One computer. Or an entire branch.
Employees import the subscription into their existing clients, while routers and firewalls use standalone configurations. Gateway connects devices to business networks.
Choose a connection methodFor every device profile, you can view traffic, set rate limits, or revoke connection access.
Connection methods, chosen per device.
Client subscription
Import the corresponding link into Surge 6, Mihomo (Clash format) or Shadowrocket to receive published rule updates from the same subscription.
Learn about client links →WireGuard
Download a standalone tunnel configuration for each device. Each configuration has its own connection identity, making it easy to view traffic and set egress separately.
Learn about device egress →RouterOS
Download a router script for each branch to establish a tunnel. The branch keeps its own routing arrangements and sends the required traffic through the connection.
Learn about branch network interconnection →FortiGate
Connect via IKEv2/IPsec, reusing the branch firewall. Routing, allow policies and NAT continue to be managed on the device side.
Learn about device network interconnection →One device, one configuration.
Generate a standalone tunnel configuration from the Relay for a computer, router, or firewall, then download it and import it on the device. With a compatible client, you can also use a subscription link.
After importing and starting the connection, check the device's connection status in the console. Routers and firewalls also require routing and access policies to be configured on the device side.
After onboarding, manage each separately.
For the current network, request admission separately.
Open the access link from the device you want to connect, complete account authentication, and the Gateway identifies its current public IPv4 address. Once the source is approved, a time-limited access permit is issued.
When a device is deactivated, revoke this configuration.
Revoke the corresponding terminal profile; once the Gateway synchronizes, the old configuration becomes invalid. Other devices using separate configurations remain connected; reconnecting requires creating a new configuration.
Internal networks at both ends, interconnected as needed.
Declare the internal subnet for configurations that support networking, and enable interconnection on both ends. After saving, download and re-import the updated configuration so the device loads the new routes.
Frequently asked questions.
Which clients can import a subscription link?
The console provides Surge 6, Mihomo (Clash format), and Shadowrocket formats. Choose the subscription that matches your client; when switching clients, generate a link in the corresponding format. Subscriptions contain members' connection credentials, so keep them secure.
Do I need a new configuration after rules or device settings are updated?
After split routing rules are published, clients can refresh the original subscription to get the new configuration. After the terminal's internal subnet and networking routes are updated, you need to re-download and import the device configuration; a revoked old configuration cannot be restored, and reconnecting requires creating a new configuration.
Are the routing methods for WireGuard, RouterOS, and FortiGate the same?
A standard Relay’s ordinary WireGuard configuration uses a full tunnel. RouterOS and FortiGate configurations establish only the tunnel; the device manages routing and traffic selection. Endpoint configurations for port-forwarding Relays also leave the default route unchanged. FortiGate access must also be enabled on the Gateway and requires firmware supporting IKEv2/IPsec.