VPN and proxies where you need them.

After payment, everything appears in your account at panel.pandadefender.com and in the Telegram bot @PandaDefenderBot. Setting up an individual server may take a few minutes.

1. Account. Configs are under “Shared configs” and “Individual configs” (on a computer, in the “More” menu). Open a config to find the “Show QR code”, “Download .conf” and “Show key” buttons; “Show key” displays the full text of the config so you can copy it. Proxies are under “My proxies”.
2. Bot. After a purchase the bot sends a .conf file with the “Show key” and “QR code” buttons. You can find them again later in “My connections” → your config. Your individual server is listed there too.

One config is for one device. If you turn it on on two devices at once, the connection will keep dropping on both.

Install the official WireGuard app: for Windows from wireguard.com/install, for iPhone, iPad and Mac from the App Store, for Android from Google Play. Then add the config:

1. Android. The easiest way is a picture of the QR code: in the bot tap “QR code” and save the image, or take a screenshot of the QR code in your account. In WireGuard tap “+” → “Import from file or archive”, pick that image and enter a name in Latin letters, up to 15 characters, for example panda-de. If the QR code is open on a computer screen, choose “Scan from QR code” instead. Import the .conf file itself only if its name is 15 Latin characters or shorter (see the question about errors below).
2. iPhone and iPad. In Telegram, open the .conf file → Share → WireGuard. Or in WireGuard tap “+” → “Create from file or archive” or “Create from QR code” and point the camera at a QR code on another screen.
3. Windows. Download the .conf file, click “Import tunnel(s) from file” in WireGuard, choose the file and click “Activate”. If the file won't import, click the arrow next to “Add Tunnel” → “Add empty tunnel…”, replace all the text with the text from “Show key” and enter a name in Latin letters. You need an account with administrator rights.
4. Mac. Download the .conf file, choose “Import tunnel(s) from file” in WireGuard and click “Activate”.
5. Linux. Install the wireguard-tools package, save the config as /etc/wireguard/panda.conf and run sudo wg-quick up panda. If you see “resolvconf: command not found”, install the resolvconf or openresolv package.

The first time you turn the tunnel on, your device asks you to allow a VPN configuration — allow it. When everything works, the tunnel shows a “Latest handshake” line.

If you're not sure, choose WireGuard: it has official apps for every system. AmneziaWG is a variant of WireGuard with extra connection parameters, and it needs its own app. The protocol is chosen when you buy and can't be changed for an existing config. If WireGuard won't connect, first go through the steps in “The VPN is on, but the internet doesn't work” and contact support — we'll tell you whether an AmneziaWG config makes sense. An AmneziaWG config won't open in the WireGuard app; use one of these apps instead:

1. AmneziaWG — from Google Play for Android, from the App Store for iPhone, iPad and Mac, and for Windows the installer from the amneziawg-windows-client page on GitHub. You add the config the same way as in WireGuard, with the same rules for the name.
2. AmneziaVPN — for Windows, Mac, Linux, Android and iPhone. Tap “+” → “File with connection settings”, choose the .conf file, then “Continue” → “Connect”.

A regular WireGuard config works in these apps too. On an individual server you can add a config with the other protocol in the bot: “My connections” → your server → “Add config”.

Open the tunnel in the app. If there's no “Latest handshake” line, or the received data counter barely grows, your device can't reach the server (the app's log then shows “Handshake did not complete”). Check these in order:

1. The config hasn't expired — you can see this in your account and in the bot.
2. Date and time on the device are set automatically. If the clock was moved back, WireGuard may fail to connect, and with the wrong time many sites won't open.
3. The same config isn't turned on on another device.
4. Other VPN and proxy apps are off. Android runs only one VPN at a time, so check that “Always-on VPN” isn't enabled for another app (Settings → Network & internet → VPN).
5. The internet works without the VPN. Try another network, for example mobile data instead of Wi‑Fi: WireGuard uses UDP, and some networks, such as guest or office Wi‑Fi, restrict it.
6. The config hasn't been edited by hand. If you're not sure, delete the tunnel and add the config again.

If there is a “Latest handshake” but sites don't open, make sure the DNS line is still in the config, and on Android set “Private DNS” to “Automatic” or “Off” (the names depend on the phone model). Still not working? Contact support and attach a screenshot of the error or of the app's log.

Some sites and apps — for example banks, payment services and marketplaces — limit sign-ins from data-centre addresses or from other countries: they ask for a CAPTCHA, make you sign in again or don't open at all. What you can do:

1. Connect to a server in the country you usually use this service from — for example, your own country if it's on the list.
2. Exclude the app from the VPN. In WireGuard and AmneziaWG for Android: open the tunnel → pencil icon → “All Applications” → “Exclude” tab → tick the app → “Exclude 1 app” → save the tunnel (floppy disk icon). In AmneziaVPN use “App split tunneling”: you can exclude apps on Android and Windows, but only sites on iPhone and Mac. WireGuard for iPhone and computers has no such setting — turn the VPN off while you use that service.
3. Clear the site's cookies or the app's data and sign in again.
4. If the service doesn't accept a shared address, an individual server may help: its IP address is used only by you.
5. If nothing helps, contact support and tell us the service, the server and what exactly happens.

Your proxy details are in your account (“My proxies” → open the proxy → “Connection details”) or in the bot: HTTP address and port, SOCKS5 address and port, login and password. Use the HTTP line for browsers and system settings, and the SOCKS5 line for Telegram and other apps that support SOCKS5.

1. Browser (Chrome, Edge, Firefox). Install the FoxyProxy extension and add a proxy: type HTTP, the address, the HTTP port, login and password. Chrome and Edge don't support SOCKS5 with a login and password.
2. Windows. Settings → Network & internet → Proxy → under “Manual proxy setup”, click “Set up”. Turn on “Use a proxy server”, enter the address and the HTTP port and save. The browser will ask for the login and password itself.
3. Mac. System Settings → Network → your connection → “Details” → “Proxies”. Turn on “Web proxy (HTTP)” and “Secure web proxy (HTTPS)”, enter the address and the HTTP port, turn on “Proxy server requires password” and enter the login and password.
4. iPhone. Settings → Wi‑Fi → ⓘ next to the network → “Configure Proxy” → “Manual”. Enter the server and the HTTP port, turn on “Authentication” and enter the login and password.
5. Android. In the Wi‑Fi network settings open “Proxy” → “Manual” and enter the address and the HTTP port; the browser will ask for the login. Other apps may not use this proxy.

On iPhone and Android the proxy works only on that Wi‑Fi network; it can't be set this way for mobile data. An IPv6 proxy opens only sites that support IPv6. Most sites work over IPv4, so if you're not sure, choose IPv4.