VPN gateway
VPN Gateway
Access to your private networks from personal devices, with a split or full tunnel, or site to site.
What a VPN gateway is
A VPN gateway lets your laptop or phone join your private networks. You reach servers by their private addresses, so they need no public IP and no open SSH port.
Ours runs on your router, uses its public address and speaks WireGuard. There is no VPN server to install and patch on one of your own machines. New accounts get the gateway with the default router.
Why ours
Names work over the tunnel
The gateway answers for your Private DNS zones and gives devices your search domain, so ssh web-1 works from your laptop.
The mode is enforced on the gateway
A device sends either only your private networks through the VPN or all of its traffic. A split tunnel device reaches your private networks and nothing else, even if its config is edited by hand.
One outgoing address
In full tunnel every device goes out to the internet from the public address of your router. Banks, CRMs and partners can allowlist that one address.
We do not keep the key
The config holds the private key of the device and is shown only once. If it is lost, remove the device and add it again.
Ways to connect
Private networks only
A personal device sends only the traffic for your private networks through the tunnel. Everything else goes out the way it always does.
Split tunnel
All traffic
A personal device sends all of its traffic through the tunnel and goes out to the internet from the public address of your router.
Full tunnel
Site to site
Connect your office or another cloud to your private networks, so servers on both sides reach each other by private address.
Coming soon
Who is connected
The page shows which devices are connected now, when each was last seen, where it connects from and how much it sent and received. The traffic graph covers the last hour, day or week, for all devices or for one.
Each device has its own key and its own address in 100.64.0.0/24. When you remove a device, it loses access right away.
The tunnel uses UDP port 51820 on your router, with an MTU of 1280, so it also works behind PPPoE and other short links.
How to start
- Open VPN Gateway in the Cloud Panel. On an older account press Enable, the first start takes about a minute.
- Press Add device, give it a name and choose private networks only or all traffic.
- Scan the QR code with the WireGuard app on a phone, or download the .conf file for a computer.
Example usage
# Debian or Ubuntu
sudo apt install wireguard-tools resolvconf
sudo cp ~/Downloads/scamp-wg-1a2b3c.conf /etc/wireguard/scamp.conf
sudo wg-quick up scamp
# start it on every boot
sudo systemctl enable wg-quick@scamp
# reach a server by its name
ssh scamp@web-1Questions
Which apps work?
The official WireGuard apps for Windows, macOS, iPhone, iPad, Android and Linux, or any other WireGuard client.
I lost the config. What now?
Remove the device and add it again. We do not keep its key, so the same config cannot be shown twice.
How many devices can I add?
An account can have 10 devices. Request more on the Limits page in the Cloud Panel.
Do I need a router?
Yes. The gateway is part of the router. Private networks on another router get their own gateway.
Why does Linux fail on the DNS line?
The DNS line of the config needs resolvconf. On Debian and Ubuntu install it together with wireguard-tools.
Can I use port 51820 in a port forward?
No. Port 51820 on the router is reserved for the gateway.