Install a WireGuard Config on iPhone, Android, Windows and macOS (2026)

WireGuard is the protocol most people should use first. It is small, it reconnects almost instantly when you move between Wi-Fi and mobile data, and the whole configuration fits in about a dozen lines of text. This guide covers the actual mechanics: getting the configuration onto each platform, keeping several servers ready so switching takes two taps, reading the config so you know what you are looking at, and fixing the three failures that account for nearly every "it will not connect" message.

If you bought the private VPN here, your WireGuard tunnel is waiting on your order page. Open it with the eight character magic code you were given after payment (it looks like AB12-CDEF). There is no account and no password to remember, which also means the magic code is the only way back in, so save it somewhere before you close the tab. The same code opens the order page for a UK Number or a travel data plan bought on the same order.

Get the official app first

Use the official WireGuard client, not a repackaged one. It is the reference implementation, it is open source, and it does not add an account layer of its own.

• iPhone and iPad: "WireGuard" on the App Store, published by WireGuard Development Team.
• Android: "WireGuard" on Google Play, or the same app from F-Droid if you keep a Google-free phone. Both are built from the same source.
• Windows and macOS: the installers on wireguard.com. On macOS the App Store build is the same client and updates itself, which is usually the easier choice.
• Linux: the wireguard-tools package from your distribution, then wg-quick up with the file.

The app asks for permission to add a VPN configuration the first time you activate a tunnel. That prompt is the operating system, not the app, and it is unavoidable: a VPN has to install a network profile to route your traffic.

Two import paths: QR scan and file import

Every WireGuard client accepts the same configuration in two shapes. Use whichever matches the device you are setting up.

QR scan, for phones

Open your order page on a computer so the QR is on a second screen, then on the phone open WireGuard, tap the plus button, choose Create from QR code, and point the camera at it. The app asks for a name for the tunnel. Name it after the location, not "VPN", because you will end up with several and a list of tunnels called VPN 1 through VPN 4 helps nobody.

Do not scan a QR from the same screen you are reading it on. If the phone is the only device you have, download the .conf file instead and use the file path below.

File import, for everything

Download the .conf file from your order page, then:

• iOS: save it to Files, open WireGuard, plus button, Create from file or archive, pick it.
• Android: plus button, Import from file or archive. A zip of several tunnels imports all of them at once.
• Windows: Import tunnel(s) from file in the bottom left, or just drag the file onto the app window.
• macOS: the plus button in the bottom left, then Import tunnel(s) from file.

Treat the file the way you would treat a password. It contains a private key, and anyone holding it can use your connection. Delete it from your downloads folder once it is imported.

What each line of the config means

A WireGuard configuration is two blocks. [Interface] describes your end, [Peer] describes the server. You do not have to understand any of it to connect, but knowing what the lines do turns troubleshooting from guessing into reading.

Two of these decide how the tunnel behaves day to day. AllowedIPs set to 0.0.0.0/0, ::/0 is full tunnel: every connection goes through the VPN. Narrower values create split tunnelling, where only some ranges go through. PersistentKeepalive is what stops a mobile network from quietly dropping an idle tunnel, which is why a connection that "works and then stops after ten minutes" is often a keepalive problem rather than a server problem.

Holding several tunnels and switching between them

One account works on every server we list, in dozens of countries, so there is no reason to keep only one tunnel. Import three or four: one nearby for speed, one in the country you need to appear in, and one somewhere else entirely as a fallback when a network misbehaves.

Every WireGuard client keeps one tunnel active at a time. Activating a second deactivates the first automatically, so switching is a single toggle. Practical notes per platform:

• iOS and Android: the tunnel list is the main screen. Long press to rename or delete. On Android you can add a quick settings tile for the last used tunnel.
• Windows: tunnels are listed down the left side. The app also lives in the system tray, so you can switch without opening the window.
• macOS: the menu bar icon lists every tunnel, so switching is two clicks from anywhere.

Give each tunnel a name that tells you the city and the protocol, for example "Berlin WG". You will thank yourself when you also have OpenVPN profiles installed.

On-demand and always-on

Each platform offers a different amount of automation, and the names are unhelpfully different.

