Frequently Asked Questions¶

Common questions and answers about Waveshift. Click any question to expand the answer.

General Questions¶

What is Waveshift?

Waveshift is a hardware and software platform for creating resilient mesh networks and edge computing deployments with secure anonymous access to the internet via Cloudflare WARP and AWS egress locations across the world.

Key Features:

Hardware nodes for plug-and-play VPN routing
On-demand AWS-based Egress Servers (Egress Servers) worldwide
Optional Cloudflare WARP integration for traffic normalisation
Kasm Workspaces integration for secure browsing and persistent profiles
Private peer-to-peer networking between devices

See How Waveshift Works for detailed architecture.

What's the benefit of using Waveshift over Cloudflare WARP alone?

Cloudflare WARP is excellent for fast internet access, but limited to selecting an egress location near your physical location.

Waveshift advantages:

✅ Choose any AWS region for egress (not just nearby) ✅ Protect your IP from Cloudflare (they see AWS, not you) ✅ Full infrastructure control (deploy, configure, destroy) ✅ Hardware nodes for easy device integration ✅ Kasm workspaces for isolated browsing ✅ P2P networking between your devices

See Cloudflare Integration for details.

Who should use Waveshift?

Ideal for:

Privacy-conscious users needing anonymous internet access
Organisations requiring secure remote access
Users needing specific geographic egress points
Teams wanting private mesh networking
Anyone wanting control over their VPN infrastructure

How is Waveshift different from commercial VPNs?

Feature	Waveshift	Commercial VPN
Infrastructure	Your own AWS resources	Shared provider servers
Exit IPs	Unique to you (or shared via Cloudflare)	Shared with thousands
Control	Full control and transparency	Trust the provider
Locations	Any AWS region	Provider's locations only
Logging	You control (none by default)	Provider's policy
Privacy	Multi-layer anonymisation	Single-layer
Hardware	Nodes for easy integration	Software-only

VPN & Networking¶

What type of VPN does Waveshift use?

WireGuard — a modern, fast VPN protocol using state-of-the-art cryptography:

Curve25519 for key exchange
ChaCha20 for symmetric encryption
Poly1305 for authentication
BLAKE2s for hashing

How does Waveshift handle traffic encryption?

Multi-layer encryption:

Device to Node: LAN (HTTPS/TLS)
Node to AWS Egress Server: WireGuard tunnel through internet
Egress Server to Cloudflare (if enabled): WireGuard to WARP
Cloudflare to Internet: Encrypted to final destination (HTTPS/TLS)

Your data is encrypted with multiple layers of protection.

Where does Waveshift generate the encryption keys?

Key generation location depends on use case:

Server keys (Egress Server, IAS):

Generated on the EC2 instance itself
Private key never leaves the server
Only the public key is shared with the Orchestrator (via SSM Parameter Store)

Peer keys (QR codes / .conf downloads):

Generated on the Orchestrator (and surfaced via the Web Console)
Both private and public keys are in the config the user downloads
Intended for personal devices the user controls

Node keys:

Generated on the Orchestrator alongside the other peer configs when an Egress Server is built with Node integration
Pushed to the Node through the Control Hub during configuration

Entropy source: the operating system's cryptographically secure random generator (Go's crypto/rand on the Orchestrator, wg genkey / wgcf on servers).

When an Egress Server is deleted, what happens to the data?

Permanent Data Destruction

When you delete an Egress Server, all data is permanently destroyed with no possibility of recovery. This is a destructive operation that cannot be undone.

What gets destroyed:

EC2 instance terminated — All data on the instance is erased
IP address released — Returns to AWS pool and may be reassigned to other customers
WireGuard configs invalidated — All keys become immediately invalid

Before deleting: Always ensure you have backups of any important data, logs, or configurations you may need later.

Is it possible to network multiple devices together?

Yes! Devices on the same Egress Server can communicate privately:

Peer-to-Peer Features:

Secure encrypted communication between peers
No internet exposure for P2P traffic
File sharing between trusted devices
Remote desktop access
Team collaboration tools

How it works:

All devices on same Egress Server are in same VPN subnet
WireGuard allows peer-to-peer routing
Traffic stays within VPN, never touches internet

See How Waveshift Works — P2P Networking for details.

