For an employee’s WireGuard computer, prepare the ingress and final egress, create a standard Relay, generate a standalone configuration for the computer, then connect to the actual service.
Get startedSign in to the customer console with an existing account and enter the team this connection belongs to. The owner or administrator prepares the nodes and Relay, while employees use their own accounts to obtain device configurations.
Choose a Gateway and a standard final Connector. Place the ingress in a region convenient for your device to connect from, and the egress in the region your business requires. You can use ready hosted resources or servers you have already connected.
Create a standard Relay, select these two nodes, and give the connection an easily recognizable name. For your first computer connection, use a standard final Connector; dedicated relay or port forwarding purposes are not required.
Generate a separate WireGuard configuration within this Relay, name it after the device, then download it and import it into the WireGuard client on your computer. Each device uses its own configuration, making it easier to review traffic or disable it individually later. The standard WireGuard configuration on a standard Relay uses a full tunnel.
Enable WireGuard on your computer and open the business website or service you need to use. Check the connection status and upload/download for this device in the terminal details; a successful configuration download or a node showing as healthy is not a substitute for an actual business access attempt.
When using Surge 6, Mihomo (Clash format), or Shadowrocket, select the corresponding subscription link. After rules are published, refresh the original subscription in the client to get the update.
Learn about subscription integration →Generate separate scripts and configurations for routers or firewalls. They establish the tunnel, while routing and access policies are managed by the device; FortiGate also requires the ingress to support and enable IKEv2/IPsec access.
Learn about branch device configuration →When connecting through an AnyTLS or SOCKS5 proxy, you must also complete source admission from the current device.
Confirm that the client connection is enabled. Check the endpoint’s recent status and traffic, along with heartbeats and service results for the Gateway and Connector in use.
If a particular service will not open, check the final Connector’s access records using the destination address, observed error and time of the incident.
In Help and Support, describe the device, connection, destination and time of the problem, and attach an error screenshot. Keep subsequent tests and replies in the same support ticket.
