WireGuard, relayed.

→ The mental model (read this first)

21tunnel does not host a WireGuard server for you. You run the WireGuard server on your own machine; 21tunnel reserves a public UDP endpoint and relays datagrams to it — so remote clients reach your box even though it has no public IP and no forwarded port. Your private keys never leave your device; we store only public keys.

  WG client (phone / laptop)                    YOUR box
  official WireGuard app                        two things run here:
        │                                         (1) wg-quick up wg0   ← the WG server
        │  Endpoint =                             (2) mytunnel udp 51820 --public-port 31099
        │  agent.21tunnel.com:31099                       ▲   ← the relay (MUST stay running)
        └───────────────►  21tunnel relay  ──────────────┘
                           (reserved UDP port 31099)

2 Bring it up (one command on Linux)

On a Linux box, install the CLI and run one command. It generates the server keypair (the private key stays on the box), registers it, brings the WireGuard interface up, starts the relay, and keeps it reconnecting — the whole thing, so there's no two-process dance to get wrong.

# on the box that will host the VPN server:
curl -fsSL https://login.21tunnel.com/install.sh | sh
mytunnel login                       # authenticate this machine once

# bring the whole VPN up (root needed for wg-quick):
sudo -E mytunnel wg up "my-vpn"      # the network's name (or id) from the dashboard

# 1) start the WireGuard server locally (or import wg0.conf into the WireGuard app)
wg-quick up wg0

# 2) relay its UDP port through 21tunnel — the exact command is printed on
#    your wg0.conf, with your reserved port already filled in:
mytunnel udp 51820 --public-port 31099

★ Keep it alive

The VPN is only reachable while the relay runs. mytunnel wg up already reconnects on its own while it's running, but a foreground process dies on reboot — run it as a service for anything real.

# stash your tunnel key where only root can read it
sudo mkdir -p /etc/21tunnel
echo 'MYTUNNEL_API_KEY=mtk_your_key_here' | sudo tee /etc/21tunnel/vpn.env >/dev/null
sudo chmod 600 /etc/21tunnel/vpn.env

sudo tee /etc/systemd/system/21tunnel-vpn.service >/dev/null <<'UNIT'
[Unit]
Description=21tunnel managed WireGuard VPN
After=network-online.target
Wants=network-online.target

[Service]
EnvironmentFile=/etc/21tunnel/vpn.env
ExecStart=/usr/local/bin/mytunnel wg up "my-vpn"
Restart=always
RestartSec=3
User=root

[Install]
WantedBy=multi-user.target
UNIT
sudo systemctl enable --now 21tunnel-vpn

Doing the manual (mytunnel udp …) flow instead? Keep that relay alive the same way:

nohup mytunnel udp 51820 --public-port 31099 > mytunnel-relay.log 2>&1 &

sudo tee /etc/systemd/system/mytunnel-vpn.service >/dev/null <<'UNIT'
[Unit]
Description=21tunnel WireGuard relay
After=network-online.target wg-quick@wg0.service
Wants=network-online.target

[Service]
ExecStart=/usr/local/bin/mytunnel udp 51820 --public-port 31099
Restart=always
RestartSec=3
User=root

[Install]
WantedBy=multi-user.target
UNIT
sudo systemctl enable --now wg-quick@wg0
sudo systemctl enable --now mytunnel-vpn

↔ Split tunnel vs full tunnel

The generated client .conf defaults to a split tunnel — only traffic to the VPN subnet goes over WireGuard; everything else uses the client's normal internet.

→ Next