Manual WireGuard configs

Most people connect with the atreoLINK app, which has WireGuard built in and picks the best path automatically. For any other device — a laptop, a travel router, something without the app — you can generate a standard WireGuard config from the dashboard and import it into the official WireGuard app or any compatible client.

A manual config is pinned to one endpoint and a plain WireGuard client won’t switch endpoints on its own, so the dashboard asks how the device will connect before it generates anything.

Generating a config

1. In the dashboard, open the server and choose Connect a device. The app is the easiest route; to make a manual config, choose Manual Setup.

2. Name this device so you can recognise it later (for example “Travel laptop”).

3. Choose how it connects. The config is created only once you choose — and you can add another later for a different network:

   • Local network — “Same WiFi as the server. Fastest, and works without internet.” Offered only when the server is reachable on your current network. Use it for a device that lives on the same LAN as the server.
   • Remote (anywhere) — “Works from cellular, travel, or any other network. Uses your server’s direct address, or the relay when no direct connection is available.” Use it for a device that needs access off-site.

4. Scan the QR code with the WireGuard app, or use Download .conf / Copy to clipboard to import it manually.

The downloaded file is named after the device and the path you picked — …-local.conf, …-direct.conf, or …-relay.conf — so you can tell your configs apart. Need both a local and a remote config for the same device? Just run the flow twice and pick a different option each time.

When the config uses the relay

If you pick Remote (anywhere) and your server currently has no direct public path (for example it’s behind CGNAT), the config is generated against the relay. The dashboard flags this:

Connecting via relay

This server has no direct connection available right now, so this config uses the relay. If it later regains a direct connection you’ll need to re-download this config to switch back.

A relay config keeps working for as long as the server is relayed, and the relay address is stable across agent reconnects and relay restarts. What it won’t do is move to the faster direct path on its own if one later becomes available — a plain WireGuard client can’t auto-switch endpoints, so you’d regenerate the config to take the direct path.

Note

WireGuard doesn’t re-resolve a hostname it has already cached. In the rare event the relay’s underlying address changes, a native/third-party WireGuard client may need a manual reconnect to pick it up. The atreoLINK apps re-resolve automatically.

If your server later loses its direct path

The reverse can happen too: you’re holding a manual direct config and the server later loses its public path (an IP change, a dropped port forward, or the ISP moving you behind CGNAT), so it falls back to the relay. A direct config can’t follow that move, so it stops working.

When this happens the server notifies the people holding a manual direct config:

Direct connection unavailable

Your server lost its direct connection and is now reachable only through the relay. Any manual WireGuard config set up for a direct connection has stopped working — re-download it as a relay config to restore access.

You only get this if you hold a manual direct config — the atreoLINK apps don’t need it, because they always provision against whichever path is live.

See also

• CGNAT relay — what the relay is, when it’s used, and the privacy trade-off.
• WireGuard VPN — how the tunnel and client provisioning work.
• Manual port forwarding — give your server a direct public path so configs stay direct.