Organizations— Managed tenants

Sites— Routing locations

Devices— Awaiting data

Gateways— Awaiting data

Policies— Signed configurations

Users— Authorized identities

Fleet activity

Recently seen devices

Data plane

Gateway readiness

Not yet refreshed

Loading published releases...

Release packages never contain enrollment codes, gateway bootstrap values, administrator tokens, or private keys. Transfer enrollment material separately through a protected channel.

Windows x64

Endpoint installers

With Reach 0.3.29 or later, install for a managed device, or sign in and use only your approved user VPN without enrolling the computer. Existing managed-device enrollment is preserved during upgrades.

Reach 0.3.29 and later include the Reach service, tray app, and Reach's private copy of the official WireGuard runtime. It does not alter or depend on a separate WireGuard installation. Temporary private-trust builds are clearly marked and should be used only for controlled preview testing.

Raspberry Pi arm64

Gateway package

For Raspberry Pi OS or Debian Bookworm/Trixie on 64-bit ARM.

Super-admin

Release administration

Upload a verified candidate as a draft, review its server-recorded identity, then publish it.

Upload release candidate

The server independently verifies allowed types, size, SHA-256, version, and Windows signatures.

For Windows, upload the MSI first, the optional delivery EXE second, and the detached-signed release manifest last. The manifest freezes that installer set. A Raspberry Pi bundle creates its own one-file draft.

Package type

Version

Release file

Select a package to calculate its upload SHA-256.

Uploaded Reach release artifacts
Release	Package	Integrity	State	Created	Actions

Create organization

A new organization starts with a Default Site, private-network policy templates and an initial administrators-only access group. Enroll a gateway, review its network setup, then add the users or groups you want to allow. Each organization can customize its own policies.

Organizations managed by Reach Control
Organization	Access	Sites	Users	Devices	Gateways	Policies	Actions

Site health and active-session telemetry will appear when the server supports those endpoints.

Create site

New sites start with failover, private-network policy templates and administrators-only access. DNS follows the gateway unless a policy specifies it, with 1.1.1.1 as the last fallback. The first eligible enrolled gateway binds an untouched starter policy. Editing an existing site does not reset its policies or permissions.

Organization

Site name

Gateway selection

Failover keeps sessions on the preferred healthy gateway and moves new sessions only when needed.

Use as this organization's default site

Gateway pools

Site routing and health

Priority is evaluated first for failover. Weight influences round robin; least connections uses current active-session counts.

Endpoint location

Device site assignments

Every device belongs to exactly one site in its organization.

Device site assignments
Device	Organization	Current site	Assignment

User destinations

User site access

Choose each user's default and additional sites, with an optional user access policy for each site.

User site access by organization
User	Organization	Configured access	Actions

Live authorization

Active user sessions

Active grants are joined to fresh per-peer gateway handshakes and cumulative transfer counters when the selected gateway reports them.

Active user VPN sessions by site
User	Site	Gateway	Connection	Gateway traffic	Expires

Enrolled Reach devices
Device	Organization	Last seen	Lifecycle	Reported VPN status	Desired state	Policy	Actions

Next steps

Continue gateway setup

Use the one-time enrollment value above with the selected platform.

Organization: —
Site: —
Platform: —
Code expires: —

The enrollment value is deliberately separate from every package URL and command below. The recommended Linux installer accepts it only through a hidden terminal prompt. For unattended Linux or Windows Server setup, download its one-time .vpngw file and transfer a copy through a protected channel; the staging commands validate and remove that transferred copy. For multiple-use invitations, keep the original only in a protected administrator vault until every intended gateway enrolls, then delete it and revoke the code.

Linux / Raspberry Pi

Checking for a published signed gateway package…

Recommended

Interactive setup

Copy and run this two-line command on the Linux gateway. The installer downloads and authenticates the current signed release, opens a guided configuration wizard, and asks for the enrollment value through a hidden terminal prompt. Paste it only when prompted; it never appears in command history or process arguments.