Is it possible to use the VPN to connect to the public internet?

Absolutely! That's the primary use case:

Device connects to Node (or uses QR code config)
All internet traffic encrypted via WireGuard
Traffic routes through AWS Egress Server
Optional: Further encrypted to Cloudflare WARP
Exits to public internet

Your ISP sees: Encrypted WireGuard traffic Websites see: AWS IP (or Cloudflare shared IP if enabled) Your real IP: Completely hidden

Sites & multi-region¶

What is a Site?

A Site is a logical scope in v0.5. It's a database row (UUID + name + settings) that governs which AWS regions its users can provision Egress Servers in. (Sites also carry Kasm / Cloudflare feature flags, but these aren't enforced yet — feature access comes from per-user licences.)

A Site does not have AWS resources of its own. The two flavours in practice:

Hub Sites — created when an admin runs wsctl node-site create (or adds a node site in the TUI). The Site's Infrastructure Access Server (IAS) is provisioned at the same time, and wsctl hub configure then onboards the Control Hub.
Default Site — auto-created on first deploy with the UUID 4DA40066-0EF8-493C-A1B6-F51A8C714A15 and the name "Global". No Hub, no IAS, no AWS resources. Users in the Default Site connect a WireGuard client straight to an Egress Server.

A user can belong to multiple Sites and pick which scope to use when provisioning an Egress Server.

What is the Infrastructure Access Server (IAS) and how is it different from an Egress Server?

The IAS is a per-Site WireGuard endpoint that terminates the Control Hub's management tunnel. The Orchestrator pushes Node configs, firmware, and Site changes to the Hub through that tunnel.

The Egress Server is the per-user, per-region WireGuard endpoint that user traffic egresses through to the public internet.

Why split them?

The IAS lives in the Site's home region and stays up for the lifetime of the Site. Hub WG keys are pinned to it.
Egress Servers can be provisioned in any allowed region on demand and destroyed when no longer needed.
When a tethered Node carries user traffic, that user-WG traffic is wrapped inside the Hub→IAS tunnel (tunnel-in-tunnel). The IAS then forwards it to the Egress Server in the chosen region, either in the same VPC or via VPC peering.

The IAS itself does not carry traffic to the public internet — it's a management + tunnel-in-tunnel anchor only.

What is the Default Site for?

The Default Site is for users who don't have a Hub. Examples:

A mobile user with a phone and a WireGuard client app
A laptop user working from a hotel without a Site router
Any device where you've downloaded a .conf file from the Web Console and installed it directly

Default-Site users provision Egress Servers from their AllowedRegions (set on the Site) and connect to them directly over the public internet. There's no Hub, no IAS in the path, no tunnel-in-tunnel.

Default Site users can also be members of a Hub Site simultaneously, in which case they choose which scope to use when provisioning each Egress Server.

Can I have Egress Servers in multiple AWS regions?

Yes. Egress Servers live in a per-region VPC, shared by every Egress Server in that region. The home region's VPC peers with each spoke VPC in a star topology — every spoke peers to home, no spoke ever peers to another spoke.

Why star and not mesh?

Keeps the blast-radius of any one region contained.
Makes adding regions cheap: one new VPC + one new peering connection back to home.
Spoke ↔ spoke communication isn't a Waveshift use case — users pick a region per Egress Server and traffic exits from there.

Each region's VPC CIDR comes from a deterministic map keyed by AWS region name; the home region defaults to 10.32.0.0/23 and spokes get distinct /23 blocks from 10.32.0.0/16. See the Key questions → Network overview for the full diagram.

How many peer slots does each Egress Server get?

As many as you ask for when you create it — the Console offers 1–20 user peers, plus up to 10 Kasm peers when Kasm is enabled and one Node peer when Node integration is enabled. The licence JWT carries a wireguard_clients quota, but the orchestrator doesn't enforce it yet.

