VPN gateways

Purpose

• Establish WireGuard VPN tunnels between a firewall and a remote peer.
• Define local and counterpart tunnel addresses and allowed IP ranges.
• Generate and manage the WireGuard key pairs used by tunnels.

Prerequisites

• Minimum permission to view VPNs and keys: networking.vpn.read.
• Permission to create a VPN or generate a key: networking.vpn.create.
• Permission to edit a VPN: networking.vpn.update.
• Permission to delete a VPN or key: networking.vpn.delete.
• A firewall must exist first; every VPN and key attaches to a firewall.
• The sidebar VPN item currently appears for holders of networking.firewalls.read, but opening the VPN pages requires the networking.vpn permissions above.

View VPN gateways

1. Open Networking → VPN.
2. Review the VPN list, showing name, firewall, peer address, status, and created date.
3. Select a VPN name to open it for editing.
4. Expected result: the VPN list for the active account is displayed.

Create a WireGuard VPN

1. Open Networking → VPN, then select Create.
2. Select the firewall for the tunnel; if none exist, use the Create Firewall link first.
3. Enter a VPN name and, optionally, a key name, then select Generate Key to create a WireGuard key pair.
4. Under Local Configuration, add one or more tunnel addresses in CIDR notation.
5. Under Counterpart Configuration, paste the peer's public key and add the counterpart addresses and counterpart tunnel addresses.
6. Under Allowed IPs, add the IP ranges permitted through the tunnel.
7. Select Create VPN.
8. Expected result: the VPN tunnel is queued for creation and appears in the list once provisioned.

Edit a VPN

1. Open Networking → VPN.
2. Select a VPN name to open it.
3. Update the configuration and save.

View WireGuard keys

1. Open Networking → VPN, then open the Keys sub-list.
2. Review the keys, showing name, status, public key, and created date.
3. Use the eye icon to reveal a public key, or the copy icon to copy it to the clipboard.
4. Expected result: the WireGuard keys for the selected scope are listed.

Generate a WireGuard key

1. Open Networking → VPN, open the Keys sub-list, then select Create.
2. Select the firewall for the key.
3. Enter a key name.
4. Select Generate Key.
5. Expected result: a new WireGuard key pair is generated; its public key appears in the list once generation completes.

Best Practices

• Create the firewall before configuring a VPN or generating a key.
• Use CIDR notation for tunnel addresses and allowed-IP entries.
• Keep private keys secret; only public keys are shown in the UI.
• Reveal a public key only when needed and copy it with the copy icon.