Skip to content

Clients

What it's for

A client is one installed device — a Windows PC, a Linux or macOS machine, or a phone. Its Details page is where you manage that device: connect and disconnect it remotely, give it VPN profiles, control its updates, and troubleshoot it.

The page has a status header (with quick actions) and tabs: Overview, Access, Integrated Server Pro, VPN, History, and Diagnostics.

How to use it

Activate a new device. Fresh installs appear as pending. Open the client, assign it to its customer, and click Activate — the device finishes the handshake on its own within a few minutes.

Connect / disconnect remotely. The header's Connect and Disconnect buttons ask the device to bring the tunnel up or down. The device picks the request up on its next check-in — usually seconds, at most a few minutes.

Kill Tunnel Pro removes the device's VPN peer on the server side immediately — it works even when the device is unreachable or frozen. It's a kick, not a ban: the next time the device connects normally, its peer is restored automatically. Use Disconnect for cooperation, Kill Tunnel for right-now.

Give it a VPN profile. For external/Community customers, upload a WireGuard® .conf on the Details page. For integrated-server customers Pro, the profile is provisioned automatically; Re-provision in the header rebuilds it if it was ever lost on the device.

Auto-connect. Enable it so the device brings its VPN up by itself after boot and network changes — the right setting for machines that should always be on the VPN.

Updates. Set the device's update channel (stable or beta) to test new client versions on selected machines, and use Force update to make it update right now instead of within the hour. See Releases & auto-update.

MFA policy Pro — see MFA session gating.

History & Diagnostics. The History tab lists the device's connection events with LAN/WAN addresses; the Diagnostics tab requests and downloads redacted log bundles — see Diagnostic logs.

Pitfalls

  • Everything remote is "on next check-in." If a device is offline, your connect/disconnect/config waits until it comes back. Only Kill Tunnel acts server-side immediately.
  • Two entries, one pending, same name? The device was reinstalled from scratch and has a new identity. Delete the old entry and activate the new one.
  • Deleting a client doesn't uninstall anything on the device — it removes the server-side identity. A still-installed client will re-appear as pending.