Gateway: getting connected

Your Gateway is a dedicated IPv4 address in Dallas, routed to your device over WireGuard. Connections to the address reach your device. Traffic your device sends through the tunnel leaves from the address.

1. Make a key

Open your Gateway in the portal and choose Generate keys in my browser. The private key is made in your browser and is never sent to us. It is shown once, so download the config or scan the QR code before you leave the page.

To use your own key instead, choose Use my own key on the Gateway page, paste a WireGuard public key into Or use my own public key and choose Save key. The iPhone and Android guides do it this way.

A Gateway has one key at a time. A new key disconnects the device that used the old one.

2. Get the config

The page offers two configs. Choose the one that matches your device.

Phone or computer is the default. Use it on iPhone, Android, Windows and macOS. Download .conf saves pb-gateway-device.conf, and the QR code on the page is built from the same config. It looks like this, with your own values:

[Interface]
PrivateKey = <your private key>
Address = 203.0.113.25/32
DNS = 1.1.1.1, 9.9.9.9
MTU = 1320

[Peer]
PublicKey = <server public key>
Endpoint = 203.0.113.1:51820
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25

Linux (advanced) is for a Linux server or router. Download .conf saves pb-gateway-linux.conf, and the page shows the Linux command. It looks like this:

[Interface]
PrivateKey = <your private key>
Address = 203.0.113.25/32
MTU = 1320
Table = off
PostUp = ip rule add from 203.0.113.25 table 51820; ip route add default dev %i table 51820
PostDown = ip rule del from 203.0.113.25 table 51820; ip route flush table 51820

[Peer]
PublicKey = <server public key>
Endpoint = 203.0.113.1:51820
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25

• Address is your Gateway.
• MTU: keep the value from your file. A larger one makes big transfers stall.
• DNS appears only in the Phone or computer config. It sends name lookups through the tunnel.
• Table, PostUp and PostDown appear only in the Linux (advanced) config. They send only traffic from your Gateway through the tunnel and leave the rest of the machine alone.

3. Choose how to use it

Use Phone or computer on Windows, macOS, iPhone and Android. It has none of the three Linux lines, which those apps cannot run.

4. Pick your device

• Linux
• Windows
• macOS
• iPhone
• Android
• OpenWrt router
• Run a server or app on your Gateway

Good to know

• IPv4 only for now. The tunnel carries IPv4. A device with IPv6 keeps its own IPv6 address outside the tunnel, so a site reached over IPv6 sees your usual address, and a lookup such as ifconfig.me may show that IPv6 address instead of your Gateway.
• Mail ports are closed. Outbound 25, 465 and 587 are blocked on Gateway, with no exceptions.
• Reverse DNS for the address is not available yet.
• Speed is set by your plan: 25, 50, 100 or 250 Mbps. Change it on the Gateway page. An upgrade is charged for the rest of the period; a lower speed starts at your next renewal.

If it does not connect

Once your device reaches us, the Gateway page shows connected and the time of the last handshake. If it still says waiting for your box:

• Check the key. The device must hold the private key that matches the public key saved on the page. A new key replaces the old one.
• Check UDP. The device must be able to send UDP to the port in the Endpoint line. Some guest and office networks block it.
• Small pages load, large ones hang. Put the MTU line back to the value from your file.

Still stuck? Open a ticket and tell us which device and guide you used.

Cancelling and payment

• Cancel from the Gateway page. The address is released immediately and cannot be restored, and the unused part of the period is not refunded.
• Unpaid invoices. The service is suspended once an invoice is 5 days overdue and resumes when it is paid.
• Suspended for abuse. You cannot cancel a Gateway that we suspended for abuse. Open a ticket and we will help.