Download, then run the interactive installer

The download must succeed before execution can start, and no network response is piped into a shell. Remove the second line if you want to inspect the script first. A reusable vpngw2. invitation still requires the wizard to collect and validate strict gateway configuration and registration.

Advanced / unattended setup

Use this flow when deployment automation has already prepared separate protected enrollment and strict configuration files. Never put the enrollment value itself in a command, environment variable, URL, or log.

File-based installer

Run with protected enrollment and configuration files

Replace both absolute placeholder paths before running the command. The files must be private regular files controlled by root or by the invoking administrator. Reach copies them into volatile root-only storage for installation and leaves the caller-owned source files in place for deployment automation to retain or remove.

Manual pinned-package fallback

Use the lower-level flow below only when you need to inspect and execute a specific portal release ticket instead of resolving the current signed release automatically.

1. Securely stage the downloaded enrollment file

The command asks only for the transferred file's absolute path, restricts it to mode 0600, validates the bounded value, atomically writes root-only /root/reach-gateway.vpngw, then removes that source copy. The value never appears in shell history or process arguments.

Before installing this invitation, you must stage an approved strict gateway configuration at /root/reach-gateway.json with mode 0600. The configuration supplies the gateway name, endpoint, peer pools, allowed destination networks, egress interface, and NAT policy.

Active gateway enrollment codes

Only non-secret metadata remains after generation. Revoke a code to stop future enrollments.

Organization

Active gateway enrollment codes for the selected organization
Code ID	Site	Uses	Created	Expires	Actions

Connect this site

Gateway network setup

Select a gateway to load its managed profile.

1. Enroll the gateway. 2. Review and activate its network settings below. 3. Use Access to assign users or groups to this site. Network readiness does not grant access.

Changes are saved as a draft first. They do not reach the gateway until a super-admin reviews the exact server revision and hash, completes fresh identity verification, and queues activation. The gateway applies the signed profile over its outbound control connection.

Technical delivery status

Management—

Delivery—

Desired revision—

Applied revision—

Gateway report—

Reported error—

Optional router port forwarding

Optional direct path

Manual UDP port forwards

Configure each mapping on the gateway's router. Reach uses it only after an authenticated peer check succeeds.

No eligible manual port forwards.

Suggested manual UDP port forwards
Peer	Router mapping	Reachability	Last check

Edit network settings

Site network

Networks this gateway can reach

One IP range (CIDR) per line. New setups start with all private IPv4 ranges. Narrow these to your site's networks as needed. Site and user policies can restrict them further; this does not allow everyone in.

Network adapter toward your LAN

Use the actual Linux adapter name from the gateway's installed configuration. Reach does not detect this here.

Gateway LAN IP selection

Automatic uses fresh addresses reported by this gateway, even after DHCP changes its IP. Clients test only addresses on their directly connected network and authenticate the gateway before use. Existing configurations remain Manual until changed. Update older gateways before activating Automatic.

Manual / legacy direct address and UDP port

Kept from enrollment for legacy direct-only clients. In Manual mode, LAN discovery is pinned to this literal IP. In Automatic mode, negotiated LAN paths use live reported IPs and ports instead. Public STUN and port-forward methods follow connection policy.

VPN adapter name

Usually mwg0. For an existing gateway, match its current configuration.

Local WireGuard UDP port

Usually 51820. Can differ from the router's external port.

Gateway VPN interface addresses

Use NAT for access to LAN networks (recommended for new setups)

NAT lets LAN devices reply without extra return routes. Leave it off if your organization manages return routes itself.

Allow direct connections when reachable

Relay availability is controlled separately by the organization's connection policy. This switch does not configure TURN.

Server-authoritative draft

Review changes

Not loaded

Draft revision: —
Draft SHA-256: —
Desired SHA-256: —
Target platform: —

Save a draft to see its structural changes.

Reach WireGuard gateways
Gateway	Endpoint	Platform	Revision	Last seen	Actions

Machine identity

Device tunnel routes

Available before sign-in for computer-level services. Keep these routes narrow; for example, Active Directory domain controllers, DNS, certificate services, and Reach management.

