Skip to content

Create a Remote Extended access

Prerequisites

  • Make sure your Alemca agent is at version 3.1.0 or higher.
  • Make sure you have downloaded and installed WireGuard from its official website, appropriate for your operating system.
  • Administrator rights: WireGuard requires administrator rights at two distinct points: during installation (to configure its network driver) and each time the tunnel is activated or deactivated (to create and manage network interfaces). A prompt (Windows) or a password request (macOS/Linux) will appear at these steps. Make sure you have the necessary permissions on your workstation.
  • Firewall: Remote Extended connects three entities : the WireGuard VPN server (managed by Alemca), your computer (WireGuard client), and the IoT device (Alemca agent). Each requires specific rules:
    • Your computer: allow outbound UDP traffic to the endpoint port shown in the connection details. On Windows, WireGuard generally creates the rule automatically, but a manual rule may be needed in Windows Defender Firewall if it does not appear.
    • WireGuard VPN server: no action required on your end — Alemca manages opening the inbound UDP port on the server side.
    • IoT device: if the device is connected via a cellular network, no firewall configuration is needed. The Alemca agent initiates the outbound connection to the VPN server itself. If the device is on a wired or corporate Wi-Fi network, allow outbound UDP traffic to the WireGuard endpoint port, the same way as for your computer.
  • Corporate firewall / proxy: if your computer or IoT device (excluding 3G/4G) is connected via a corporate network, verify that the network infrastructure does not filter UDP traffic. A corporate firewall or transparent proxy blocking UDP will prevent the WireGuard tunnel from being established.

Steps

1. Create an Access Point

  1. Log in to the Alemca web interface.
  2. Go to My Account > Config Extended.

Screenshot of the access point location 3. Click Create Access Point, give it a name, then confirm.

Screenshot of access point creation 4. After a few seconds, your access point is ready and the message "Access point active" appears.

2. Generate a WireGuard Key Pair

  1. Open the WireGuard application.
  2. Click Add Tunnel in the bottom left, then choose Add Empty Tunnel.
  3. WireGuard automatically generates a key pair. Copy the public key displayed at the top of the form — you will need it in the next step.
  4. Give the tunnel a name, then save it.

New WireGuard tunnel

3. Add a User to the Access Point

  1. Still on the Config Extended page, click Add User.
  2. Enter a username and paste the public key copied from WireGuard.
  3. Confirm the addition.

Propagation can take up to 1 minute. Once active, the connection details (assigned IP address, access point public key, etc.) appear in the interface.

Screenshot of user creation

4. Configure the WireGuard Client

Retrieve the information displayed in the user connection details. In the WireGuard application, open the tunnel created in the previous step and fill in the following configuration:

[Interface]
PrivateKey = <Private key automatically generated by WireGuard>
Address    = <Assigned IP address>

[Peer]
PublicKey  = <Access point public key>
Endpoint   = <Access point IP address>:<Port>
AllowedIPs = <Allowed address range>

Replace each value between < > with the one provided in the interface (the PrivateKey is already pre-filled by WireGuard).

Save and activate the tunnel by clicking Activate.

Windows 24H2 and later

Since the Windows 24H2 update, the WireGuard client may require one of the following solutions:

  • Enable Windows virtualization: see the official Microsoft documentation.

  • Adjust the configuration: remove the 192.0.2.254/32 address from the AllowedIPs list in the [Peer] section:

    [Peer]
PublicKey  = <Access point public key>
Endpoint   = <Access point IP address>:<Port>
AllowedIPs = 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16

To verify the tunnel is active, check that the "latest handshake" field shows a recent timestamp (less than 2 minutes ago) in the WireGuard interface, confirming that the connection is established.

Screenshot of a VPN tunnel

5. Create a Session with an Alemca Agent

  1. From the agent information page, open the Remote > Extended V2 section.
  2. In the Choose a terminal list, select the user created in the previous step.
  3. Fill in:
    • Target subnet — the address range you want to access on the agent (e.g. 192.168.0.0/16)
    • Session duration — in seconds (e.g. 3600 for 1 hour)
  4. Click Create session.

Screenshot of session creation

Warning

  • To access the entire remote site network, you must enter the network address. Using only a single machine address (e.g. 192.168.1.10/32) will only give access to that device.
  • You can calculate the network address using the following tool.
  • Select the desired subnet (e.g. /24), enter the target IP (e.g. 192.168.1.10), then click Calculate.
  • This will give you: Network address calculation
  • All that remains is to fill in the field with the calculated network address, in our example 192.168.1.0/24.

The agent then establishes a WireGuard tunnel. Once the session is active, you can interact with the agent through this tunnel.

Remote Extended sessions are ephemeral and will be automatically deleted by the server.