Pevnost

How to set up WireGuard on Windows, iPhone, Android, macOS and Linux.

Guide · 17 October 2026 · 8 min

State of things on 17 October 2026: Pevnost is in private beta. Accounts can be created and paid by bank transfer; Bitcoin and Lightning follow once our BTCPay wallet is connected, Monero and cash by post later. The first server is being installed and is not live yet.

Pevnost uses plain WireGuard. There is no proprietary protocol and no account app you must install. You create a key for each device on our account page, download one small configuration file, and import it into the official WireGuard app. Our own Windows app does the same thing with a nicer front and a kill switch; everywhere else the official app is the way.

1. Create the account

  1. Open app.pevnost.net and press Create an account. No name, no e‑mail, no password.
  2. Write down the 24‑character account ID. It is the only key to the account; we cannot recover it.
  3. Pay for 30 days or a year. The page shows a bank account, a variable symbol and the amount. The account is activated within one working day of the money arriving. How each payment method affects your privacy is in a separate guide.

2. Generate a device key

Once the account is active, the page shows Generate device key. Press it once per device. The browser creates a WireGuard key pair locally (with tweetnacl, no network call). Only the public half is sent to us; the private half exists only in that browser tab and inside the file you download. Reload the page and it is gone, which is the point. Up to five devices can be active at once; remove old ones on the same page.

For each server you get a file named like pevnost-prg1.conf. It contains your private key, your tunnel address, our DNS resolver (10.8.0.1 inside the tunnel), the server's public key and endpoint, and AllowedIPs = 0.0.0.0/0, ::/0, which routes everything through the tunnel.

3a. Windows

Our app (beta). Download the zip from the Apps page, unzip it, run Pevnost.exe as administrator, enter the account ID, press Connect. The app generates and rotates the device key itself and ships the WireGuard tunnel and driver, so nothing else is needed. The kill switch is on whenever the tunnel is up.

Official app. Install WireGuard from wireguard.com/install. Open it, press Import tunnel(s) from file, pick the .conf, press Activate. Because the configuration routes all traffic, the official app also installs its firewall rules while the tunnel is active (the option is called Block untunneled traffic (kill‑switch) in the tunnel's edit dialog; it is on when AllowedIPs covers everything).

3b. iPhone and iPad

  1. Install WireGuard from the App Store.
  2. Get the file onto the phone: AirDrop it, save it to Files, or open the account page on the phone itself and download there.
  3. In WireGuard: + → Create from file or archive and pick the .conf. A QR code also works (Create from QR code) if you display the configuration on another screen; our account page shows the text, any QR generator that runs offline will do.
  4. Switch the tunnel on. iOS asks once to add a VPN configuration.

Kill switch on iOS: the app has On‑demand activation in the tunnel settings. Turn it on for cellular and Wi‑Fi; iOS then re‑establishes the tunnel automatically and keeps it up. There is no absolute block of non‑VPN traffic on iOS, Apple does not expose one to third‑party VPN apps.

3c. Android

  1. Install WireGuard from Google Play or F‑Droid.
  2. Copy the .conf to the phone (or download it there).
  3. In WireGuard: + → Import from file or archive, pick the file, switch it on.

Kill switch on Android: in system settings go to Network & internet → VPN, tap the gear next to WireGuard, enable Always‑on VPN and Block connections without VPN. That is the strongest kill switch on any phone platform.

3d. macOS

Install WireGuard from the Mac App Store. Press Import tunnel(s) from file, choose the .conf, activate. The App Store version runs as a network extension and survives sleep well. The Homebrew wireguard-tools package works too (see Linux), but the App Store app is simpler. Our own macOS app is planned, not available yet.

3e. Linux

sudo apt install wireguard            # Debian/Ubuntu; other distros: package "wireguard-tools"
sudo cp pevnost-prg1.conf /etc/wireguard/pevnost.conf
sudo chmod 600 /etc/wireguard/pevnost.conf
sudo wg-quick up pevnost
sudo wg                               # shows the handshake and transfer counters
sudo wg-quick down pevnost

NetworkManager users can import the same file with nmcli connection import type wireguard file pevnost-prg1.conf. For a kill switch on Linux, add nftables rules that only allow traffic on the pevnost interface and to the server endpoint; wg-quick does not do that by itself.

4. Verify it works

5. Rotating keys and removing devices

A device key is random and says nothing about you, but you may still want a fresh one now and then or after a lost phone. On the account page, remove the old device and generate a new key; the old key stops working immediately. Our Windows app rotates its key automatically and tells the server which key the new one replaces, so there is no gap.

If something does not work, write to support@pevnost.net with the platform and the output of wg show (it contains no secrets).