VPN access

A VPN profile is a WireGuard identity for one device, linked to one of your proxy tokens. Everything the device sends leaves through that proxy. You can link the profile to another token later without scanning a new QR code or changing the config on the device.

Create a profile under My account → VPN profiles, or press Use with VPN profile on a proxy. Use one profile per device.

Create a profile#

1. Press Create profile, or press Use with VPN profile on a proxy and choose Create a new profile.
2. Name it and pick the device.
3. Pick the token to link. For a pay-per-GB token, also pick the location and how long to keep the IP.
4. Press Show config. On a phone, scan the QR code. On a computer, download the file. On Linux, copy the snippet.
5. Follow the section for your device below.
6. Test the setup on the check page.

Choose a server: US, Europe or Singapore. The server nearest to the device is usually the fastest. Changing the server later needs the new config on the device: scan the new QR code or download the file again.

A profile with no linked token, or with an expired or disabled token, sends nothing. Its traffic is blocked, never sent outside the tunnel. Pick a token to start it again.

Supported setups#

Leak-tested means we captured the device's network traffic through startup, sleep and wake, a switch from Wi-Fi to cellular, a gateway restart and a failed exit, and found no traffic outside the tunnel. We promise no DNS or IP leaks only on the setups marked Yes. The others work, but traffic can leave the device outside the tunnel at times.

iOS#

1. Install WireGuard from the App Store.
2. In Litport, open the profile and press Show config.
3. In the WireGuard app, tap +, then Create from QR code. Scan the code, name the tunnel and allow the VPN configuration.
4. Turn the tunnel on.
5. Optional: open the tunnel, tap Edit and turn on On-Demand Activation for the networks you use.

Supported, not leak-tested. On-Demand brings the tunnel back up when the network changes. It is not a kill switch: traffic can leave the device outside the tunnel while it reconnects.

Android#

1. Install WireGuard from Google Play.
2. In Litport, open the profile and press Show config.
3. In the WireGuard app, tap +, then Scan from QR code. Scan the code, name the tunnel and allow the VPN request.
4. Turn the tunnel on.
5. Open Android's system VPN settings, tap the gear next to WireGuard, and turn on Always-on VPN and Block connections without VPN.
6. Open Android's Private DNS setting and choose Automatic or Off. Private DNS provider hostname breaks DNS in the tunnel.

Supported and leak-tested with steps 5 and 6.

Windows#

1. Install WireGuard from wireguard.com/install.
2. In Litport, open the profile, press Show config and download the file.
3. In WireGuard, press Import tunnel(s) from file and pick the file.
4. Select the tunnel, press Edit and check Block untunneled traffic (kill-switch). The box appears because the config routes all traffic through the tunnel.
5. Press Activate.

Supported and leak-tested with the kill-switch on.

macOS#

1. Install WireGuard from the Mac App Store.
2. In Litport, open the profile, press Show config and download the file.
3. In WireGuard, choose Import tunnel(s) from file and pick the file.
4. Press Activate.
5. Optional: edit the tunnel and turn on On-Demand for the networks you use.

Supported, not leak-tested. On-Demand brings the tunnel back up when the network changes. It is not a kill switch: traffic can leave the Mac outside the tunnel while it reconnects.

Linux#

1. Install WireGuard and resolvconf. On Debian and Ubuntu: sudo apt install wireguard resolvconf. wg-quick needs resolvconf to set the DNS server.
2. In Litport, open the profile, press Show config and save the config as /etc/wireguard/litport-vpn.conf.
3. Start the tunnel:

sudo wg-quick up litport-vpn

Supported without the firewall snippet, but not leak-tested: traffic can leave outside the tunnel when it is down.

For the kill switch, add these two lines to the [Interface] section of the config. They come from the wg-quick(8) manual page. They reject all outgoing traffic that does not go through the tunnel, your local network included, and remove the rule when the tunnel stops.

