Share your embedded debug hardware with your team for remote debugging.
ProbeCodex allows you to share physical debug probes (J-Link, ST-Link, Nu-Link, etc.) with your team over a secure VPN. This enables remote debugging of embedded systems from anywhere in the world.
0.0.0.0:13333 (accessible over VPN)Install the ProbeCodex Agent on the machine where your debug probe is physically connected.
The VPN provides secure connectivity between you and your team members.
Windows
Download and install from: wireguard.com/install
Linux
ProbecodexVPN.conf filemacOS / Linux (via Agent)
The agent will automatically connect to VPN if enabled in config.
Windows (via WireGuard GUI)
ProbecodexVPN.conf fileThen start the agent:
Register your debug probe in the portal so team members can see and book it.
Important
Make sure your debug probe is connected and the agent is running. The agent detects USB probes automatically when you visit the hardware page.
Define when your hardware is available for others to book.
Example: Office Hours
Once hardware is shared, team members can connect to it remotely.
Or directly with GDB:
Success!
You are now connected to the remote OpenOCD instance over VPN. You can debug, flash, and inspect the target MCU as if the probe was locally connected.
ProbeCodex uses WireGuard, a modern, high-performance VPN protocol, to create a secure private network between team members sharing hardware.
ProbecodexVPN.conf) contains your private key and connection details10.100.1.x) on the team networkPer-Session Access Control
VPN peers can only communicate with each other during active, approved hardware bookings. Outside of booking windows, peer-to-peer traffic is blocked at the server level. Only the hardware owner and the borrower can see each other, and only during the scheduled time.
Unique Key Pairs
Each team member gets a unique X25519 cryptographic key pair. Your private key never leaves your machine after the initial download. All traffic is encrypted end-to-end using WireGuard's modern cryptography (ChaCha20, Poly1305, Curve25519).
Network Isolation
Organizations are isolated into separate VPN subnets. Your VPN configuration only allows traffic within your team's subnet — you cannot reach devices belonging to other organizations.
Have questions about VPN security? Use the AI Support Chat in the portal for detailed answers about our security architecture.
The ProbeCodex Agent manages your VPN connection automatically. During installation (probecodex-agent install), the agent:
~/.probecodex/wg0.conf with restricted file permissions (chmod 600)Show current VPN connection status, mode (direct/wstunnel), your VPN IP address, and connection health.
Manually connect to the VPN. The agent auto-detects the best mode (direct UDP or wstunnel) and connects. Use this if auto-connect was skipped or you disconnected manually.
Disconnect from the VPN. Also stops wstunnel if it was running.
Show the path to your VPN configuration file and whether it exists.
--no-vpn — Skip VPN setup during install (not allowed for Team/Enterprise tiers)--no-deps — Skip dependency installation (WireGuard, wstunnel)--keep-vpn — Keep VPN configuration when uninstallingWhen the agent starts (probecodex-agent start), it automatically:
If VPN connection fails, the agent continues running without VPN. You can retry with probecodex-agent vpn connect.
Need help with VPN issues? Use the AI Support Chat in the portal — it understands the full VPN architecture and can diagnose connection problems.
WireGuard uses UDP port 51820 by default. Some networks block this — corporate firewalls, hotel Wi-Fi, and mobile hotspots from certain carriers are known to block UDP VPN traffic.
Mobile Hotspot Users
Many mobile carriers block UDP ports used by VPN protocols like WireGuard. If you are tethering through a phone hotspot and the VPN won't connect, this is likely the cause. The wstunnel workaround below solves this.
wstunnel is an open-source tool that wraps WireGuard's UDP traffic inside a standard HTTPS WebSocket connection (TCP port 443). Since HTTPS traffic on port 443 is allowed by virtually every network, this bypasses UDP blocking while keeping all the security of WireGuard encryption.
How it works
Your Machine (WireGuard UDP)
↓
wstunnel client (wraps UDP in WebSocket)
↓ HTTPS port 443 (passes through any firewall)
ProbeCodex Server (Caddy TLS termination)
↓
wstunnel server (unwraps back to UDP)
↓
WireGuard Server (port 51820)
The ProbeCodex Agent handles this automatically. When it detects that UDP is blocked, it switches to wstunnel mode without any manual configuration. Just make sure wstunnel is installed:
macOS
Windows
Download the Windows binary from github.com/erebe/wstunnel/releases and add it to your PATH.
If you need to set up wstunnel manually (without the agent), follow these steps:
ProbecodexVPN.conf file:# Change this:
Endpoint = vpn.probecodex.com:51820
# To this:
Endpoint = 127.0.0.1:51820
Need help? Use the AI Support Chat in the portal — it has full context on the VPN architecture and can guide you through setup.
Windows users must connect to VPN manually via the WireGuard GUI app before starting the agent. The agent will then detect the existing VPN connection.
probecodex-agent statusping <VPN_IP> to test connectivityMany mobile carriers block UDP traffic used by WireGuard. Install wstunnel and the agent will automatically route traffic over HTTPS (TCP 443) instead. See Restrictive Networks above for details.
Peer-to-peer VPN traffic is only allowed during active, approved hardware bookings. Make sure your booking is approved, the scheduled time has started, and both you and the hardware owner have the agent running. Outside of booking windows, peer traffic is blocked for security.
Nu-Link probes require OpenOCD-Nuvoton, not standard OpenOCD. Install it from: github.com/OpenNuvoton/Nuvoton_Tools