Gateway on Android

The key is made in your browser on the Gateway page, so the private key never leaves your browser or your device. You need the WireGuard app and a screen that shows the Gateway page. A computer is easiest, because you scan its screen with the phone.

1. Make the key and scan the code

1. Install WireGuard from Google Play.
2. On a computer, open your Gateway in the portal and choose Generate keys in my browser.
3. Keep Phone or computer selected. The page shows a QR code.
4. In WireGuard, tap +, then Scan from QR code, and scan the code.
5. Name the tunnel pbgw (any name works) and tap Create tunnel. Accept the connection request when Android asks.

If you only have the phone: in your browser, open the Gateway page, choose Generate keys in my browser, then Download .conf. It saves pb-gateway-device.conf. In WireGuard, tap +, then Import from file or archive, and pick the file.

2. Connect

Turn on the tunnel switch. Then check:

• Open ifconfig.me in your browser. It shows your Gateway.
• The Gateway page shows connected.

Using your own key

If you would rather make the key in the app: tap +, Create from scratch, tap the generate button in the Private key field, and copy the Public key. On the Gateway page, choose Use my own key, paste it into Or use my own public key and choose Save key. The page then shows a config with <your private key> in place of a key. Copy its values into the app: Addresses, MTU, DNS servers 1.1.1.1, 9.9.9.9, and a peer with the Public key, Endpoint, Allowed IPs 0.0.0.0/0 and Persistent keepalive 25.

Things to know

• The QR code holds your private key. Scan it from another screen. Do not take a screenshot of it or share it.
• One key at a time. Saving a new key disconnects any other device that used the Gateway.
• IPv6 is not carried. The config routes IPv4 only, so a phone with IPv6 keeps using its own IPv6 address outside the tunnel. Sites reached over IPv6 see your normal address, and ifconfig.me may show the IPv6 one.
• Stay connected. In Android's VPN settings, open WireGuard and turn on Always-on VPN. The exact menu path varies by phone maker.