms | 0.00ms | 0.00ms | false
4gK6BJ14TBSdSaAFLJyWaiZFkuxztvWzBz2suUSTKMYo | ams-test-tve1 | 178.240.19.43 | 0.00ms | 0.00ms | 0.00ms | false
2c4bFe3Wqd1PHoRBes9Zh36DAM8g6v3AuA39vrimBEUq | fra-test-tve1 | 178.241.19.43 | 0.00ms | 0.00ms | 0.00ms | false
#Step 6: Verify connection state
Next, check that no stale tunnels are currently open. This ensures a clean slate for your new connection.
Run the status command to view your current connection state:
doublezero status
OutputTunnel Status | Last Session Update | Tunnel Name | Tunnel Src | Tunnel Dst | Doublezero IP | User Type | Current Device | Lowest Latency Device | Metro | Network
disconnected | no session data | | | | | | N/A | nyc-dz001 | N/A | testnet
If the status shows as disconnected, you are ready to proceed. If a tunnel is currently active, disconnect it before continuing:
doublezero disconnect
#Step 7: Configure the environment
You need to point your daemon to the correct network. For this guide, Testnet will be used, but you can also use Mainnet-Beta. This tells your DoubleZero Client where to operate.
Run this command to configure the daemon for testnet:
DESIRED_DOUBLEZERO_ENV=testnet \
&& sudo mkdir -p /etc/systemd/system/doublezerod.service.d \
&& echo -e "[Service]\nExecStart=\nExecStart=/usr/bin/doublezerod -sock-file /run/doublezerod/doublezerod.sock -env $DESIRED_DOUBLEZERO_ENV" | sudo tee /etc/systemd/system/doublezerod.service.d/override.conf > /dev/null \
&& sudo systemctl daemon-reload \
&& sudo systemctl restart doublezerod \
&& doublezero config set --env $DESIRED_DOUBLEZERO_ENV > /dev/null \
&& echo "✅ doublezerod configured for environment $DESIRED_DOUBLEZERO_ENV"
Note: This override replaces the default service configuration. After upgrading DoubleZero, review /usr/lib/systemd/system/doublezerod.service to check if the default configuration changed.
Output✅ doublezerod configured for environment testnet
Note: After restarting the daemon, it needs about 30-60 seconds to discover available DoubleZero devices. You can continue to the next step while this happens in the background.
#Step 8: Link your Solana identity
To use the IBRL (Increase Bandwidth, Reduce Latency), you must prove ownership of an active validator.
First, locate your validator on-chain to verify its status:
doublezero-solana passport find-validator -ut
This verifies that your Validator ID is active in the gossip network and present in the leader schedule.
OutputDoubleZero Passport - Find Validator
Connected to Solana: testnet
DoubleZero ID: 1sdA55v6QrXbeV26bfK536ktatXzsBSZq4wSvs7SzsS
Detected public IP: 84.32.32.110
Validator ID: BbjLw9hSG1sPQydnfjafWZW9s47qeAA3YxrSdayuUuVu
Gossip IP: 84.32.32.110
In Leader scheduler
✅ This validator can connect as a primary in DoubleZero 🖥️ 💎. It is a leader scheduled validator.
#Step 9: Prepare the connection
Generate an access request using your DoubleZero address and primary validator ID.
Run this on your primary validator machine (the one with active stake that's visible in Solana gossip):
doublezero-solana passport prepare-validator-access -ut \
--doublezero-address <YOUR_DOUBLEZERO_ADDRESS> \
--primary-validator-id <YOUR_VALIDATOR_ID>
OutputDoubleZero Passport - Prepare Validator Access Request
Connected to Solana: testnet
DoubleZero Address: 1sdA55v6QrXbeV26bfK536ktatXzsBSZq4wSvs7SzsS
Primary validator 🖥️ 💎:
ID: BbjLw9hSG1sPQydnfjafWZW9s47qeAA3YxrSdayuUuVu
Gossip: ✅ OK (84.32.32.110)
Leader scheduler: ✅ OK
To request access, sign the following message with your validator's identity key:
solana sign-offchain-message \
service_key=1sdA55v6QrXbeV26bfK536ktatXzsBSZq4wSvs7SzsS \
-k <identity-keypair-file.json>
#Step 10: Generate signature
Next, sign a message using your validator's identity keypair. Copy the command from the previous step's output. Replace <identity-keypair-file.json> with the actual path to your keypair and <YOUR_DOUBLEZERO_ADDRESS> with your DoubleZero address:
solana sign-offchain-message \
service_key=<YOUR_DOUBLEZERO_ADDRESS> \
-k <identity-keypair-file.json>
The output will be a long string, which is your signature.
