> For the complete documentation index, see [llms.txt](https://support.simbase.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://support.simbase.com/private-networks/wireguard.md).

# WireGuard

WireGuard is the VPN we use for remote access into a private network. Add a WireGuard connector to your network, import the generated configuration into the WireGuard client, and you can reach your SIM cards on their static IPs.

## Why WireGuard

WireGuard replaces OpenVPN on our platform:

* **Small and auditable.** A few thousand lines of code, against hundreds of thousands for OpenVPN. Far less to go wrong.
* **Modern, fixed crypto.** Curve25519, ChaCha20-Poly1305 and BLAKE2s. There is no cipher negotiation, so there are no weak-cipher footguns.
* **Fast and low latency.** It runs in the Linux kernel, reconnects almost instantly and keeps working when your own IP or network changes.
* **A trivial configuration.** A handful of lines, generated for you.

## Before you start

* [Deploy a private network](/private-networks.md#deploy-a-private-network) and [assign your SIM cards](/private-networks.md#assign-a-sim-to-a-private-network) to it.
* Set the APN on those devices to `fixedip.eu` or `fixedip.us`, matching the POP your network runs in.
* Install the WireGuard client: [wireguard.com/install](https://www.wireguard.com/install/) for Windows, macOS and Linux, or the **App Store** (iOS) and **Google Play** (Android).

## Create a WireGuard connector

1. In the dashboard, navigate to **'Private Network'** and open your network.
2. Add a **WireGuard** connector.
3. The configuration is generated for you, including the keys, the address of the client and the endpoint of your gateway. Download or copy it.

Add one configuration per device or person that needs access. Every client needs its own.

A configuration looks like this:

```
[Interface]
PrivateKey = <generated for you>
Address    = 10.215.8.50/32

[Peer]
PublicKey  = <your gateway key>
Endpoint   = your-gateway.simbase.com:51820
AllowedIPs = 10.215.8.0/24
PersistentKeepalive = 25
```

{% hint style="warning" %}
The configuration contains a private key. Treat it like a password: store it somewhere safe and do not share it or mail it around. If you need to revoke access, remove that client from the connector in the dashboard.
{% endhint %}

## Add the tunnel on Windows, macOS or Linux

1. Open the WireGuard app, click **Add Tunnel** and choose **Add empty tunnel…**
2. Delete the pre-filled text in the editor.
3. Paste your configuration.
4. Give it a recognisable **Name**, for example `Simbase private network`.
5. Click **Save**, select the tunnel in the list and click **Activate**.

Within a few seconds the status turns **Active** and you see a 'Latest handshake' time and bytes sent and received. That means you are connected.

## Add the tunnel on iPhone or Android

Save the configuration file to your phone, open the WireGuard app, tap **+** and choose **Create from file or archive**. Select the file, then tap the tunnel to turn it on. If your phone will not let you pick a `.txt` file, rename it to end in `.conf` first.

## Check that it works

* In the app, confirm you see a recent **handshake** and that bytes are transferring.
* Open the **'SIM cards'** tab of your private network in the dashboard and note the IP of one of your SIMs.
* Ping that IP from your terminal (Mac, Linux) or command prompt (Windows).

No handshake? Check that the SIM is online and assigned to the network, that the APN on the device is `fixedip.eu` or `fixedip.us`, and that you pasted the whole configuration without anything cut off. Toggling the tunnel off and on forces a retry.