Using a VPN provider

You don't need your own server to use Tunl. Most VPN providers that run WireGuard will hand you a standard .conf file from their website, and Tunl imports it like any other. This page is where to find that file for the providers people ask about, and what to know once it's in.

The providers below make their own apps, and those apps are the supported way to use them. Tunl is for the people who would rather run a plain WireGuard tunnel and get Tunl's watchdog, history and routing on top. None of these companies are affiliated with Tunl, and their names belong to them.

Before you start

• One key per device. Every provider lets you make a key pair, and each one should live on one machine. If the same key is on your Mac and your phone, the two fight over the session and both drop. Make a separate config for each.
• The private key is shown once. Several generators display it only at creation time. Download the file then and there. If you lose it, revoke the key on the provider's site and make another.
• One file is one tunnel. A config points at one server. If you want a choice of countries, download one file per country and import them all. Tunl keeps them as separate tunnels and connects one at a time.
• Check the device limit. Most providers cap active WireGuard keys at around five. If a generator refuses, an old key from a phone you no longer have is usually the reason. Remove it there.

Mullvad

Log in at mullvad.net with your account number and open the WireGuard configuration generator under your account. Click Generate key; the key pair is made in your browser. Pick a country, city or server, optionally turn on the DNS content blockers, and click Download file. You can also download a zip of every server at once.

Five keys per account. Mullvad's configs use the server's IP address as the endpoint rather than a hostname, so if a server is retired the file stops working and you download a new one; Tunl will tell you the tunnel has stalled but cannot re-resolve an address that was never a name.

Proton VPN

Sign in at account.protonvpn.com and go to Downloads → WireGuard configuration. Give the config a name, choose the platform, pick a server or accept the recommended one, and click Create, then Download. The private key is in the downloaded file and is not shown again.

Paid plans can turn on NetShield, Moderate NAT and port forwarding (NAT-PMP) in the config's options; the free plan gets the free servers and VPN Accelerator only. NetShield is done by Proton's resolver inside the tunnel, the one the file's DNS line points at, so it works in Tunl exactly as it does in Proton's app.

AirVPN

Log in at airvpn.org and open the Config Generator in the client area. Choose WireGuard as the protocol, tick the servers or countries you want, and click Generate. The keys are managed under VPN Devices in the same client area, one per device, and each generated file is tied to a device.

The generator offers several entry ports; the default UDP port works on most networks, and the alternatives exist for networks that block it. The file names it produces are long; the name becomes the tunnel's name in Tunl, and you can rename it after import.

IVPN

Open the WireGuard config generator in the client area at ivpn.net. Choose Generate key (or add one you made yourself), pick a single-hop or multi-hop server, a port and IPv4 or IPv6, and download the zip. Unzip it and import the .conf inside.

How many keys you can hold depends on the plan, and the generator says so when you reach the limit. It only works for accounts created after November 2020, the ones whose ID looks like i-XXXX-XXXX-XXXX; older accounts need to ask support to migrate.

Windscribe

Log in and open windscribe.com/getconfig/wireguard. Select a location, choose a port (443 if you are unsure), keep New Key Pair selected or reuse one you made earlier, and click Download Config.

The generator is a paid feature, on the Pro and Build-A-Plan subscriptions. The file contains a preshared key as well as your private key, so treat it as a secret.

Surfshark

In your account on surfshark.com, open Manual setup and choose WireGuard. Click Generate a new key pair and store what it shows; it is not displayed again. Then find the location you want in the list and click Download beside it.

Getting the file into Tunl

Drag the .conf onto the Tunl window, or open the + menu at the bottom of the sidebar and choose Import .conf…. The same menu takes a QR-code image, and New Tunnel… lets you paste the file's text. Then connect. Tunl shows the handshake and the byte counters; if the counters move, you are through.

What works with a provider, and what doesn't

• Reconnecting, trusted networks, history, the kill switch and split tunnelling all work with any of these files. They are done on your Mac and need nothing from the server. The kill switch, unattended repair and split-tunnel rules beyond the first are Premium, as on the home page.
• Leave encrypted DNS off. Every one of these files points the DNS line at the provider's own resolver inside the tunnel, which answers plain DNS only, and Tunl's encrypted DNS uses whatever is in that field as the DoH or DoT server. Switch it on and every lookup fails. The queries already travel inside the tunnel and are seen only by the provider you are paying, which is the same position their app puts you in.
• Stall detection and repair work too. Providers do retire and move servers, and a tunnel to a server that has gone is exactly the connected but nothing gets through case Tunl exists for. When the endpoint is a hostname Tunl re-resolves it; when it is a bare IP, as in Mullvad's files, repair can only reconnect, and a stall that persists means you need a fresh config.
• The WebSocket wrapper does not apply. It needs a matching relay on the server, which these providers don't run. On a network that blocks UDP, use whatever the provider offers for that instead: AirVPN's alternative ports, Windscribe's port 443, or the provider's own app.
• The provider's app features (ad blocking, multi-hop selection, port forwarding, streaming modes) exist in the config only if you chose them when generating it. Tunl does not add them and does not remove them.

If you would rather not depend on a provider at all, the server setup guide gets you from a bare VPS to a working tunnel, and Tunl can make the key pair for you.