Applies to the enrolled device

Person identity

User access routes

Available only after Reach Login authorizes the signed-in person. These destinations may be broader for business applications and never expand the device tunnel's machine routes.

Default deny without an explicit assignment

Your authorization

Your effective VPN access

Only the routes and DNS servers listed here can be requested after Reach Login.

This page shows authorization scope, not live connection state. Use the Reach tray icon for connection status.

Signed-in people

User access routes

Create an organization-scoped destination boundary, then explicitly assign it to a portal user.

Bindings supported in this release: individual Reach portal users. Group bindings are not yet available. A user without an assignment is denied a user tunnel by default.

Create user access policy

Organization

Policy name

Allow assigned users to request this access

Allowed destination CIDRs

One IPv4 or IPv6 CIDR per line. Reach canonicalizes and combines overlapping networks.

Per-CIDR ports (optional)

One rule per line: CIDR followed by tcp: and/or udp: port lists. Use commas and inclusive ranges. CIDRs without a rule remain unrestricted.

DNS servers (optional)

One IPv4 or IPv6 address per line; no hostnames or secrets. Leave this empty unless the user tunnel must change host-wide DNS resolution; the device tunnel should normally retain AD and DNS service.

User assignments

Each portal user can have one user access policy per organization. Assigning another policy replaces the current assignment.

Explicit user access policy assignments
Portal user	Organization	User access policy	Assigned	Actions

Enrolled machines

Device tunnel routes and behavior

Signed device policies control pre-login connectivity, providers, DNS, trusted-network behavior, and machine route scope.

Edit existing policy

Device policy

Policy name

Make this organization's default

Basic device VPN settings

Reach managed gateway

Select the default/fallback gateway for this policy. A device's site strategy can choose another eligible gateway at that site for redundancy.

Connection transport

Automatic uses the signed path order: private/IPv6 direct, port forwarding, STUN hole punching, then server-supplied TURN over UDP or TLS. It requires an enrolled Linux gateway and private/ULA split routes; Windows gateways and full/public routes require Direct only. Existing Direct only policies change only when you select Automatic. Router mapping protocols remain opt-in in Advanced settings; TURN credentials must be configured by the super-admin.

Enable this device tunnel when assigned Start and maintain the tunnel automatically

Default device state

Traffic scope

Device IP addresses and CIDR ranges

One IPv4/IPv6 address or CIDR per line. A single address is treated as one host. Split traffic requires at least one entry.

Per-CIDR ports (optional)

Managed WireGuard only. Any allowed CIDR without a rule permits all ports; each rule uses a CIDR followed by tcp: and/or udp: lists.

DNS servers (optional)

One IPv4 or IPv6 DNS server per line. Reach keeps the structured policy and standard single-peer WireGuard configuration synchronized.

Device diagnostics Enable detailed debug event logging on this device

Off by default. Applies to Reach service, tray operations, and both Device and User VPNs, including users of other organizations. Windows Application log, source ManagedVpn.Service, events 4200–4209. Credentials, keys, tokens and packet contents are excluded; repeated events are rate-limited. Requires Windows Reach 0.3.48 or later. Turn off after troubleshooting; no service restart is needed after policy refresh.

Control-plane outage continuity Maximum offline hours

0 disables the allowance. Up to 8 hours from the last successful authorization allows known peers to keep or restore reachable paths. User sign-in expiry still applies. New revocations reach offline devices when control contact resumes. Requires Reach 0.3.55 and a compatible gateway.

User VPN Enable User VPN and tray sign-in

Users still need an assigned User Access Policy, such as Techs, and site permission. Enabling User VPN does not grant access or connect a signed-out user. First-time setup uses the device tunnel's managed gateway and route ceiling; existing User VPN settings stay independent. Custom user settings are available in Advanced JSON.

When User VPN is disabled Hide the User VPN section, account controls, and user settings Hide the Reach tray icon entirely

Optional; both default to off. These choices apply only while this device policy disables User VPN, and are retained if it is re-enabled. Requires Windows Reach 0.3.35 or later. The VPN service keeps running and checking policy; Reach can still be opened from the Start menu. Hiding UI does not change access permissions.