Output3yiZNuwtmiYiGjainynwkrTGvjK7kf9XcQnohg1RLcmX6L7qADcyptDU1NA6yPTEssoSZPKcD5UiRueaJtuWApwz
#Step 11: Request validator access pass
Use the signature from Step 9 to request your validator access pass. This step funds your account with initial DoubleZero credits once the pass is successfully created, which you'll need to establish a connection.
Run the following command to initiate your connection request on DoubleZero. Replace the placeholders with your actual values, including the signature from Step 9:
doublezero-solana passport request-validator-access \
-k <identity-keypair-file.json> \
-ut \
--primary-validator-id <YOUR_VALIDATOR_ID> \
--doublezero-address <YOUR_DOUBLEZERO_ADDRESS> \
--signature <YOUR_GENERATED_SIGNATURE>
The command will return a request ID upon success.
OutputRequest Solana validator access: 614JjCSixyw5PffqNEqXeuStgU7tbL1yAv5xDGtG2rm9xjtCdhMK5qtg9t23UxCVdoxPzckfMojtRfKLrKn14fvG
Verify your DoubleZero balance was credited:
doublezero balance
Output0.01098544 Credits
Your balance should now show credits greater than zero. These are DoubleZero network credits (not SOL) used to facilitate platform operations. You're ready to connect.
#Step 12: Connect in IBRL mode
IBRL (Increase Bandwidth, Reduce Latency) is DoubleZero's default connection mode. With your access pass created, you can now connect.
Run the connect command:
doublezero connect ibrl
DoubleZero Service Provisioning
🔗 Start Provisioning User...
Public IP detected: 84.32.32.110 - If you want to use a different IP, you can specify it with `--client-ip x.x.x.x`
🔍 Provisioning User for IP: 84.32.32.110
User account created
Connected to device: nyc-dz001
Service provisioned with status: ok
✅ User Provisioned
Now check your connection status:
doublezero status
OutputTunnel Status | Last Session Update | Tunnel Name | Tunnel Src | Tunnel Dst | Doublezero IP | User Type | Current Device | Lowest Latency Device | Metro | Network
up | 2025-12-18 14:43:22 UTC | doublezero0 | 84.32.32.110 | 64.86.249.22 | 84.32.32.110 | IBRL | nyc-dz001 | ✅ nyc-dz001 | New York | testnet
A status of up means you're successfully connected.
You can also view routes propagated by other DoubleZero users:
ip route
Outputdefault via 84.32.32.97 dev bond0 proto static
5.39.251.201 via 169.254.2.80 dev doublezero0 proto bgp src 84.32.32.110
5.151.82.133 via 169.254.2.80 dev doublezero0 proto bgp src 84.32.32.110
5.151.82.214 via 169.254.2.80 dev doublezero0 proto bgp src 84.32.32.110
5.187.35.28 via 169.254.2.80 dev doublezero0 proto bgp src 84.32.32.110
5.199.161.197 via 169.254.2.80 dev doublezero0 proto bgp src 84.32.32.110
5.199.172.194 via 169.254.2.80 dev doublezero0 proto bgp src 84.32.32.110
5.255.78.21 via 169.254.2.80 dev doublezero0 proto bgp src 84.32.32.110
10.184.69.0/24 dev bond0.3244 proto kernel scope link src 10.184.69.17
31.172.68.190 via 169.254.2.80 dev doublezero0 proto bgp src 84.32.32.110
37.59.20.52 via 169.254.2.80 dev doublezero0 proto bgp src 84.32.32.110
37.122.252.22 via 169.254.2.80 dev doublezero0 proto bgp src 84.32.32.110
38.46.222.221 via 169.254.2.80 dev doublezero0 proto bgp src 84.32.32.110
38.46.223.227 via 169.254.2.80 dev doublezero0 proto bgp src 84.32.32.110
38.46.223.238 via 169.254.2.80 dev doublezero0 proto bgp src 84.32.32.110
38.58.177.50 via 169.254.2.80 dev doublezero0 proto bgp src 84.32.32.110
38.58.177.52 via 169.254.2.80 dev doublezero0 proto bgp src 84.32.32.110
38.92.24.98 via 169.254.2.80 dev doublezero0 proto bgp src 84.32.32.110
45.134.108.155 via 169.254.2.80 dev doublezero0 proto bgp src 84.32.32.110
45.134.108.157 via 169.254.2.80 dev doublezero0 proto bgp src 84.32.32.110
....
#Conclusion
By following this guide, you've installed DoubleZero, generated your identity, linked your validator, and established your IBRL connection. Your validator is now live on the network.
For increased redundancy, you can add backup validators using the --backup-validator-ids flag. You can also enable Prometheus metrics to monitor your connection health in Grafana. Both procedures are detailed in the official documentation.
