Add a Laptop or Phone to Your WireGuard Network

Your laptop or phone in the private network

Add a laptop or phone to your WireGuard network and it reaches your servers on their private addresses, encrypted, from any network. The device makes its own key in the WireGuard app; you only paste its public key here.

A phone is quicker with a QR code: Add a phone with one scan.

01 · Add the device

1. In the WireGuard app on the device, create an empty tunnel and copy its Public key (how).
2. Fill in the form under the list:
   Name

   Any label, for example MacBook Air.

   Tunnel address

   Already filled in with the next free private address. Change it if you want another free one.

   Device public key

   The key from the app.

   Public IPs it connects from

   The internet address of your home or office, or 0.0.0.0/0 to connect from any network, mobile data included. Your current address is shown above the list.

3. Click Add Device. This server adds the device to its tunnel.

02 · Put the device on every server it needs

Add Device puts the device on the server you added it from. For each other server it must reach: open that server › Security › Devices, tick On this server on the device's row and click Save.

03 · Put the config on the device

Click Config on the device's row. It holds one [Peer] block for each server the device is on, each with the server's public key, its endpoint, both its addresses (private and public) under AllowedIPs and a keepalive of 25 seconds.

• Laptop (macOS, Windows): paste the lines in the app, under the line with PrivateKey, and save.
• Phone (Android, iOS): the app has no text editor. Edit the tunnel, set Addresses to the device's tunnel address with /32, and for each [Peer] block tap Add peer and fill in Public key, Endpoint, Allowed IPs and Persistent keepalive.

Turn the tunnel on. Every peer shows a Latest handshake within a few seconds; a peer without one is not reachable. Sample tunnel config shows the full config of a new device, with every WireGuard server of your account as a peer, before the device is added.

04 · Change or remove it

• Edit the name, the tunnel address or the public IPs on the row, tick or untick On this server, then Save.
• Delete removes the device from every server, together with any firewall rule made for its private address, so a new device that gets the same address inherits nothing.

On this server decides which servers the device can reach. Tick it on each server the device needs.