PostUp = iptables -I OUTPUT ! -o %i -m mark ! --mark $(wg show %i fwmark) -m addrtype ! --dst-type LOCAL -j REJECT && ip6tables -I OUTPUT ! -o %i -m mark ! --mark $(wg show %i fwmark) -m addrtype ! --dst-type LOCAL -j REJECT
PreDown = iptables -D OUTPUT ! -o %i -m mark ! --mark $(wg show %i fwmark) -m addrtype ! --dst-type LOCAL -j REJECT && ip6tables -D OUTPUT ! -o %i -m mark ! --mark $(wg show %i fwmark) -m addrtype ! --dst-type LOCAL -j REJECT

Leak-tested with the snippet. Stop the tunnel with sudo wg-quick down litport-vpn.

Router#

These steps cover GL.iNet and OpenWrt routers. Every device behind the router goes through the profile.

1. In Litport, open the profile, press Show config and download the file.
2. GL.iNet: open the router's admin panel, go to VPN → WireGuard Client and add the downloaded file as a new configuration. Connect it.
3. OpenWrt: in LuCI, go to Network → Interfaces, press Add new interface, choose WireGuard VPN and use Load configuration to paste the file.
4. Turn on the router's kill switch. On GL.iNet it is Block Non-VPN Traffic in the VPN options. On OpenWrt, forward the LAN zone only to the VPN zone, never to WAN.

Supported and leak-tested with the kill switch on.

Network and DNS#

• Port. The config uses UDP port 51830. If your network blocks it, choose port 443 in Show config and import the config again. WireGuard uses UDP, so a network that blocks all UDP also blocks the VPN.
• MTU. The config sets MTU 1280 for you. Leave it as it is.
• IPv6. IPv6 is refused inside the tunnel, so apps use IPv4.
• DNS. DNS stays inside the tunnel. Litport does not look names up itself: they are resolved through the proxy exit, so a website normally sees a resolver that matches the exit. Where a lookup lands depends on the provider, so this can vary.
• Placeholder addresses. nslookup shows addresses like 198.18.x.x. That is normal. The real lookup happens at the exit. A name that does not exist shows as a failed connection, not as "not found".
• Secure DNS in browsers. A browser with its own secure DNS (DNS over HTTPS) still goes through the tunnel, but it does not use Litport's resolver.
• UDP. UDP works through proxies that carry UDP, such as the pay-per-GB pools marked UDP. See UDP in the pay-per-GB guide. Other proxies refuse UDP, and apps fall back to TCP. How well that works depends on the app.
• Ports. TCP to the usual web ports is allowed, plus SSH (22), mail (465, 587, 993, 995) and RDP (3389). Port 25 is closed. Other TCP ports are refused. Ask support if an app needs another port.

Pay-per-GB traffic#

A VPN sends everything the device sends: app updates, photo backups, video. On a pay-per-GB token every byte is billed at the pool's rate, so watch your balance. There is no separate VPN spending limit yet.

On a rotating pay-per-GB session, a name's lookup and the connection to it can leave from different exits in the same location. Choose a keep-IP time on the profile to keep them together.

Change the exit#

Link the profile to another token, or press New IP. Open connections close within a few seconds and apps reconnect through the new exit. The device's IP changes, so apps and sites see a new IP.

Check your setup#

Open the check page on the device while the tunnel is on. It shows the IP and location websites see, where this browser's DNS lookups land, and whether IPv6 or WebRTC show another address. It checks that browser only, not other apps.

If the profile does not connect:

• Check that it has a linked token and that the token is active.
• Check that the profile is not paused.
• If the profile still says Never connected, the tunnel never reached Litport. Try port 443.
• On Android, set Private DNS to Automatic or Off.

Allowed use#

Use a profile only on your own devices. The same uses are prohibited as with proxies: peer-to-peer file sharing and torrents, sending spam, attacking or scanning networks, and fraud. Litport records the destinations of VPN traffic as it does for proxy traffic, and which token a profile used. A profile that is abused can be paused. See the Terms of Use and the Appropriate Use Policy.