Skip to main content
Updated November 9, 2026 A VPN gateway lets you reach a VPC’s private IPs from outside Raff. Your servers don’t need public IPs. Traffic through the tunnels is not metered.

​
Before you start

  • A VPC, in any region.
  • For a site-to-site tunnel, a remote network whose range doesn’t overlap the VPC’s range.

​
Add the gateway

1

Open the Services tab

In Networking → VPCs, open the VPC and go to the Services tab.
2

Enable the gateway

Click Enable VPN Gateway, name it or keep the suggested name, and click Enable. If your account pays by subscription, you pay at checkout first.
3

Wait for it to start

Setup usually takes 1-2 minutes. The tab then shows the gateway’s endpoint and its list of devices.

​
Connect a laptop or phone

1

Install WireGuard

Get it from wireguard.com/install or your phone’s app store.
2

Get a config

Under Devices, click Get config on a free device. You can give it a name there.
3

Import it

On a phone, scan the QR code from the WireGuard app. On a computer, click Download .conf and import the file.
4

Activate the tunnel

Turn the tunnel on in WireGuard. You can now reach the VPC’s private IPs.
Use one config per device. Each config holds a private key, so treat it like a password.

​
Connect an office or another network

1

Add the tunnel

Under Site-to-Site Tunnels, click Add tunnel, pick WireGuard or IPsec (IKEv2), and fill in the form.
2

Create it and copy the preshared key

Click Create tunnel. Raff generates a preshared key and shows it on the tunnel’s row.
3

Set up your firewall

Use the values under Your Raff side and the preshared key.WireGuard: enter the public key, the endpoint and the VPC’s local subnet in your firewall’s site-to-site settings. The dashboard lists UniFi Network 8.1+, pfSense, OPNsense and MikroTik.IPsec: use these settings.
The VPC’s servers get a route to your remote subnets within a few minutes, with no restart. Your firewall must send traffic for the VPC’s range through the tunnel.

​
Check that it works

A tunnel’s row shows its state: Then ping a server’s private IP from your device or from a machine on the remote network. If nothing answers, check that the server’s firewall allows the traffic. For a tunnel that doesn’t connect, see Troubleshooting.

​
Limits

​
Remove a tunnel or the gateway

  • Tunnel: click Delete on its row. Traffic to that network stops.
  • Gateway: click Delete at the top of the gateway card. Device configs stop working at once and billing stops. This can’t be undone.
Delete the gateway before you delete the VPC.

Manage a VPC

Detail page tour, including peering.

Features & limits

VPC features, prices and limits.

Troubleshooting

Common VPC issues and fixes.
Last modified on November 9, 2026