Create a gateway
Provision your first IPsec gateway from the dashboard or the CLI, then bring it online.
Before you start
Have three things ready for each site: a name, the local subnet the gateway will advertise (for example 10.10.0.0/24), and a reachable endpoint — a static public IP or hostname. If a site is behind NAT with no static IP, the gateway can still come up through our rendezvous, so long as at least one side is reachable.
From the dashboard
Open Gateways → New gateway and follow the five-step wizard: pick a region, name the gateway, set its local subnet, choose or accept the crypto proposal, and deploy. When it finishes you get a config bundle to run on the appliance or VM at that location.
From the CLI
The same provisioning is one command, which returns the gateway id and a config bundle:
vpngeek gateway create \
--name hq-gateway \
--region eu-central \
--subnet 10.10.0.0/24
# List gateways and their status
vpngeek gateway list
# Fetch the deploy bundle for an appliance
vpngeek gateway config hq-gateway > hq-gateway.conf
Bring it online
Deploy the config bundle to the gateway host and start the service. Within a few seconds the gateway should report reachable in the dashboard and under vpngeek gateway list. A gateway that stays unreachable is almost always a firewall issue upstream — allow outbound UDP 500 and 4500 so IKE and NAT-T can get out. Once the gateway is reachable you are ready to define a tunnel to another site.