Linux setup

Install wireguard-tools from your distribution (the kernel module is built in since Linux 5.6).

Your key pair

Your WireGuard key pair is made on your side, never by us. Either let the account page generate it in your browser (JavaScript on: you get one .conf download per server with the private key already in it), or make it on the command line:

umask 077
wg genkey | tee private.key | wg pubkey > public.key

Paste the contents of public.key into Add device on the account page and download the ZIP. Every .conf in it contains PRIVATE_KEY_HERE; replace that with the contents of private.key:

unzip ironkeel-device-1.zip
sed -i "s|PRIVATE_KEY_HERE|$(cat private.key)|" ik-*.conf

With wg-quick

sudo install -m 600 ik-<server>.conf /etc/wireguard/
sudo wg-quick up ik-<server>
sudo wg          # shows the handshake and transfer counters
sudo wg-quick down ik-<server>

sudo systemctl enable --now wg-quick@ik-<server> starts the tunnel at boot.

With NetworkManager

nmcli connection import type wireguard file ik-<server>.conf, then enable it from the network menu.

Checks

curl https://ifconfig.co (or any IP echo service) shows the server's address.
resolvectl status (systemd-resolved) or /etc/resolv.conf shows the tunnel DNS address (10.64.0.1) while the tunnel is up; wg-quick sets this for you.
IPv6 is routed into the tunnel as well; curl -6 https://ifconfig.co should show the server's IPv6 address or fail, never your home address.
In a browser, open our leak check. Each address it shows should be an ironkeel server's; "No answer" means that family was not checked. It can't see DNS or WebRTC: ipleak.net, a leak-check site we do not run, tests your browser for both, and no DNS server or address it lists should be your internet provider's.

Limits

Nothing blocks your traffic while the tunnel is down. Before the tunnel is up and after wg-quick down, your traffic uses your normal connection. There is no kill switch by default, so check with sudo wg that the tunnel is up before you rely on it.

If the tunnel stops

If pages stop loading, check your paid-until date first: take the tunnel down (sudo wg-quick down ik-<server>), or use another device. When paid time runs out, the tunnel stops without a message: it stays up, but nothing gets through, and the latest handshake in sudo wg grows more than a few minutes old. To add time, redeem a voucher on the account page, then bring the tunnel back up.