Use a private network with Throughwire

Throughwire already encrypts the connection to its exit. A company can add its own private layer when it wants separate keys and access rules for internal systems.

This additional layer is optional. It is intended for private company systems, not required for ordinary web browsing.

The most reliable arrangement is:

Company device -> private layer -> Throughwire router -> company gateway or private service

Step 1: Use the router setup

Run Throughwire on the office router. Then run Tailscale, WireGuard, SSH, or cloudflared on the devices and servers behind it.

Do not install a second VPN engine directly on the Throughwire router. Two router VPNs can compete for DNS, routes, firewall rules, and the kill switch.

When Throughwire is running in Hiddify on a device, SSH and ordinary applications generally work normally. Tailscale or WireGuard on the same device may require advanced split routing. iPhone, iPad, and Android allow only one active VPN at a time.

Step 2: Choose the private layer

Option	Best for	Recommended configuration
Tailscale	Company devices, servers, and internal dashboards	Use normal tailnet routes. Do not enable an exit node.
WireGuard	A fully self-managed private gateway	Put only company networks in AllowedIPs. Do not use 0.0.0.0/0.
SSH	Server administration and occasional port forwarding	Use key authentication and keepalives.
Cloudflare Tunnel + Access	Publishing selected internal web or admin services	Run cloudflared beside the private service and protect it with Access.

Tailscale

Tailscale is the simplest default for most teams. Its normal configuration sends only private tailnet traffic through Tailscale, while Throughwire continues handling ordinary internet and China-direct traffic.

Do not select a Tailscale exit node. An exit node creates a second full internet tunnel, adds another route, and prevents Throughwire from handling local Chinese services directly. Tailscale also documents the limitations of running alongside another device VPN.

WireGuard

WireGuard is the better choice when the company wants to operate the gateway and keys itself. Configure AllowedIPs with only the private company networks that employees need. Place the gateway near the selected Throughwire exit whenever practical.

If large transfers stall while small requests work, test an MTU between 1280 and 1320. Keep the highest value that remains stable on the actual connection.

SSH

SSH is suitable for administration, remote shells, and individual port forwards. It is not a replacement for a private network covering many applications, but it is simple and dependable through either the Throughwire router or Hiddify.

Cloudflare Tunnel

Cloudflare Tunnel is for selected private services rather than the whole company network. It makes an outbound connection from the service to Cloudflare, so no inbound router port is required. Cloudflare is part of this trust path; Throughwire cannot read the private payload, but the company should still review Cloudflare's policies and access controls.

Leave the tunnel protocol on automatic first. If QUIC is unreliable, Cloudflare supports HTTP/2 as the fallback transport. See Cloudflare's Tunnel connectivity requirements.

Step 3: Keep the route short

An inner layer adds encryption overhead and one more destination. On a modern computer the cryptography is usually not the limiting factor; distance and relay choice matter more.

• Keep the private gateway near the Throughwire exit or the company service.
• Prefer direct Tailscale connections. Relayed connections remain encrypted but are slower.
• Route only company networks through Tailscale or WireGuard.
• Avoid sending all public internet traffic through a second tunnel.

Chinese services continue using Throughwire's China-direct route unless the private layer is configured as a full internet tunnel. Traffic sent to an overseas private gateway passes through Throughwire and counts toward the plan's data allowance.

Step 4: Understand what stays private

For traffic inside the additional private layer, Throughwire can observe the encrypted endpoint, timing, and data volume. It cannot read the inner payload or destinations. The private-network provider or company gateway has its own trust boundary, so its policies still apply.

For help choosing a topology, send us the operating systems, the Throughwire setup you use, and the region where your company gateway or services are hosted through the contact form.