Revoke the configuration, then wait for node sync.
After revocation is submitted, the node must synchronize the update. The Gateway removes the corresponding WireGuard peer or IPsec identity; old files retained on the device can no longer reconnect.
Disable this configuration. Other connections continue.
When a device is lost, retired or its configuration is leaked, revoke the corresponding independent terminal configuration. Once the Gateway synchronizes, the old configuration stops working and the other independent configurations are kept.
Learn about configuration scopeFind the device, disable only the matching configuration.
Work computers and office routers each have their own configuration. If a computer is lost, find the matching entry in Relay by device name and configuration number, then confirm revocation—there is no need to disable the entire connection.
What you manage is the configuration identity. If the same configuration was imported on multiple devices, revoking it prevents all of them from using it to connect. Create a separate configuration for each device so they can be disabled individually.
Connectivity and intranet access are revoked together.
Associated networking is cleaned up with the configuration.
Intranet connectivity for this configuration is closed, and the associated routes and access rules are cleared. Other independent terminals continue to use their own connection identities and settings.
Device recovered? Create a new configuration.
Revocation cannot be undone. To connect again, create and import a new terminal configuration, then assign its egress, rate limit, and intranet connectivity.
Different permissions, handled separately.
Deleting the local files on a device does not revoke its server-side connection identity. Signing out of the console only ends the current browser session; banning a source IP applies to Gateway's public source. Disabling a device tunnel requires revoking the corresponding terminal configuration.
Learn about account and source permissions →Frequently asked questions.
Can I restore the old configuration after recovering the computer?
No. Revocation cannot be undone, and the old files will not become valid again. Create and import a new configuration, then set up the required device connections and intranet settings.
Will this affect other devices using the same Relay?
Devices using other independent configurations can continue to connect. If multiple devices share the same revoked configuration, they will all lose the connection permissions of that configuration.
Does a successful revocation submission mean the device is already disconnected?
The submitted record still needs to be synchronized and executed by the node. Permissions on the server are fully revoked only after the Gateway applies the change and removes the configuration identity and associated rules. A successfully saved request alone does not prove that an online device has disconnected.