Docs menu

Basics

Features

Developer & AI

Trust

Docs / Team VPN

Team VPN

Turn your server into a VPN for your team. Each laptop or phone gets its own key, can have an expiry date, and can be revoked any time. No business VPN subscription needed: just the VM you already rent and the free official WireGuard app.

What it is for

This VPN is for team access and a fixed IP, not for getting around blocked sites.

Set up the VPN

Open VPN, pick a server and press Set up VPN. The server must be connected, have a public IP and not be a Kubernetes node. Saka installs WireGuard, turns on packet forwarding and NAT, and opens the UDP port (default 51820) in the server firewall. It takes about 30 seconds to 2 minutes; sites and apps on the server are not affected.

Provider firewall. If your VPS provider has its own firewall outside the server (e.g. DigitalOcean Cloud Firewall or AWS Security Groups), open the port for UDP there too. If you later turn on the server firewall from Server security, the VPN port is opened automatically.

Add a device

Press + Add device, enter a name (e.g. Budi's laptop) and its user, then choose what goes through the VPN:

Also choose how long it is valid (no limit, 1, 7, 30, 90 or 365 days), handy for freelancers or vendors. Saka then shows a QR code and a Download .conf file button. The configuration contains the device's secret key and is shown only once; if it is lost, revoke that device and create a new one.

Changing the mode or extra addresses means creating a new configuration: add a new device, then revoke the old one. Domains are resolved to IPs when the configuration is created; if that system's IP changes, create the configuration again.

Set it up on the device

Use the free official WireGuard app (wireguard.com/install):

Check. Full mode: open ifconfig.me on the device; it should show the server's IP. Split mode: open your internal system's address.

If the laptop is on a network with the same addresses as the server's private network (rare, e.g. both 10.43.76.0/24), split mode can clash; use full mode for that device.

Monitor, revoke and alerts

Sites that open only through the VPN

On a site's page, the VPN only card restricts part of the site so it opens only from the team VPN; other visitors see a 403 page:

Allowed are the VPN server's public IP and the VPN network, so the site may live on another server. It also works behind Cloudflare or a load balancer, because Saka reads the visitor's real IP. Full-mode devices can open it right away. Split-mode devices created after protection is turned on include it automatically: sites on other servers through a route to their IP, and sites on the VPN server itself through the VPN gateway DNS (the device asks the gateway, which answers that domain with the gateway address and forwards other names to public DNS). Split devices created earlier need to be recreated. The Saka panel is not locked, so you can always turn protection off; if the VPN is removed, its site protection is lifted too. AI agents use the MCP tool situs_hanya_vpn.

Security

Through the API and AI agents

API
GET    /api/v1/vpn
POST   /api/v1/vpn                          {"server_id": "srv_...", "port": 51820}
POST   /api/v1/vpn/<id>/perangkat           {"nama": "Budi laptop", "mode": "split", "rute": ["erp.office.example"], "hari": 30}
DELETE /api/v1/vpn/<id>/perangkat/<id>
DELETE /api/v1/vpn/<id>                     {"konfirmasi": "<server name>"}

AI agents use the MCP tool vpn (actions daftar, pasang, perangkat_buat, perangkat_cabut, hapus).