HexaWAN

Zero Trust · Control-plane console

HexaWAN

Platform monitoring

checking…

A live overview of the whole HexaWAN platform — nodes, VPN users, reverse-proxy traffic, WAF activity, and end-to-end website uptime.

Website monitoring

Every enabled HTTP/HTTPS reverse-proxy route is probed through the local reverse proxy each minute — nginx → WAF → upstream, using the route's own hostname (SNI + Host). Uptime %, HTTP status, response time and the served certificate's expiry are recorded. Dialing nginx directly means results don't depend on public DNS or NAT hairpin, so origin-only routes (not proxied through Cloudflare) report correctly too.

No websites to monitor yet. Add an HTTP/HTTPS reverse-proxy route and probing begins within a minute.

Reverse-proxy traffic

No traffic recorded in this window yet.

Infrastructure

WAF activity

No nodes have registered yet. Start a node agent and it will appear here.

VPN users

End users sign in from the HexaWAN client with these credentials and receive a config for each node they're entitled to.

No VPN users yet. Click “Add user” to create one.

Reverse proxy

checking…

nginx isn't deployed in this stack, so routes are stored but not served. Add the nginx service (see the README) and restart.

DNS credentials

Cloudflare API tokens (scoped Zone:DNS:Edit), stored encrypted and shared across routes for DNS-01 certificate issuance and renewal. Reference one from a route's “Cloudflare DNS credential” selector.

No DNS credentials yet. Click “Add credential” to store one.

DNS search domains

Comma-separated bare domain suffixes pushed to split-horizon VPN clients on the DNS = line (e.g. ovoteck.com, corp.internal), so split-tunnel clients can install per-suffix NRPT rules. Applied ONLY to clients using the “gateway” resolver; literal-DNS clients are unaffected.

No proxy routes yet. Click “Add route” to create one.

Web proxy protection

Unknown-host requests and IP blocks are logged below. These settings apply to the web proxy only. Unknown HTTPS names are rejected during the TLS handshake and have no HTTP event.

HTTPS upstream certificates are verified by default. Exceptions disable verification only for the listed backend hostnames; prefer installing a trusted private CA.

IP blacklist

Blocks all web routes, including redirects and routes with WAF disabled. Addresses are the direct connection's source IP; forwarded headers are not trusted.

Security audit trail

Policy changes, blocks, removals and automatic expiry. Expand a record for changed entries. The latest 10,000 changes are retained.

WAF activity

Repeated unknown-host and blacklist requests are grouped by source, host, policy and minute. Request paths are representative samples; counts cover ingested records.

No events match these filters. Unknown-host requests and blacklist hits are logged automatically; enable route WAF to also collect rule matches.

WAF event

Client config


        
Scan in the WireGuard app

      

      

        
        
      

    

  


  
  

    

      

        
Add route

        
      

      

        
        

          
          
          

          
Connection and deployment instructions
          
Players connect in their game using the address below, not an https:// URL. Each enabled route needs a unique protocol and public port. For games needing extra query or voice ports, add a route for each port with a different hostname.

          
Point this hostname's DNS A record at your proxy's public IPv4 address (DNS-only). Publish the port on the nginx container and allow/forward the same protocol and port through your firewall/router. Saving here configures the proxy and fleet DNS; it does not change public DNS or firewall rules. Backends see the proxy's IP. Game authentication stays on the game server.

          

          

        

        
        
        
        
        
        
        
        
        

          
          
        

        
        
        

          
          

            Disabled rule categories — turn whole CRS groups off for this route
            

            
          

          
          
        

        
      

      

      

        
        
      

    

  


  
  

    

      

        
Add VPN user

        
      

      

        
        
        
        
        

          Entitled nodes
        

        

          Registered devices
        

      

      

      

        
        
      

    

  


  
  

    

      

        
Managed config

        
      

      

        Overrides applied to every managed client on this node. Blank / 0 means
        “use the server default”. Changes take effect on each client's next config pull.
      

      

        
        
        
        
        
      

      

      

        
        
      

    

  


  
  

    

      

        
Add DNS credential

        
      

      

        
        
        
        
      

      

      

        
        
      

    

  


  


  
  

    
    

      Install HexaWAN
      Keep the console on your home screen — opens full screen, no address bar.
    

    

      
      
    

  


  

    

      
Admin login security

      

      
Use an authenticator app for sign-ins. Changes require your password and revoke other sessions.

      

        
        

          
Scan this QR code in your authenticator app, or enter the setup key. Setup expires after 10 minutes.

          

        

        
        
        
      

      
Save these recovery codes somewhere safe. Each works once, together with your password. These codes are only shown now; generating replacements invalidates the old set.