VPN Configuration

VPN Configuration

NetWatch requires a full-tunnel WireGuard configuration for its backend services. The managed tunnel is their required Internet route; a Windows host VPN is optional and does not replace it.

Import a profile

1. Select Generic WireGuard or VPNBook during setup.
2. Choose the provider .conf file.
3. Wait for NetWatch to validate the profile, start the managed runtime, and check routing, DNS, the kill switch, and Internet egress.

NetWatch rejects provider command hooks and profiles that do not supply a full IPv4 tunnel and an IPv4 DNS resolver. Imported profiles are rewritten into NetWatch's managed format.

Generic WireGuard and VPNBook use the same secure routing path. The VPNBook expiry date is an estimate for renewal planning, not a security verdict.

Replace a profile

1. Open Settings and select Replace configuration.
2. Import the new provider file.
3. Restart NetWatch when prompted.
4. Run Test connection after the runtime returns to Ready.

The replacement is applied during restart; it is not a live tunnel swap.

Host VPN changes

If you start, stop, or switch a Windows host VPN, restart NetWatch so Docker and WSL networking can settle against the new host route.

Verification failure

Run the bundled network check from PowerShell:

wsl -d Ubuntu -- sh -lc 'cd ~/.local/share/netwatch/runtime && python3 docker/verify-networking.py'

Replace Ubuntu with the distribution selected for NetWatch. The output identifies routing, DNS, firewall, or egress failures without displaying the private key.

The maintained security guarantees and limitations are in the network threat model.