Gateway on Windows

1. Install WireGuard for Windows from wireguard.com/install.
2. On the Gateway page, choose Generate keys in my browser, keep Phone or computer selected, then choose Download .conf. It saves pb-gateway-device.conf.
3. In WireGuard, choose Import tunnel(s) from file and pick pb-gateway-device.conf.
4. Choose Activate.

The file needs no editing. The [Interface] section looks like this:

[Interface]
PrivateKey = <your private key>
Address = 203.0.113.25/32
DNS = 1.1.1.1, 9.9.9.9
MTU = 1320

The [Peer] section sends all IPv4 traffic through the tunnel. The DNS line sends name lookups through it too. Without it, lookups to your router can fail once the connection is on.

Check it worked

• In WireGuard, Latest handshake shows a time a few seconds ago.
• Open ifconfig.me in a browser. It shows your Gateway.
• The Gateway page shows connected.

Things to know

• Block untunneled traffic (kill-switch) appears in the editor. When it is ticked, traffic that cannot use the tunnel is blocked, which can include devices on your local network. Untick it if you need to reach a printer or NAS while connected.
• IPv6 is not carried. The config routes IPv4 only, so a PC with IPv6 keeps using its own IPv6 address outside the tunnel. Sites reached over IPv6 see your normal address, and ifconfig.me may show the IPv6 one.
• The QR code holds your private key. Windows has no QR scanner, so use the file. Do not share a screenshot of the code.
• Running a server on the Gateway? Windows Defender Firewall blocks inbound connections by default. Allow the program or port for the network the tunnel is on. See Run a server or app on your Gateway.
• The tunnel is named pb-gateway-device, after the file. To disconnect, choose Deactivate. Your normal connection returns.