Network
Arrows are configured next hops, not measured links. Check-in is control status; use Diagnostics to verify reachability.
Unlock management
Enter your personal access credential or the bootstrap token. Credentials stay in this page’s memory and are cleared when you lock it.
Devices & bindings
DNS & configuration details
Auto route discovery
Tests approved links in both directions. Suggestions never change your routes.
No discovery run yet. Only provisioned, mutually accepted links are probed. Missing or stale evidence stays unknown.
1 · RESOLVE A NAME
Managed DNS
Select a configured name. Its answer can be traced below.
2 · FOLLOW THE PACKET
Route trace
No trace yet.
Advanced: isolated packet laboratory
3 · TEST THE ENCRYPTED PACKET PATH
AWG packet laboratory
Use the client and name selected in Managed DNS. This creates disposable official AWG links in memory and a loopback echo service. Your current policy is enforced on actual TCP, UDP or ICMP packets, including fragments and return translation. It does not connect a real device or contact the selected hostname.
No encrypted packet test yet.
Advanced: DNS mode reference
Synthetic mode gives each client and hostname its own address, with a lease bound to its hostname and client. The userspace gateway translates it at the final egress and restores it on replies.
Observed mode returns real IPs, but shared IPs and DNS bypass prevent reliable hostname identification. Domain-sensitive rules fail closed in that mode. IP rules placed earlier can still make an explicit IP-based decision.
Enroll node credentials
Existing policy nodes only. This does not provision links or add forwarding members.
Edit node
Device binding
Grouping labels only. Existing addresses and entry nodes stay unchanged.
Access rules
First match wins. Rules are staged until Save.
POLICY DRAFT
Routing settings
Draft edits are saved only when you validate and save the revision below.
DESTINATION RULE
Routing rule
Ordered rules in selected scope
VERSIONED DESIRED CONFIGURATION
Review and save
Rules run in order: client → network → gateway → global. Defaults apply after all rule groups. A next rule outside a gateway needs an explicit at list. Cycles are rejected.
Save stores a desired revision. Publish activates it on nodes.
COORDINATED NODE ACTIVATION
Publish a desired revision
Saving edits keeps a desired revision. Publishing prepares every node, seals traffic, activates the same generation everywhere, then releases downstream nodes before ingress. A failure stays sealed until recovery.
Node control is not configured.
Revision history
Restore an earlier policy as a new revision. The latest 64 revisions are retained.
Advanced: rollout recovery lab
Exercise staged changes and compensation against in-memory node models. This does not deploy anything.
No exercise yet.
Amnezia VPN link
Convert an existing complete AWG client .conf locally. Nothing is uploaded; no peers are provisioned.
Secret: this link and QR contain the client private key. Share only with the device owner.
LEAST PRIVILEGE
People & access
Viewers inspect configuration and trace routes. Operators also edit policy, allocate DNS leases, run labs and publish. Administrators manage identities. Credentials expire after at most 90 days; rotating immediately invalidates the previous credential.
Create an identity
Save this credential now
It is shown only once. Deliver it privately to its owner. Only its hash is saved by Waygate.