Addresses are assigned sequentially from the wg0 network, starting at 10.0.0.2/32 (the server is 10.0.0.1): user peers first, then Kasm peers, then the Node peer. The peer set is fixed at build time — to change it, create a new Egress Server.

Hardware¶

What's included in the Waveshift hardware package?

Standard Kit includes:

1× Control Hub (GL.iNet Brume 2) — Control Hub router
5× Nodes (GL.iNet Slate AX) — User device routers
1× Network Switch (8+ ports) — Unmanaged
Power adapters for all devices
20× Ethernet cables (Cat 6)

See Hardware Setup for complete details.

Can I use different hardware than provided?

Waveshift Firmware Requirements

Control Hub and Node routers require Waveshift-specific firmware and cannot be substituted with standard routers.

Hardware requirements:

Control Hub and Nodes require Waveshift custom firmware
Firmware is custom-built specifically for GL.iNet hardware
Standard consumer routers cannot be flashed with Waveshift firmware
GL.iNet devices other than those provided are not currently supported

Why this matters: The firmware includes specialised VPN management, automatic configuration, and killswitch functionality that aren't available on standard router firmware.

However, you can substitute:

Switch can be any unmanaged switch (8+ ports)
Bearer router can be any router providing internet
Tablet can be any device with Ethernet adapter
Power adapters can be substituted (check voltage/amperage)

Alternative Hardware Options

If you need different hardware than the standard kit, Blackfire Technology can help scope alternatives.

When to contact: If you need higher capacity, different form factors, or deployment-specific requirements.

Contact: support@blackfire.tech

What firmware is running on the GL.iNet devices?

Waveshift Custom Firmware:

Based on OpenWrt Linux distribution
Custom Waveshift modules for VPN management
Automatic configuration from Orchestrator
VPN killswitch and firewall rules

Firmware updates: Released periodically through Waveshift deployment updates.

How can I get the latest firmware?

Firmware updates released periodically by Blackfire Technology
Deployed during Waveshift service updates
Control Hub and Nodes update in coordination with Orchestrator

How do I reset the Internet Bearer Router?

Reset procedure:

Locate the reset button on the Bearer Router
Hold the reset button for 10 seconds
Release when the system begins to reboot
Wait for full boot (approximately 4 minutes)
Reconfigure internet settings via admin panel at 192.168.8.1

Reset Wipes Configuration

A factory reset will erase all settings including Wi-Fi credentials, internet configuration, and custom settings.

What if I need more nodes?

Expanding your deployment:

Additional nodes can be purchased through Blackfire Technology
All nodes come pre-flashed with Waveshift firmware
Simply connect and power on following the same setup procedure
Contact: support@blackfire.tech

Can nodes be used without a Control Hub?

No. Nodes require the Control Hub for operation:

Control Hub provides management network connectivity
Configuration is pushed from Orchestrator via Control Hub
WireGuard credentials are distributed through Control Hub
Node status monitoring requires Control Hub connection

Architecture: Nodes are designed as managed endpoints, not standalone routers.

Setup & Configuration¶

What are the default login credentials?

See Default values & credentials for the complete list.

Change Default Passwords

Always change default passwords in production environments!

Can I deploy Waveshift without the hardware?

Yes! Two deployment options:

1. With Waveshift Nodes:

HQ-style setups
Users get issued nodes to connect / network different devices

2. Cloud-only:

Clients use QR codes / config files provided by Waveshift to fill their devices
Kasm Workspaces use only the cloud infrastructure
No Waveshift hardware required

See Quick deploy for cloud-only deployment.

Privacy & Security¶

Does Waveshift log my traffic?

Privacy by Default

Waveshift is designed with privacy as a core principle. It is a self-hosted VPN service provider. Any logs that are available belong to you. Currently there is no logging of your traffic. In the future, we may add logging capabilities but these logs will belong to the client running Waveshift and Blackfire Technology will have no access to these.