The iOS on-demand exception list is the genuinely useful one. Add your home Wi-Fi as an excluded network and the tunnel will come up everywhere else on its own, without you ever thinking about it. On Android, "Block connections without VPN" is what actually prevents traffic escaping in the seconds between losing and regaining a connection. Turn it on if that matters to you, and be aware that it also means the phone has no internet at all while the tunnel is down.

Troubleshooting, in the order worth trying

No handshake at all

The app shows a tunnel as active but "Latest handshake" never appears and no traffic moves. That means your packets are not reaching the endpoint, or the reply is not coming back. Work down this list:

1. Check the device clock. The WireGuard handshake carries a timestamp. A phone or laptop whose clock is badly wrong gets rejected. Set date and time to automatic.
2. Try a different network. Switch from Wi-Fi to mobile data. If it connects on mobile data, the Wi-Fi network is blocking it, and no amount of editing the config will change that.
3. Try another server. One endpoint may be unreachable from your route while others are fine. This is exactly why you imported several tunnels.
4. Check you are not running the same config twice. WireGuard identifies you by key, not by device. If the identical tunnel is active on two devices at once, the server's route for that key follows whichever handshake arrived last and both connections behave erratically. Use a separate configuration per device.
5. Re-import the file. A config copied by hand from a screenshot usually has a broken key. Import the file rather than retyping it.

If nothing gets a handshake on any server, that is the point to contact support with your magic code. Our refund policy covers a service that will not connect on any server after troubleshooting. It does not cover one slow server, because the fix for that is to switch.

Connected, but websites will not resolve

The handshake succeeds, an IP address check shows the VPN location, but names do not resolve. This is almost always DNS.

• Confirm the config has a DNS line. Without one, the device keeps using its previous resolver, which both leaks your lookups and often fails inside the tunnel.
• On Android, check Private DNS in system settings. If it is set to a specific hostname, it can conflict with the tunnel's resolver. Set it to Automatic or Off and retest.
• On macOS and Windows, disconnect and reconnect once after changing DNS settings. Both cache aggressively.
• If you use a network-level ad blocker at home, it may be intercepting port 53 and confusing the picture. Test on mobile data to rule it out.

Connected, but large pages and downloads stall

This is the MTU problem, and it is the most misdiagnosed of the three. The signature is specific: the handshake works, small requests succeed, then a big download or a page with many assets hangs and eventually times out. Some mobile networks and some home connections wrap your traffic in an extra layer, leaving less room inside each packet than WireGuard assumed.

The fix is one line. Edit the tunnel, and in [Interface] set MTU lower. Try 1420 first if there is no value at all, then 1380, then 1280. Reconnect after each change. Lower values cost a little throughput and 1280 is the safe floor for IPv6, so stop at the first value that works rather than going straight to the bottom.

The network blocks UDP entirely

WireGuard only speaks UDP. There is no TCP mode, and there is no configuration change that creates one. Some corporate networks, some university networks, some hotel captive portals and some mobile carriers allow only TCP on ports 80 and 443. On those networks WireGuard cannot work, however the tunnel is configured.

What to do instead, in order:

1. OpenVPN over TCP 443. Your order page carries .ovpn profiles in UDP and TCP variants. The TCP one on port 443 looks like an ordinary encrypted connection to a web server at the level of ports, which is enough for most restrictive corporate networks. It is slower than WireGuard, and on a network like this that trade is worth making.
2. VLESS. If the network inspects traffic rather than just filtering ports, a TLS-fronted VLESS stream is the next thing to try. That is a longer subject with its own client apps, and it has its own guide: VLESS explained, what to try when WireGuard is blocked.

One thing to remember about eSIMs

Turn the VPN off while you install an eSIM. The download of an eSIM profile has to reach the operator directly, and a tunnel in the way is a common cause of an install that hangs at "Activating". Install the eSIM first, confirm it has signal, then bring the tunnel back up. The same applies to a bundle where the VPN and an eSIM arrive on one order page.

What to do next

If your tunnel is up, do two small things now and save yourself a bad evening later. Import a second and third server so switching is a toggle rather than a project, and store your magic code somewhere you will still have it in six months, because it is the only way back to your order page and there is no account to recover.

If you are still deciding, the VPN page lists what is delivered and the plan lengths from 7 to 365 days, and the status page opens an existing order with the magic code. If you are reading this because a network is blocking you rather than because something broke, skip ahead to the VLESS guide, which covers what deep packet inspection actually looks for and what to try in which order.