# VPN access

A VPN profile is a WireGuard identity for one device, linked to one of your proxy tokens. Everything the device sends leaves through that proxy. You can link the profile to another token later without scanning a new QR code or changing the config on the device.

Create a profile under **My account → VPN profiles**, or press **Use with VPN profile** on a proxy. Use one profile per device.

## Create a profile

1. Press **Create profile**, or press **Use with VPN profile** on a proxy and choose **Create a new profile**.
2. Name it and pick the device.
3. Pick the token to link. For a pay-per-GB token, also pick the location and how long to keep the IP.
4. Press **Show config**. On a phone, scan the QR code. On a computer, download the file. On Linux, copy the snippet.
5. Follow the section for your device below.
6. Test the setup on the [check page](/check).

Choose a server: US, Europe or Singapore. The server nearest to the device is usually the fastest. Changing the server later needs the new config on the device: scan the new QR code or download the file again.

A profile with no linked token, or with an expired or disabled token, sends nothing. Its traffic is blocked, never sent outside the tunnel. Pick a token to start it again.

## Supported setups

| Device | App | Kill switch | Leak-tested |
| --- | --- | --- | --- |
| [iOS](#ios) | Official WireGuard app | On-Demand reconnects, but is not a kill switch | No |
| [Android](#android) | Official WireGuard app | Always-on VPN and Block connections without VPN | Yes |
| [Windows](#windows) | Official WireGuard app | Block untunneled traffic (kill-switch) | Yes |
| [macOS](#macos) | Official WireGuard app | On-Demand reconnects, but is not a kill switch | No |
| [Linux](#linux) | `wg-quick` | Firewall snippet | Yes, with the snippet. Without it: supported, not leak-tested |
| [Router](#router) | GL.iNet or OpenWrt WireGuard client | The router's kill switch | Yes |

Leak-tested means we captured the device's network traffic through startup, sleep and wake, a switch from Wi-Fi to cellular, a gateway restart and a failed exit, and found no traffic outside the tunnel. We promise no DNS or IP leaks only on the setups marked Yes. The others work, but traffic can leave the device outside the tunnel at times.

## iOS

1. Install WireGuard from the [App Store](https://apps.apple.com/app/wireguard/id1441195209).
2. In Litport, open the profile and press **Show config**.
3. In the WireGuard app, tap **+**, then **Create from QR code**. Scan the code, name the tunnel and allow the VPN configuration.
4. Turn the tunnel on.
5. Optional: open the tunnel, tap **Edit** and turn on **On-Demand Activation** for the networks you use.

Supported, not leak-tested. On-Demand brings the tunnel back up when the network changes. It is not a kill switch: traffic can leave the device outside the tunnel while it reconnects.

## Android

1. Install WireGuard from [Google Play](https://play.google.com/store/apps/details?id=com.wireguard.android).
2. In Litport, open the profile and press **Show config**.
3. In the WireGuard app, tap **+**, then **Scan from QR code**. Scan the code, name the tunnel and allow the VPN request.
4. Turn the tunnel on.
5. Open Android's system VPN settings, tap the gear next to WireGuard, and turn on **Always-on VPN** and **Block connections without VPN**.
6. Open Android's Private DNS setting and choose **Automatic** or **Off**. **Private DNS provider hostname** breaks DNS in the tunnel.

Supported and leak-tested with steps 5 and 6.

## Windows

1. Install WireGuard from [wireguard.com/install](https://www.wireguard.com/install/).
2. In Litport, open the profile, press **Show config** and download the file.
3. In WireGuard, press **Import tunnel(s) from file** and pick the file.
4. Select the tunnel, press **Edit** and check **Block untunneled traffic (kill-switch)**. The box appears because the config routes all traffic through the tunnel.
5. Press **Activate**.

Supported and leak-tested with the kill-switch on.

## macOS

1. Install WireGuard from the [Mac App Store](https://apps.apple.com/app/wireguard/id1451685025).
2. In Litport, open the profile, press **Show config** and download the file.
3. In WireGuard, choose **Import tunnel(s) from file** and pick the file.
4. Press **Activate**.
5. Optional: edit the tunnel and turn on **On-Demand** for the networks you use.

Supported, not leak-tested. On-Demand brings the tunnel back up when the network changes. It is not a kill switch: traffic can leave the Mac outside the tunnel while it reconnects.

## Linux

1. Install WireGuard and `resolvconf`. On Debian and Ubuntu: `sudo apt install wireguard resolvconf`. `wg-quick` needs `resolvconf` to set the DNS server.
2. In Litport, open the profile, press **Show config** and save the config as `/etc/wireguard/litport-vpn.conf`.
3. Start the tunnel:

```bash
sudo wg-quick up litport-vpn
```

Supported without the firewall snippet, but not leak-tested: traffic can leave outside the tunnel when it is down.

