Because a WireGuard config is the credential, losing a device means losing a key to the office. The good news: revoking it is the simplest operation in all of VPN administration — if you do it promptly and completely.
People delay revocation because it sounds complicated. In WireGuard it is the opposite: one deletion on the firewall outranks every copy of the config in the world. This page gives the routine for the three moments it matters, the clean way to reissue, and the rare bigger case where the whole setup rotates.
Illustrative panel — the tunnels list should always match the list of people and devices you actually trust.
There is no "log out everywhere" button because there are no accounts or sessions. Access is a tunnel entry on the firewall holding a public key. Delete the tunnel, and every copy of that config — on the lost phone, in an old email, in a backup — becomes worthless paper. The next handshake simply never completes. In the Untangle app: open Apps → WireGuard VPN → Tunnels, delete the person's tunnel, and Save. Done in under a minute, effective immediately, with nothing to chase on the device itself — which matters, because the device is usually the thing you no longer have.
For the replacement, create a brand-new tunnel rather than resurrecting the old one — new tunnel means new keys, so anything copied from the old setup stays dead. Keep the naming discipline (Priya-Phone-2 is fine and even tells the story). Deliver the new QR/config over a private channel, watch the person connect once, and confirm the handshake before you both move on.
The one bigger case: if the firewall's own admin access was compromised, or configs were bulk-exported by someone untrusted, individual deletions are not enough. Then the routine is: reset the WireGuard app's server keys (reinstalling/resetting the app's configuration on the Untangle box), recreate every tunnel, and reissue every client. It is an hour of work for a small office and it is the only honest answer — partial rotation leaves you guessing which keys are clean. Afterwards, review who has firewall admin rights; the VPN was probably not the only door they could open.
See the Tunnels tab in action in the setup video — it is the same screen you will use for every revocation.
▶️ Watch Full VideoYes, effectively. The tunnel has no long-lived session to drain — once the peer is gone from the firewall, the client's next handshake fails and no traffic passes. Anything already open through the tunnel stops with it.
No. Deleting on their word is trust, not administration — copies survive in backups, email and screenshots. Delete the tunnel on the firewall; that is the only deletion you can verify.
Disabling is fine for a temporary pause — a device in for repair, a contractor between visits. For anything involving trust (loss, leaving, leakage), delete it. A disabled tunnel is one click away from being enabled again by anyone with admin access; a deleted one must be recreated from scratch.