Remembered User VPN login Require a new login after (days) Expire after no successful renewal for (days)

Defaults: 30 days maximum and 7 days without a successful renewal. Current clients use Reach's own remembered login after SSO verification. The shortest device and selected organization policy applies, capped by certificate expiry. Renewals do not extend the original maximum; existing registrations need a fresh login for a longer duration.

Changing sites or organizations, signing out, or switching accounts requires a new login and registration key. This does not extend administrative SSO verification.

Reach password resets revoke remembered access immediately; connected gateways apply peer removal on their next synchronization. Company SSO password resets require a separate Auth-service notification integration.

User VPN organization guard

When User VPN is enabled, restrict which organization's user VPN this device may join. This guard does not enable sign-in or grant access; the user's organization, site, and User Access Policy permissions are also required.

Allow any organization Default. The user's eligible organizations determine what they may connect to. Device organization only Block user VPN connections to every other organization. Selected organizations Permit only an explicit organization whitelist on this device.

Trusted local network Pause Device VPN after an authenticated local tunnel test DHCP DNS suffixes Maximum encrypted reply time (ms)

Requires Windows Reach 0.3.49 and a gateway with local tunnel verification. Every encrypted reply must be below this limit on the same physical adapter as the DHCP suffix. Rechecks continue while paused; failed or expired proof resumes Device VPN. User VPN stays separate. This replaces other trusted-network checks in this policy. A nearby relay can still meet the time limit.

Advanced path and JSON settings

Tunnel path settings

Choose an Automatic WireGuard tunnel (wire format: relay). Device and User tunnel order, toggles, TURN standby, and manual forwarding remain independent.

Direct-path preference order for the selected tunnel

Reach tries enabled methods from top to bottom. Move methods to set preference; router protocols remain opt-in.

Ordered direct-path policy methods
Order	Method	Enabled	Move

Keep TURN credentials ready as standby while a direct path is active

Manual port-forward mode

Specific external UDP port

Strict policy JSON

Basic, organization, and path controls update this signed JSON. After editing JSON directly, leave the field to reload every control.

Saving creates a new signed revision. Assigned devices refresh their configuration, and active user grants may be revoked for re-evaluation.

Create device policy

Organization

Policy name

Make this organization's default device policy

Starting point

Basic device VPN settings

Reach managed gateway

Select an organization gateway to create the provider configuration automatically. A device's site strategy can choose another eligible gateway at that site for redundancy.

Connection transport

The blank Reach starter selects Automatic when you choose an enrolled Linux gateway with private/ULA split routes. Cloned defaults retain their transport. Windows gateways and full/public routes require Direct only. Automatic tries signed direct paths and STUN hole punching, with server-supplied TURN UDP/TLS fallback; the super-admin must configure TURN credentials. PCP, NAT-PMP, and UPnP remain opt-in in Advanced JSON.

Enable this device tunnel when assigned Start and maintain the tunnel automatically

Default device state

Traffic scope

Device IP addresses and CIDR ranges

One IPv4/IPv6 address or CIDR per line. A single address is treated as one host. Split traffic requires at least one entry.

Per-CIDR ports (optional)

Managed WireGuard only. Any allowed CIDR without a rule permits all ports; each rule uses a CIDR followed by tcp: and/or udp: lists.

DNS servers (optional)

One IPv4 or IPv6 DNS server per line. Reach keeps the structured policy and standard single-peer WireGuard configuration synchronized.

Device diagnostics Enable detailed debug event logging on assigned devices

Off by default. Covers Reach service, tray operations, and both VPNs on every device assigned this policy, even when User VPN connects to another organization. Excludes credentials, keys, tokens and packet contents. Events are rate-limited. Requires Windows Reach 0.3.48 or later; takes effect on policy refresh without restarting. Disable after troubleshooting.

Control-plane outage continuity Maximum offline hours

0 disables the allowance. Up to 8 hours from the last successful authorization allows known peers to keep or restore reachable paths. User sign-in expiry still applies. New revocations reach offline devices when control contact resumes. Requires Reach 0.3.55 and a compatible gateway.