For the kill switch, add these two lines to the `[Interface]` section of the config. They come from the `wg-quick(8)` manual page. They reject all outgoing traffic that does not go through the tunnel, your local network included, and remove the rule when the tunnel stops.

```ini
PostUp = iptables -I OUTPUT ! -o %i -m mark ! --mark $(wg show %i fwmark) -m addrtype ! --dst-type LOCAL -j REJECT && ip6tables -I OUTPUT ! -o %i -m mark ! --mark $(wg show %i fwmark) -m addrtype ! --dst-type LOCAL -j REJECT
PreDown = iptables -D OUTPUT ! -o %i -m mark ! --mark $(wg show %i fwmark) -m addrtype ! --dst-type LOCAL -j REJECT && ip6tables -D OUTPUT ! -o %i -m mark ! --mark $(wg show %i fwmark) -m addrtype ! --dst-type LOCAL -j REJECT
```

Leak-tested with the snippet. Stop the tunnel with `sudo wg-quick down litport-vpn`.

## Router

These steps cover GL.iNet and OpenWrt routers. Every device behind the router goes through the profile.

1. In Litport, open the profile, press **Show config** and download the file.
2. GL.iNet: open the router's admin panel, go to **VPN → WireGuard Client** and add the downloaded file as a new configuration. Connect it.
3. OpenWrt: in LuCI, go to **Network → Interfaces**, press **Add new interface**, choose **WireGuard VPN** and use **Load configuration** to paste the file.
4. Turn on the router's kill switch. On GL.iNet it is **Block Non-VPN Traffic** in the VPN options. On OpenWrt, forward the LAN zone only to the VPN zone, never to WAN.

Supported and leak-tested with the kill switch on.

## Network and DNS

- **Port.** The config uses UDP port 51830. If your network blocks it, choose port 443 in **Show config** and import the config again. WireGuard uses UDP, so a network that blocks all UDP also blocks the VPN.
- **MTU.** The config sets MTU 1280 for you. Leave it as it is.
- **IPv6.** IPv6 is refused inside the tunnel, so apps use IPv4.
- **DNS.** DNS stays inside the tunnel. Litport does not look names up itself: they are resolved through the proxy exit, so a website normally sees a resolver that matches the exit. Where a lookup lands depends on the provider, so this can vary.
- **Placeholder addresses.** `nslookup` shows addresses like 198.18.x.x. That is normal. The real lookup happens at the exit. A name that does not exist shows as a failed connection, not as "not found".
- **Secure DNS in browsers.** A browser with its own secure DNS (DNS over HTTPS) still goes through the tunnel, but it does not use Litport's resolver.
- **UDP.** UDP works through proxies that carry UDP, such as the pay-per-GB pools marked UDP. See [UDP in the pay-per-GB guide](/docs/ppg-proxies#udp). Other proxies refuse UDP, and apps fall back to TCP. How well that works depends on the app.
- **Ports.** TCP to the usual web ports is allowed, plus SSH (22), mail (465, 587, 993, 995) and RDP (3389). Port 25 is closed. Other TCP ports are refused. Ask support if an app needs another port.

## Pay-per-GB traffic

A VPN sends everything the device sends: app updates, photo backups, video. On a pay-per-GB token every byte is billed at the pool's rate, so watch your balance. There is no separate VPN spending limit yet.

On a rotating pay-per-GB session, a name's lookup and the connection to it can leave from different exits in the same location. Choose a keep-IP time on the profile to keep them together.

## Change the exit

Link the profile to another token, or press **New IP**. Open connections close within a few seconds and apps reconnect through the new exit. The device's IP changes, so apps and sites see a new IP.

## Check your setup

Open the [check page](/check) on the device while the tunnel is on. It shows the IP and location websites see, where this browser's DNS lookups land, and whether IPv6 or WebRTC show another address. It checks that browser only, not other apps.

If the profile does not connect:

- Check that it has a linked token and that the token is active.
- Check that the profile is not paused.
- If the profile still says **Never connected**, the tunnel never reached Litport. Try port 443.
- On Android, set Private DNS to **Automatic** or **Off**.

## Allowed use

Use a profile only on your own devices. The same uses are prohibited as with proxies: peer-to-peer file sharing and torrents, sending spam, attacking or scanning networks, and fraud. Litport records the destinations of VPN traffic as it does for proxy traffic, and which token a profile used. A profile that is abused can be paused. See the [Terms of Use](/terms-of-use) and the [Appropriate Use Policy](/appropriate-use-policy).