Your phone and PC connect to Korthveil over WireGuard. Each device gets its own configuration: the phone scans a QR code, the PC imports a file. All their internet traffic goes through the tunnel, they use the firewall's DNS, and from the firewall it goes out through NordVPN, with IPVanish as backup and a kill switch.

What you need:

• The WireGuard add-in. It is switched on when you first save on VPN › WireGuard.
• The VPN provider group VPN_ONLY with wgnord and wgipvanish (guide Send your Wi-Fi through NordVPN, with IPVanish as backup). You can also do it afterwards (Step 7).
• The free WireGuard app on each device: App Store, Google Play, or wireguard.com for Windows and macOS.
• About fifteen minutes.

Inside the house only. In this guide the devices connect from the Wi-Fi zone WIFI (firewall address 192.168.20.1) or the management network MGMT (192.168.2.13), on UDP port 51822. Connecting from the internet, for example on mobile data, would need a port forward of UDP 51822 to the firewall on whatever router sits in front of it. That is not part of this guide, and nothing here changes that router.

Not in FIPS mode. WireGuard uses algorithms that are not FIPS-approved. On a firewall in FIPS mode, Korthveil refuses to commit WireGuard tunnels: use IPsec there.

The screenshots come from a test firewall whose zones are lan and lab. On the GMKtec test firewall they are WIFI and MGMT.

How it works

 phone / PC                        Korthveil firewall
 ┌──────────────┐  UDP 51822      ┌──────────────────────────────────┐
 │ WireGuard    │ ──────────────▶ │ wg0 (zone vpn)                   │
 │ app          │  to 192.168.20.1│  10.255.0.1, fd00:255::1         │
 │ 10.255.0.10  │                 │   │ DNS: the firewall's resolver │
 │ all traffic  │                 │   ▼                              │
 │ in the tunnel│                 │ policy route VPN_ONLY            │
 └──────────────┘                 │   wgnord, else wgipvanish,       │
                                  │   else blocked (kill switch)     │
                                  └──────────────────────────────────┘

• wg0 is the WireGuard server on the firewall. It joins its own zone, vpn, so rules can treat VPN users on their own.
• Each device has its own keys and its own addresses in the tunnel (IPv4 and IPv6). A lost phone is removed on its own; the others keep working.
• The private key is made on the firewall, shown to you once as a QR code and a file, and then forgotten. Korthveil keeps only the public key.

Step 1: A zone for VPN users

Open Network › Interfaces, zones & routes. In Zones, look for vpn. If it is not there, click Add zone and name it vpn (description: Remote devices over WireGuard). It needs no interfaces: the tunnel joins it in Step 3.

Keep vpn apart from the providers' zone providers. The VPN provider wizard needs them to be different.

Step 2: Where devices connect

Open VPN › WireGuard. In Remote access endpoint, set Public host name or address to 192.168.20.1, the firewall's address on the Wi-Fi.

Korthveil writes this address into every new device configuration. It adds the port itself.

A PC on the management network connects to 192.168.2.13 instead. Step 6 shows how to change that address in the PC's file.

Step 3: The server tunnel

Click New tunnel. Korthveil names it wg0 (or the next free name), makes a new key pair, and fills in addresses. Check and set:

You don't need a firewall rule for the port. Accept connections from zones opens UDP 51822 into the firewall from those zones, and only there. Korthveil adds it with the commit.

Then, under Remote device addresses:

The rest of this guide uses 10.255.0.1 and fd00:255::1. If your fields show other addresses (for example 10.253.0.1/24), keep them and use yours wherever the guide says 10.255.0.….

Click Save to pending changes at the bottom of the page.

Step 4: The firewall answers DNS for the tunnel

Devices ask 10.255.0.1 for names, so the firewall's resolver must answer the vpn zone.

Open Network › DNS resolver. In Resolver, under Serve these zones, tick vpn as well as the zones already ticked. Click Save to pending changes. With the DNS filter on, the phone gets the same ad and malware blocking as the Wi-Fi.

Step 5: Commit

Commit the pending changes (the bar at the top), with a note such as WireGuard server wg0 for phones. In Tunnel status at the bottom of VPN › WireGuard, wg0 now shows up.

Step 6: Add the phone and the PC

On VPN › WireGuard, with the tab wg0 selected, click Add device in Remote devices:

What the device may reach is enforced by the firewall, by the device's tunnel addresses, so a changed configuration on the device cannot widen it. Internet only suits a guest's phone: it browses (through NordVPN, Step 7) but cannot open anything in the house. Local network only suits a laptop that only needs the file server. "Local network" means the private ranges (10/8, 172.16/12, 192.168/16, fc00::/7 and so on) unless the tunnel's Local network for device access lists your own networks. Change it later with the pencil in the device's row.

