Gateway on iPhone and iPad

The key is made in your browser on the Gateway page, so the private key never leaves your browser or your device. You need the WireGuard app and a screen that shows the Gateway page. A computer is easiest, because you scan its screen with the phone.

1. Make the key and scan the code

1. Install WireGuard from the App Store.
2. On a computer, open your Gateway in the portal and choose Generate keys in my browser.
3. Keep Phone or computer selected. The page shows a QR code.
4. In WireGuard, tap +, then Create from QR code, and scan the code.
5. Name the tunnel pbgw (any name works) and tap Save. Allow the VPN configuration when iOS asks.

If you only have the phone: in Safari, open the Gateway page, choose Generate keys in my browser, then Download .conf. It saves pb-gateway-device.conf. In WireGuard, tap +, then Create from file or archive, and pick the file from Files.

2. Connect

Turn on the tunnel switch. Then check:

• Open ifconfig.me in Safari. It shows your Gateway.
• The Gateway page shows connected.

Using your own key

If you would rather make the key in the app: tap +, Create from scratch, and Generate keypair, and copy the Public key. On the Gateway page, choose Use my own key, paste it into Or use my own public key and choose Save key. The page then shows a config with <your private key> in place of a key. Copy its values into the app: Addresses, MTU, DNS servers 1.1.1.1, 9.9.9.9, and a peer with the Public key, Endpoint, Allowed IPs 0.0.0.0/0 and Persistent keepalive 25.

Things to know

• The QR code holds your private key. Scan it from another screen. Do not take a screenshot of it or share it.
• One key at a time. Saving a new key disconnects any other device that used the Gateway.
• IPv6 is not carried. The config routes IPv4 only, so a phone with IPv6 keeps using its own IPv6 address outside the tunnel. Sites reached over IPv6 see your normal address, and ifconfig.me may show the IPv6 one.
• Stay connected. To reconnect automatically, open the tunnel, tap Edit, and turn on On-Demand Activation for Wi-Fi and cellular.