Office connection

RequirementsCopy Anchor Link

Use a router with WireGuard, IPv4 forwarding, policy routing, and firewall controls. Your account needs an available gateway. Contact support if none appears.

Office subnets must use private RFC 1918 IPv4 ranges. An account supports up to 16 interconnects, each with up to 16 nonoverlapping subnets. Different interconnects can reuse the same subnet.

Router keysCopy Anchor Link

Generate a WireGuard key pair on your router. On Linux:

umask 077
wg genkey > office-private.key
wg pubkey < office-private.key > office-public.key

Keep the private key on the router. You will paste only the public key into Loclix.

Interconnect configurationCopy Anchor Link

1. Open account Private Connect.
2. Select Create interconnect.
3. Enter a name.
4. Select a gateway.
5. Enter your office IPv4 subnets, or generate a range from the client count.
6. Enter the router's public key.
7. Select Create interconnect.

Open Manage interconnect and copy the office tunnel template. Replace <OFFICE_PRIVATE_KEY> with your router's private key and restrict access to the resulting file.

The template includes the endpoint, gateway public key, tunnel and DNS addresses, and a 1380-byte MTU. Use these supplied values; changing the gateway assignment can change its addresses and port.

See Office subnet and DHCP for client addressing.

Office routesCopy Anchor Link

Configure the following on your router using its vendor documentation:

• Enable IPv4 forwarding and route office Internet traffic through WireGuard.
• Keep the public gateway endpoint reachable through the office Internet connection.
• Keep local office networks and router management outside the tunnel default route.
• Configure clients to use the tunnel DNS address.
• Preserve client source IPs through the tunnel; do not apply source NAT on the office router.

Loclix performs NAT at the gateway. Applying NAT before the tunnel combines client usage under the router's address.

The template's AllowedIPs = 0.0.0.0/0 allows Internet destinations through the peer. You must still configure forwarding, client DNS, and firewall rules. Only your saved office subnets and assigned router tunnel address are accepted as source addresses.

Bypass preventionCopy Anchor Link

Configure a router kill switch to block office Internet traffic outside WireGuard while allowing the gateway endpoint through the regular connection. Block direct IPv6 Internet access if office traffic must stay within Private Connect, which currently supports IPv4.

Use browser or device policies to disable DNS over HTTPS where required. DNS response policies alone cannot stop encrypted DNS carried over ordinary HTTPS.

Connection checksCopy Anchor Link

Send traffic from an office device, then open Analytics. Check for a recent WireGuard handshake, increasing transfer counters, and the expected client source IPs.

If the handshake is missing, check the router key, endpoint, UDP connectivity, and routing. If usage appears only under the router's address, remove source NAT before the tunnel.

Changes and removalCopy Anchor Link

Saving configuration, including a new router key or DNS policy, briefly interrupts connections and resets analytics counters. Clients need to reconnect.

Clear Enable interconnect to pause it, or select Remove interconnect to delete it. Forwarding stops after the change takes effect, or within 60 seconds if the gateway cannot receive it.

Your router's kill switch determines whether traffic stays blocked during an interruption. Check it before relying on the tunnel as your only Internet path.

See the WireGuard quick start for Linux tool usage.