What the Orchestrator logs:

✅ Does NOT log your browsing activity
✅ Does NOT log websites you visit
✅ Does NOT log DNS queries
✅ Logs only: System events, infrastructure builds, and errors

What AWS logs:

✅ Does NOT log your traffic (unless you explicitly enable VPC Flow Logs)
✅ Logs only: Infrastructure metrics and API calls (via CloudTrail)

What Cloudflare logs (if WARP is enabled):

✅ Claims no user-identifiable logging
✅ Publishes regular third-party audits of their 1.1.1.1 service
✅ May see aggregated traffic patterns but cannot correlate them to individual users

Your privacy: With Waveshift, you control the infrastructure. Unlike commercial VPNs, you can verify there's no logging by inspecting your own servers.

Can my ISP see what I'm doing?

Your ISP sees:

Encrypted WireGuard traffic
Amount of data transferred
Connection timing
Destination: AWS ingress Egress Server IP address

Your ISP CANNOT see:

Websites you visit
Content of your traffic
Your DNS queries
Your actual destinations

What happens if the VPN disconnects?

Automatic Killswitch Protection

Waveshift includes built-in VPN killswitch functionality to protect against accidental exposure if your VPN connection drops.

How the killswitch works:

Immediate blocking — Traffic is blocked the instant VPN disconnects
No leaks — All data is prevented from using your regular internet connection
Firewall enforcement — Node firewall rules strictly prevent non-VPN traffic
Visual indicators — Node LEDs show VPN connection status
Auto-reconnect — Connection automatically retries without manual intervention

Your protection: If the VPN fails for any reason, your device is protected from accidentally exposing your real IP address or unencrypted traffic.

When you'll see this: The killswitch activates automatically during network interruptions, VPN server maintenance, or any connectivity issues.

How secure are the WireGuard keys?

Cryptographically secure:

Secure randomness from the operating system's CSPRNG
Curve25519 elliptic-curve cryptography
Perfect forward secrecy — past sessions remain secure
Short-lived sessions reduce exposure
Unique keys per Egress Server — no key reuse

See Cloudflare Integration — Entropy for technical details.

Troubleshooting¶

Devices aren't showing up in the UI?

Node Registration Troubleshooting

If nodes aren't appearing in the Waveshift console, work through these troubleshooting steps in order.

1. Verify physical connections:

Node WAN port connected to Bearer Router (for internet)
Node LAN2 port connected to Control Hub (for management)
All Ethernet cables firmly seated

2. Confirm power status:

All nodes powered on with LEDs lit
Using correct power adapters (minimum 3A for nodes)
Power outlets functional

3. Allow registration time:

Nodes take 1–2 minutes to register after power-on
Refresh the Nodes page in your browser
Check if nodes appear as "Unassigned"

4. Test Control Hub access:

Verify https://console.waveshift.internal loads from your device connected to the Control Hub
Confirm Control Hub has active internet connection

Still not working? See Common issues for the broader hardware-setup symptom list.

Egress Server build is failing?

Egress Server Build Prerequisites

If your Egress Server build is failing, these are the most common causes. Check each before retrying.

Common failure causes:

AWS credentials expired — For wsctl users, re-authenticate with AWS
Regional capacity limits — Try deploying to a different AWS region
Network connectivity issues — Ensure Orchestrator has stable internet
AWS service quotas exceeded — Check your account limits for EC2 instances

When you'll see this: During Egress Server creation, especially in high-demand regions or with new AWS accounts.

Next steps: See detailed solutions in Troubleshooting — Common Issues.

Can't access the Control Hub console?

Control Hub Console Access

If you can't access the Control Hub console at https://console.waveshift.internal, work through these troubleshooting steps.

1. Verify tablet/computer connection:

USB-Ethernet adapter properly connected to tablet
Ethernet cable from adapter to Control Hub LAN port (any LAN port)

2. Try a different LAN port:

Control Hub has multiple LAN ports — try each one
Avoid the WAN port (used for internet, not management)

3. Power-cycle the Control Hub:

Unplug power adapter, wait 10 seconds
Reconnect power and wait 60 seconds for full boot
LEDs should illuminate during boot sequence

4. Verify power supply:

LED indicators are lit (not dim or flickering)
Using the provided power adapter (not a substitute)
Power adapter firmly connected

Still stuck? See Common issues for the broader hardware-setup symptom list.

