Your own fast, modern VPN server — running on the firewall you already have. Install the WireGuard app on Untangle, create one tunnel per device, and connect from Windows or your phone. No separate server, no config files typed by hand.
Most WireGuard guides start with a Linux server and a terminal. This one does not: in the video, the server is the WireGuard VPN app inside the Untangle firewall — the same box that already guards the office network. That makes the setup short, but two ideas still matter and this guide keeps them in front of you: a tunnel is an identity, and a connected tunnel is not the same as an allowed tunnel. Both are explained below, in the order the video does the job.
Illustrative panel — the WireGuard VPN app inside the Untangle (Arista Edge Threat Management) firewall, the exact route shown in the video.
Log in to your Untangle firewall admin interface in the browser — this product is now sold as Arista Edge Threat Management, and older boxes still say Untangle; the screens are the same family. Then:
That is the whole server installation. There is no separate Linux server to build and no config file to type by hand — the firewall itself becomes the WireGuard server.
Open the app's Settings once and look, but do not redesign anything yet. Untangle manages the WireGuard interface, generates the server keypair itself, and listens on the standard WireGuard port 51820 (UDP). The defaults are correct for the normal office and home-lab job: staff connect in from outside and reach the office network. Changing the network space or port before your first tunnel works only adds places for a mistake to hide.
In the app's Tunnels tab, click Add to create a tunnel. Give it a name that says who and what — for example Ramesh-Laptop or Priya-Phone. Untangle assigns the tunnel an address automatically (you can pick a new random network space in Settings if you ever need one). Repeat this for every device. Never create one shared tunnel for the whole office: WireGuard has no usernames, so the tunnel is the identity — one tunnel per device is what makes removing one person later a ten-second job.
A tunnel that connects but reaches nothing is the most common first-day result, and this is the step that prevents it — it is also a step the video spends real time on. After the tunnel exists, set the network access rules so VPN clients are allowed to reach the LAN resources they need, and make sure the firewall and routing rules are applied and saved. Think of it as two doors: the tunnel gets a person to the firewall; the access rules decide what they may walk into once inside. Allow the office subnet and the specific servers they use — not the whole world by habit.
In the Tunnels tab, open the Remote Client view for the tunnel you created. Untangle shows the recommended client configuration two ways: as a QR code and as a text config you can copy or save as a file.
wireguard.com, open it, choose Add Tunnel → Import tunnel(s) from file (or paste the text into a new empty tunnel), and save.Treat that config and QR code like a password — whoever holds them holds the key to that tunnel. Send them over a channel you trust, never in a group chat.
On the client, press Activate. Then verify, do not assume:
If the handshake never appears, the problem is almost always the road in — a wrong endpoint address, or the internet router in front of the firewall not passing UDP 51820. The separate fix guides in this series walk those cases one by one.
Installing the app, adding tunnels, the access rules and the client connection — the full process demonstrated live, step by step.
▶️ Watch Full VideoNo — in this setup the WireGuard server is an app running on your Untangle (Arista Edge Threat Management) firewall itself. The firewall terminates the VPN, so there is no extra Linux box to build or maintain.
WireGuard listens on UDP port 51820 by default. If another router sits between the internet and your firewall, that router must forward UDP 51820 to the firewall, or clients outside will never reach it.
One tunnel per device — Ramesh-Laptop and Ramesh-Phone are two tunnels. WireGuard has no usernames or passwords, so the tunnel is the identity. Separate tunnels are what let you remove one device in seconds without touching anyone else.