1. Prepare the gateway
Use a server you own or are authorized to operate. Configure the tunnel interface, forwarding, firewall and public endpoint. Keep its private key out of the control-plane website.
2. Give each device its own peer
Create or import a unique device profile. Share only its public key with the operator’s provisioning workflow. Transfer private profiles through a channel you trust.
3. Verify the connection
Check the handshake, external address, DNS and intended IPv6 behavior. Then test permission denial, reconnection and what happens when the gateway goes offline.