CTFBox Configuration Editor

Wireguard Settings

Wireguard Port

Wireguard Profiles

Server Address (Required)

DNS Server

Time Settings

Start Time (Optional) Uses your current time zone

End Time (Optional) Uses your current time zone

Grace Time

Tick Time (seconds)

Server Settings

VM Mode Incus is recommended. (Note: Incus is managed internally, no installation required).

Gameserver Token (Optional)

Debug Mode

Gameserver Options

Expose Gameserver

Credential Server Options

Enable Credential Server

Game Settings

Flag Expire Ticks

Initial Service Score

Max Flags Per Request

Submission Timeout

Resource Settings

Network Limit Bandwidth

Max VM CPUs

Max VM Memory

Team Configuration

Number of Teams

Enable NOP Team

0 teams configured

Configuration Preview

// Configuration will be shown here when you modify settings

Pre-Grace

Grace Period

Competition

Post-End

-∞ Start Time - Grace Start Time End Time

Grace Time Explained

Grace time is a preparation period before the competition officially begins, allowing teams to set up their infrastructure without attacks.

Frozen Network

When: Before start_time - grace_time

Access: Players can only connect to the gameserver, not to any VMs

Locked Network (Grace Period)

When: Between start_time - grace_time and start_time

Access: Teams can only access their own VMs, not other teams' services

Unlocked Network (Competition)

When: Between start_time and end_time

Access: Full network access, teams can attack other teams' services

Finished

When: After end_time

Access: Teams can only access their own VMs, competition is over

Note: If no start_time is set, the competition starts after grace_time seconds from CTFBox startup.

VM Mode Options

These settings control how team services are deployed and managed on the CTFBox server.

Incus Mode

Recommended. Uses Incus system containers for team isolation. Offers enhanced performance and security. Incus does not need to be installed on the host machine (it is managed internally by CTFBox). Learn more about Incus

Privileged Mode

Testing only. Uses privileged Docker containers with reduced security isolation. Not recommended for production CTF events.

No Containers (External)

Use this if you're managing your own team VMs outside of CTFBox. Disables internal container management. You have to create externally, and connect using VM wireguard dedicated profiles, and olso deploy services on your own.

Other Server Settings

Gameserver Token

Authentication token for the gameserver API. Auto-generated if left empty, but you can set a fixed value for consistency.

Debug Mode

Enables verbose logging for troubleshooting. Useful during setup but can generate large log files.

Gameserver Options

When exposed, the gameserver web interface is accessible at the specified address. By default, it's only available locally.

Credential Server

A service that provides secure access to team credentials via a user-friendly interface. When enabled:

Each team receives a unique PIN code (in router/configs/team<id>/pins.json)
Teams use their PIN to access their Wireguard VPN configuration files
Teams can also view their team token (used for flag submission)

Address format: ip:port - Use 0.0.0.0 to listen on all interfaces