Click Create device and QR code. Korthveil makes the device's keys and a preshared key, gives it the next free IPv4 and IPv6 addresses, and saves it to the pending changes.

A window Configuration for phone opens, with the QR code and these buttons: Download .conf, Copy configuration, Copy device public key. This is the only time the private key is shown. Korthveil does not keep it. Keep the window open for Step 7, or download the file now. If you close it too early, re-key the device (the arrows icon in its row) for a new QR code.

The guide does not show this window: the QR code holds the device's private key. Treat it like a password. Don't photograph it, send it by chat or email, or leave it on screen.

Click Done, and repeat for pc. For the PC, click Download .conf: you get pc.conf.

PC on the management network: the file says Endpoint = 192.168.20.1:51822. Open it in a text editor and change that line to Endpoint = 192.168.2.13:51822. Change nothing else.

Commit the pending changes. A device connects only after the commit.

Step 7: Send their internet through NordVPN

So far the devices' internet traffic reaches the firewall but has nowhere to go: by default nothing is allowed from vpn to the internet. The VPN provider wizard adds the route, the rule, and NAT.

Open System › Wizards › VPN provider with failover:

1. Providers: under Provider tunnels already on this firewall, tick wgnord, then wgipvanish. Leave the new-provider box empty (click Remove on it). Zone for the provider tunnels stays providers.
2. Failover: group name VPN_ONLY, wgnord first, Kill switch on, as before.
3. Who: under People connecting in over WireGuard tick wg0. Networks and devices from an earlier run (such as WIFI) stay as they are; you don't need to tick them again.
4. What: leave Only these sites empty.
5. Review, Apply, then Keep these settings within five minutes.

Running the wizard again only adds or replaces what you tick in that run: the Wi-Fi keeps its policy route and its allow rule into the VPN.

For wg0 the wizard adds:

• a policy route VPN_ONLY remote wg0 for the tunnel's IPv4 and IPv6 subnets;
• a rule VPN_ONLY remote wg0 into the VPN from zone vpn to providers.

The source NAT on each provider tunnel is already there.

IPv6: if your providers give the tunnel only an IPv4 address, the kill switch blocks the devices' IPv6 internet traffic instead of letting it out through your own line. Apps then use IPv4.

Step 8: Put it on the device

iPhone or Android:

1. Open the WireGuard app and tap +.
2. Choose Scan from QR code and point the camera at the QR code from Step 6.
3. Name the tunnel (for example korthveil) and allow the VPN profile when the phone asks.
4. Turn the tunnel on.

Windows or macOS:

1. Open the WireGuard app and choose Import tunnel(s) from file.
2. Choose pc.conf.
3. Click Activate.

Then delete the .conf file from the Downloads folder: the app keeps its own copy.

The device must be on the Wi-Fi korthveil (or the management network for the PC) to connect. It sends a keepalive every 25 seconds, so the firewall sees at once that it is there.

Step 9: Check it

1. On the firewall: VPN › WireGuard › Tunnel status. The row for phone shows: - Kind Device, Status online (a handshake in the last 3 minutes); - Endpoint: the phone's own address on the Wi-Fi, for example 192.168.20.57:49152; - Last handshake: under two minutes ago; - Received and Sent: growing while you use the phone.

Remote devices shows the same: online, and the traffic as ↓ received ↑ sent.

2. The graphs: at the top of Tunnel status, VPN throughput shows the traffic of all WireGuard tunnels, and Active VPN sessions the peers with a recent handshake. The provider tunnels count too, so expect the number to go up by one for each device that connects. Hover over a graph for the values.
3. On the phone: open an IP check site (for example the provider's own "what is my IP" page). It shows NordVPN's server and location, not your internet provider.
4. DNS: the WireGuard app shows DNS servers: 10.255.0.1, fd00:255::1. A blocked domain from the DNS filter does not load.
5. The path: Firewall › Policy lookup from 10.255.0.10 to any internet address says it is sent via gateway group VPN_ONLY.

A lost or stolen phone

On VPN › WireGuard, tab wg0, in Remote devices:

After the commit the device no longer appears online in Tunnel status. Each device has its own keys, so the others keep working.

Change it later

Other ways to add devices: System › Wizards › Remote-access VPN also makes devices with QR codes. It is meant for people connecting from the internet: it opens the port in your internet zone, and if there is no tunnel in its zone yet, it makes one on the first free port from 51820. For this setup, use VPN › WireGuard as above.

Troubleshooting

More: the guide Send your Wi-Fi through NordVPN, with IPVanish as backup covers the providers and the kill switch. modules/wireguard.md describes the add-in, and adr/0069 the VPN provider wizard.