Skip to content

Set up remote access

Overview

A VPN gives you a secure channel to the gateway so you can manage it remotely — including when the gateway is on LTE and behind carrier NAT. The gateway supports both WireGuard and OpenVPN, and can run them at the same time.

Production gateways also ship with a SenArch support connection already set up (see below). To manage the gateway from your own infrastructure, add your own WireGuard or OpenVPN configuration.

SenArch does not host a VPN server for you

SenArch does not provide a WireGuard or OpenVPN server for your own remote access — you supply your own (see Prerequisites).

Prerequisites

For your own remote access you need:

  • Your own WireGuard or OpenVPN server on a host with a public IP. Over LTE the gateway is behind carrier NAT, so it dials out to a public server and you connect to that same server. WireGuard is recommended.
  • A client configuration file (.conf) for this gateway, containing its keys and the server endpoint.
  • Access to the Gateway UI.

SenArch support access

Every production gateway ships with a SenArch WireGuard configuration pre-installed. This gives the SenArch support team a secure tunnel into the gateway to help you — for example, when the gateway is deployed remotely on LTE.

If you do not want SenArch to have this access, turn it off in the Gateway UI:

  1. Open Settings → Wireguard Configuration Files.
  2. Disable the SenArch configuration.
  3. Select Save Changes.
Disabling this prevents SenArch remote support

With the SenArch connection off, the support team can no longer reach the gateway to help you. Make sure your own remote access works first so you can still manage the gateway.

Set up your own remote access (WireGuard)

  1. Obtain this gateway's WireGuard .conf from your own WireGuard server.
  2. In the Gateway UI, open Settings → Wireguard Configuration Files.
  3. Select Upload New File, give it a name, and upload the .conf.
  4. Select Save Changes.

The gateway starts WireGuard automatically and applies safe runtime defaults so the tunnel stays up across NAT and LTE — a persistent keepalive of 25 seconds and a forced MTU of 1280 (these override any values set in your .conf). Your tunnel runs alongside the SenArch connection — both can be active at once.

Confirm the tunnel

Open Dashboard and check the WireGuard service. When the tunnel is up, it shows an interface (for example wg0) and the gateway's VPN IP address. From another peer on the same VPN, you can then reach the gateway at that IP — open the Gateway UI at http://<vpn-ip> or connect with ssh root@<vpn-ip>.

OpenVPN

The gateway also supports OpenVPN, and it can run at the same time as WireGuard. Upload your client .conf under Settings → OpenVPN Configuration Files; the gateway starts the tunnel automatically and shows it on the Dashboard as tun0. The same public-IP server requirement applies.

Troubleshooting

If a tunnel does not come up or you get no VPN IP after uploading a config, see Remote access (VPN).

Next steps