Set up the VPN

Setting up a site takes three steps: turn the VPN on there, check what sessions will reach, and write a policy that lets your technicians in.

These settings are under Organization Admin → VPN, which you see with the vpn:read permission. Changing anything takes vpn:update; see Permissions.

Turn the VPN on at a site

1. Go to Organization Admin → VPN → Sites and choose the site. The same controls are on the region’s own page, under Organization Admin → Regions.
2. Turn on the switch under VPN.

The switch is available once at least one of the site’s gateways can run the VPN. If none can, it says why, and Gateways lists each gateway’s reason. Gateways running it, in the list of sites, shows how many have it running.

When the VPN is on, each of the site’s gateways adds a WireGuard interface and the firewall rules that hold each session to its routes. Turning the VPN off removes them and, after you confirm, ends every live session at the site.

A gateway’s own state is on its page, on the VPN tab: whether it can run the VPN, what it last reported, and who is connected through it. The tab also shows a warning for anything on the gateway’s host that may stop the VPN’s traffic and that the gateway can’t change itself, such as a firewall, with what to do about it.

Routes: what sessions reach

The site’s Routes card lists the networks a session reaches:

• seen on its devices: the private IPv4 networks Witina has seen on the site’s devices in the last 30 days.
• added: networks you add.

To add networks, enter them under Routes, separated by commas, for example 192.168.50.0/24, 10.10.0.0/16, and choose Save. Add any network technicians need that isn’t listed. If the list is empty, sessions can’t start.

A session takes the routes as they are when it starts.

Site DNS servers

Site DNS servers are where the site’s gateways send lookups for your DNS domains. Leave it empty to use each gateway’s own DNS servers, the ones it got from DHCP. To set them, enter their addresses, separated by commas, and choose Save.

DNS domains

Under Organization Admin → VPN → Settings → DNS domains, list the domains whose names should resolve at the site while a technician is connected, such as customer.internal or corp.example.

• Organization applies to sites that don’t belong to a division, and to divisions without a list of their own.
• Each division, such as a customer, can have its own list. It replaces the organization’s for that division’s sites, so include every domain they need.

Reverse lookups for a session’s routes go to the site too, without listing anything.

Changing the organization’s list takes vpn:update across the organization. A division’s list takes vpn:update for that division.

Policies

Nobody can connect until a policy lets them. To make one, go to Organization Admin → VPN → Policies and choose New policy:

1. Enter a Name, such as “Field technicians”.
2. Under Teams, tick the teams it lets in.
3. Under Where, leave Every site in the organization ticked, or untick it and tick the customers (“Every site in Customer”) and sites the policy covers.
4. Set Longest session (minutes), from 1 to 480. A session lasts this long, and Extend gives it this long again from that moment.
5. Choose Save.

How policies combine:

• They add up. Someone in the teams of two policies can connect wherever either allows, and where both do, the longer session length applies. There are no deny rules.
• Turning one off with its switch stops anyone connecting by it, without deleting it.
• Turning one off, deleting it, or taking someone off its team ends the sessions that no policy allows any more.
• A deleted site or customer drops out of the policies that name it. A policy left with none of its places covers nothing.

For an MSP, a policy per customer, with Where set to “Every site in Customer”, keeps each team to its own customers. A policy for Every site in the organization suits the people who work on all of them.

Making or changing a policy takes vpn:update over every place it names, both before and after the change.

Connection path

Organization Admin → VPN → Settings → Connection path chooses whether sessions go direct or through Witina’s relay, for the organization and for each division.

• No preference (direct, for now): Witina’s default.
• Direct preferred: direct, through the relay only when no direct path works.
• Direct only: never through the relay.
• Relay preferred and Relay only aren’t available yet.

A division set to The organization’s follows the organization. Until the relay is available, every choice works the same way: a direct path, or an error saying the connection needs the relay. See When there’s no direct path.

Flow records

Organization Admin → VPN → Settings → Flow records sets how many days your organization keeps flow records: 90 by default, and from 1 to 3650. Shortening it deletes older records at the next daily pass. Use the default goes back to 90. Changing it takes vpn:update across the organization.

Permissions

Permission	Lets you	Built-in roles
vpn:read	See the VPN’s sites, policies, and settings, and a gateway’s VPN tab	All of them
vpn:update	Turn the VPN on and off, change routes, DNS, policies, and settings, and end other people’s sessions	Administrator
vpn_session:read	See everyone’s sessions and flow records, and use Who was it	Administrator

Connecting isn’t a permission: policies decide it. Everyone sees their own sessions and computers without any of these.