Kasm Workspaces¶

What is Kasm and why use it with Waveshift?

Kasm Workspaces Integration

Kasm Workspaces provides secure, containerised browser environments that run in isolated containers rather than on your local device.

Key benefits:

Isolated browsing — Browser runs in a container; no traces left on your device
Disposable sessions — Destroy the workspace when done; all data is removed, unless preserved using persistent profiles
Fingerprinting resistance — Consistent browser fingerprint across sessions
Waveshift Egress Server routing — Route through any of your Egress Servers worldwide
Multiple browsers — Chrome, Firefox, Tor Browser, and more

How it works: When you launch a Kasm workspace, it creates a fresh containerised browser instance. All browsing happens in that container, which routes through your selected Waveshift Egress Server. When you close the workspace, the container is destroyed completely.

When to use Kasm: Perfect for sensitive browsing where you want zero traces on your local machine, or when you need consistent browser fingerprinting.

Waveshift Integration:

Automatically configured when building an Egress Server
One-click access to workspaces
Egress through your selected Egress Server location

How do I access Kasm Workspaces?

From the Waveshift Console as a non-admin user:

Click Workspaces in left navigation
Browser opens new tab automatically
Select workspace (Browser, Desktop, etc.)
Set Egress Provider to Waveshift
Select your Egress Server from dropdown
Launch workspace

All your browsing routes through the selected Egress Server.

Billing & Costs¶

How much does Waveshift cost to run?

AWS Costs:

EC2 instances (per hour) — varies by instance type and deployment location
Data transfer (per GB)
Other AWS services (minimal)

Typical monthly cost: Approximately $200–400 depending on usage and instance types.

Cloudflare WARP: Free (built into Cloudflare's 1.1.1.1 service).

How can I reduce AWS costs?

Minimising AWS Costs

Waveshift uses on-demand AWS resources, so you have complete control over costs. Follow these strategies to minimise spending.

Cost-saving best practices:

Destroy unused Egress Servers — Don't leave Egress Servers running when not in use; AWS charges by the hour
Limit active Egress Servers — Only create Egress Servers you're actively using; you can quickly recreate them later
Choose cost-effective regions — US regions tend to be cheaper than EU or Asia-Pacific
Monitor with Cost Explorer — AWS Cost Explorer shows your spending patterns

When you'll save most: Destroying Egress Servers when not actively using them is the single biggest cost saver. An Egress Server running 24/7 costs much more than one you spin up for a few hours when needed.

Understanding AWS On-Demand Pricing

Waveshift uses AWS on-demand resources, which means you pay only for what you use, when you use it.

How it works:

EC2 instances are billed per hour while running
Data transfer is billed per gigabyte transferred
No charges when instances are stopped or terminated
No long-term contracts or commitments

Cost control: You have complete control over costs. Destroy Egress Servers when not needed, and you stop incurring charges immediately. Need an Egress Server again? Create it on demand in minutes.

Example: Each Egress Server is two t4g.nano instances (the server and its UDP ingress proxy), each with a public IPv4 address. Running 24/7 that's roughly $10–15/month plus data transfer; the same Egress Server used 8 hours/day costs roughly a third of that.

Support¶

Where do I get help?

Support channels:

📧 Email: support@blackfire.tech 📚 Documentation: https://docs.waveshift.io 🐛 Bug reports: support@blackfire.tech

How do I report bugs?

Reporting Issues Effectively

Help us help you by including these details when reporting bugs or issues.

Essential information to include:

Clear description — What's the problem in plain language?
Reproduction steps — Exact steps that led to the issue
Expected vs actual — What should have happened vs what did happen
System details — Hardware models, firmware versions, wsctl version
Log files — Any error logs or console output
Screenshots — Visual evidence helps immensely

Where to send: Email all details to support@blackfire.tech.

Response time: Blackfire Technology typically responds to support requests within 24–48 business hours.

Can I request features?

Yes! Feature requests are welcome.

Submit via email: support@blackfire.tech

Include:

Detailed description of desired feature
Use case / why it's needed
Any relevant examples or references