Wayk Bastion

Wayk Bastion was Devolutions’ self-hosted server for the Wayk Now remote desktop tool. IT teams and MSPs used it to broker and relay remote sessions inside their own network, instead of going through a public cloud service. If you are looking for a Wayk Bastion download today, know this first: the product was discontinued in July 2021. It is no longer sold, its support ended at the end of 2021, and Devolutions points users to Devolutions Gateway as the successor.

This page is for admins who still find an old Bastion host in their environment, or who need a supported replacement. Below we explain what Wayk Bastion did, how to retire it cleanly, and how its successor differs. In the same 2021 announcement, Devolutions said that Wayk’s capabilities were being folded into Devolutions Server, that the Wayk Agent would become the Devolutions Agent, and that most features were being carried over to Devolutions Gateway.

Wayk Bastion at a glance

What it does

As Wayk Bastion worked until 2021 (formerly named Wayk Den):

• Acted as a self-hosted broker for Wayk Now clients, so machines registered with your own server instead of the public Wayk service.
• Relayed remote desktop traffic through a gateway component when a direct peer-to-peer connection was not possible.
• Kept a central list of machines and users for unattended access, with access control per user.
• Ran as a set of Docker containers (den-server, den-lucid, den-picky and others) behind a Traefik reverse proxy, which was the only part exposed on the host.
• Was managed through PowerShell cmdlets, for example New-WaykBastionConfig, Start-WaykBastion, Update-WaykBastionImage, Backup-WaykBastionData and Export-WaykBastionLogs.
• Could register itself as a system service (Register-WaykBastionService) and forward container logs to a syslog server.

How sysadmins use it

Audit a leftover Bastion host

1. On the host, load the module and print the current configuration:

   Import-Module WaykBastion
   Get-WaykBastionConfig
   Get-WaykBastionPath

2. Note the external URL, the certificate in use and which ports Traefik publishes. Then check your firewall for matching inbound rules.
3. Run docker ps to see which den-* containers are still running and how old the images are. They have received no security updates since 2021.

Retire it safely

1. Export what you may need for audits: run Export-WaykBastionLogs and Backup-WaykBastionData (check Get-Help Backup-WaykBastionData for the parameters in your module version).
2. Stop the stack and remove the service registration:

   Stop-WaykBastion
   Unregister-WaykBastionService

3. Close the inbound firewall and NAT rules that pointed at the host, revoke or let expire its TLS certificate, and remove its DNS record.
4. Uninstall Wayk Now from endpoints, or replace it with the remote access tool you migrate to.

Move to Devolutions Gateway

1. Decide on the control plane: per Devolutions’ documentation, Gateway is configured from Devolutions Server or Devolutions Cloud and needs a Gateway licence for that setup.
2. Install Gateway on Windows (MSI) or on Linux (.deb and .rpm packages for x64 and ARM64 are published with each GitHub release).
3. Open the listener ports: 7171/TCP for the HTTP(S) listener (web sessions) and 8181/TCP for the TCP listener (native client sessions):

   sudo ufw allow 7171/tcp
   sudo ufw allow 8181/tcp

4. Install a trusted TLS certificate; WebSocket-based web sessions fail with an untrusted one.

Install and first run

Wayk Bastion (historical). It was installed with Install-Module -Name WaykBastion on a host with Docker and PowerShell 5.1 or later. You then created the configuration with New-WaykBastionConfig and started it with Start-WaykBastion, which pulled the container images. The module is now unlisted in the PowerShell Gallery, and building a new Bastion server makes no sense: the Wayk Now clients it served are discontinued too.

Devolutions Gateway (successor). Gateway is a relay written in Rust, and its source is on GitHub under the Apache-2.0 and MIT licences. The current release is 2026.3.0 (15 September 2026).

• Windows: install the MSI with admin rights; the configuration file is %ProgramData%DevolutionsGatewaygateway.json.
• Linux: install the package with sudo dpkg -i devolutions-gateway-*-x64.deb (or the .rpm on RHEL-family systems); the configuration is in /etc/devolutions-gateway/ and the binary is /usr/bin/devolutions-gateway. Re-installing a newer package keeps the configuration.
• Management: the DevolutionsGateway PowerShell module (Install-Module -Name DevolutionsGateway) works on Windows and, with PowerShell 7, on Linux.
• Gotchas: ports 7171 and 8181 must be reachable from clients, and the certificate must be trusted by browsers.

Limitations

• Discontinued: no sales, no support since the end of 2021, and no security patches for its containers.
• Its clients (Wayk Now) are discontinued too, so even a working Bastion has nothing current to serve.
• Documentation is archived and scattered; parts of the official blog and repositories have moved or gone offline.
• Migration is not one-to-one. Devolutions Gateway is a session relay that works with Remote Desktop Manager and Devolutions Server, not a drop-in Wayk server.

Wayk Bastion vs alternatives

For simple attended support without hosting anything yourself, a cloud tool such as AnyDesk is faster to roll out.

FAQ

Is Wayk Bastion still available?

No. Devolutions stopped selling Wayk Bastion and Wayk Now in July 2021 and ended support at the end of 2021.

What replaced Wayk Bastion?

Devolutions Gateway, used together with Devolutions Server or Devolutions Cloud. The Wayk Agent became the Devolutions Agent.

Is Wayk Bastion free?

It was a commercial product, and it can no longer be bought or licensed. Its successor’s source code is open on GitHub, but the documented setup with Devolutions Server requires a Gateway licence.

Can I still run my existing Wayk Bastion server?

It may still start, but it gets no patches, and its container images date from 2021. Treat it as an internet-facing liability and retire it.

Which ports does Devolutions Gateway use?

By default it uses 7171/TCP for the HTTP(S) listener and 8181/TCP for the TCP listener. Both can be changed during setup.

Does Devolutions Gateway run on Linux and Docker?

Yes. There are .deb and .rpm packages for x64 and ARM64 and an official Docker image. On Windows it installs as a service from an MSI.

Is there a free alternative to Wayk Bastion?

Apache Guacamole is the best-known free, open-source self-hosted remote access gateway.

Last checked against official sources: 1 October 2026 (developer website: devolutions.net). Versions and licence terms change — confirm on the developer's site before deploying in production.