Run a server or app on your Gateway

Once the connection is on, the Gateway belongs to your device. Anything listening on the device can be reached at the address, and anything that sends from the address leaves from it.

The examples use Linux with the config as downloaded (server mode). Set it up with the Linux guide first.

Inbound: reach a service at the Gateway

1. Run the service on the device, listening on all addresses (0.0.0.0) or on the Gateway itself.
2. Let the port in on the tunnel interface. With ufw: sudo ufw allow in on pbgw to any port 443 proto tcp
3. Test it from another network, for example curl -kI https://203.0.113.25/, or open the address in a browser.

To use a name instead of the address, point an A record at your Gateway.

Bind a service to the Gateway

A service that listens on the Gateway itself, for example nginx with listen 203.0.113.25:443;, can only start once the connection is on. Before that, the address does not exist on the machine and the service fails with "Cannot assign requested address". Make it wait for the tunnel:

sudo systemctl edit nginx

Add:

[Unit]
[email protected]
[email protected]

Requires also stops the service if the tunnel is stopped. Use Wants instead if the service should keep running on its other addresses.

Outbound: choose what leaves from the Gateway

What you want	How
Everything on the machine	Switch to full tunnel
One app	Tell the app to send from the Gateway
Everything one user runs	Add a routing rule for that user

One app

Many programs can pick the address they send from:

• curl: curl --interface 203.0.113.25 https://example.com
• wget: wget --bind-address=203.0.113.25 https://example.com
• nginx as a proxy: proxy_bind 203.0.113.25;

Traffic the app sends from the Gateway uses the tunnel. Everything else on the machine is unchanged.

Everything one user runs

To send all traffic from one system user through the Gateway, add two lines under [Interface] in /etc/wireguard/pbgw.conf. Find the user's ID with id -u <user>; this example uses 1001:

PostUp = ip rule add uidrange 1001-1001 lookup 51820 priority 32000
PostDown = ip rule del uidrange 1001-1001 lookup 51820 priority 32000

Keep the existing PostUp and PostDown lines; WireGuard runs each in turn. Restart with sudo systemctl restart wg-quick@pbgw, then check from that user:

sudo -u <user> curl -4 https://ifconfig.me

It prints your Gateway. The same command as any other user prints the machine's own address.

On other devices

• Windows, macOS, iPhone, Android run in full tunnel, so all IPv4 traffic leaves from the Gateway. Inbound connections reach the device too, subject to its own firewall.
• OpenWrt routers forward ports on the Gateway to devices behind them. See the OpenWrt guide.

Limits

• Mail ports are closed. Outbound 25, 465 and 587 are blocked on Gateway, with no exceptions, so you cannot run a mail server that sends from it.
• IPv4 only for now. A service reached over IPv6 is reached on the machine's own address, not through the Gateway. Apps you bind to the Gateway must use IPv4.
• Reverse DNS is not available yet.
• Speed is set by your plan's tier.