User VPN Enable User VPN and tray sign-in

On by default for new policies. Users still need an assigned User Access Policy and site permission. First-time setup uses the device tunnel's managed gateway and route ceiling; existing User VPN settings and organization restrictions are preserved. This does not connect a signed-out user. Other authentication settings and organization restrictions can be reviewed in Advanced JSON.

When User VPN is disabled Hide the User VPN section, account controls, and user settings Hide the Reach tray icon entirely

Optional; both default to off. These choices apply only while this device policy disables User VPN, and are retained if it is re-enabled. Requires Windows Reach 0.3.35 or later. The VPN service keeps running and checking policy; Reach can still be opened from the Start menu. Hiding UI does not change access permissions.

Trusted local network Pause Device VPN after an authenticated local tunnel test DHCP DNS suffixes Maximum encrypted reply time (ms)

Requires Windows Reach 0.3.49 and a gateway with local tunnel verification. Every encrypted reply must be below this limit on the same physical adapter as the DHCP suffix. Rechecks continue while paused; failed or expired proof resumes Device VPN. User VPN stays separate. This replaces other trusted-network checks in this policy. A nearby relay can still meet the time limit.

Advanced JSON settings

Strict policy JSON

The selected organization's complete current default is cloned first. Advanced trusted-network, gateway, provider, authentication, and path settings are preserved unless changed here.

Passwords are write-only. Reach Control never returns or displays a stored password.

Add OpenVPN credential

Stored OpenVPN credential metadata
Name	Organization	Username	Revision	Actions

Active device enrollment codes for the selected organization
Label	Code ID	Policy	Uses	Expires	Actions

Activation can be blocked while gateways are active or until enrolled devices acknowledge staged trust.

Reach Control signing keys
Key ID	State	SPKI SHA-256	Created	Actions

The TURN API token / API key is write-only. Reach stores it encrypted and gives endpoints only short-lived, session-bound credentials. Disabling relay can strand policies using transport_mode: relay (shown as Automatic in device policies). Automatic currently supports Windows clients with an enrolled Linux gateway and private/ULA split routes; it can use direct paths without relaying. Direct only remains available separately. Test saved credentials checks HTTPS credential issuance only, not a TURN allocation or cross-NAT connectivity.

Cloudflare Realtime

TURN provider

Configuration has not loaded.

Unknown

Enable Cloudflare TURN credential issuance

TURN Token ID (32 characters)

Credential lifetime

New TURN API token / API key (64 characters; leave blank to keep the stored value)

Use the 64-character secret paired with the TURN Token ID, not a Cloudflare account Global API Key or general Calls API token. The stored value is write-only and is never returned or displayed.

Your current password

Required for each saved credential or relay configuration change.

Allowed relay transports UDP 3478 (preferred, best performance) TLS over TCP 443 (fallback for restricted networks)

Access & security groups

Site assignments grant access. All applicable policies narrow it. A deny always wins. Gateway preferences never grant permissions.

Create user

Reach Control users and access
User	Role	Organizations	Status	Actions

Profile and access

Name: —
Username: —
Role: —
Organizations: —
Session expires: —

Company SSO verification

Sign in

Create the first super-admin

All organizations

Enrollment secret (shown once)

Network overview

Recently seen devices

Gateway readiness

Downloads

Endpoint installers

Gateway package

Raspberry Pi install commands

Release administration

Upload release candidate

Organizations

Sites

Site routing and health

Device site assignments

User site access

User site access

Active user sessions

Devices

Gateways

Continue gateway setup

Linux / Raspberry Pi

Interactive setup

File-based installer

Manual pinned-package fallback

Windows Server

Active gateway enrollment codes

Gateway network setup

Manual UDP port forwards

Review changes

VPN access policies

Device tunnel routes

User access routes

Your effective VPN access

User access routes

User assignments

Device tunnel routes and behavior

Device policy

OpenVPN credentials

OpenVPN credential

Device enrollment

Signing keys

NAT traversal

TURN provider

Access & security groups

Users

User

Reset password

Account

Profile and access

Change password

Manage company account