Free tools Windows power users keep installed
One-click scans. No signup required.
A point-to-point WireGuard VPN links two Ubuntu hosts through a small, dedicated tunnel network. Give each host its own key pair and tunnel address, put the other host’s public key in a [Peer] section, and list the opposite tunnel address in AllowedIPs. Bring the interface up with wg-quick, then verify the handshake, routes and an end-to-end ping.
Antihost offers VPS plans with one-click OpenVPN, NVMe storage and a 14-day free trial.
The procedure below creates a direct host-to-host link on 10.10.10.0/24. It also explains what changes when one host is a gateway for an entire LAN, because forwarding, firewall rules and return routes are not needed for a simple tunnel-address ping but are essential for routed traffic.
As an Amazon Associate I earn from qualifying purchases.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →What this design creates
WireGuard is configured independently on each host. Every interface has a private key, a tunnel address and one or more peers identified by public keys. The private key stays on its host; only the corresponding public key is copied to the other host.
In this example, host A uses 10.10.10.1 and host B uses 10.10.10.2 inside the dedicated 10.10.10.0/24 tunnel subnet. Each peer advertises only the other host’s address with a /32 prefix. That narrow policy keeps the link point-to-point and prevents WireGuard from capturing unrelated traffic.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Direct host-to-host or routed site-to-site?
Decide which topology you actually need before writing configuration. A direct link carries traffic between the two Ubuntu machines themselves. A site-to-site design uses those machines as gateways for additional networks.
| Design | Endpoints | AllowedIPs entries | Forwarding and NAT | Firewall exposure | Startup |
|---|---|---|---|---|---|
| Host-to-host | The two Ubuntu hosts are the endpoints. | Usually the opposite tunnel address as a /32. |
Not required for traffic terminating on either host. | Allow the WireGuard UDP listener and the intended traffic on wg0. |
Enable wg-quick@wg0 if the link must return after reboot. |
| Routed site-to-site | Each Ubuntu machine is a gateway to a LAN or other interface. | Include the remote LAN CIDR, and commonly the local tunnel address as needed for peer traffic. | Enable IPv4 forwarding, permit forwarding in the firewall, and provide return routes. Use NAT only when a deliberate design requires it. | Protect both the UDP listener and forwarded traffic between interfaces. | Persistent startup is normally required on permanent site links. |
Do not put a LAN prefix in AllowedIPs merely because a tunnel exists. A prefix there tells WireGuard which destinations should use the peer and which source addresses are acceptable from that peer. It also causes wg-quick to install routes, so an overly broad prefix can redirect traffic unexpectedly.
Prerequisites and planning
Two reachable Ubuntu hosts
Use two existing Ubuntu systems with administrative access. Install the WireGuard tooling from the Ubuntu repository appropriate to each deployed Ubuntu release. The hosts must be able to exchange UDP packets on the chosen listening port, directly or through a firewall rule and, if necessary, a port-forward.
WireGuard does not require a special hardware appliance for this setup. Confirm the public address or DNS name and UDP port of whichever host must be reachable from the other. If one side is behind changing or unknown addressing, that side can omit its peer’s Endpoint and learn the current endpoint from authenticated traffic.
Choose a non-overlapping tunnel subnet
Select a private subnet that does not overlap either host’s physical LAN, cloud network, VPN, container network or any remote network you may later route. The example uses 10.10.10.0/24. Assign 10.10.10.1/24 to host A and 10.10.10.2/24 to host B. A different unused private range works just as well.
Plan the listener
The examples use UDP port 51820. The number is a convention, not a requirement; both sides must use the port on which the corresponding host listens, and any upstream security group, firewall or port-forward must permit it.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Install WireGuard and generate keys
On each Ubuntu host, install the distribution’s WireGuard package. On releases using the standard Ubuntu package manager, the command is:
sudo apt update
sudo apt install wireguardGenerate a separate key pair on each host. Run the following commands independently on host A and host B:
umask 077
wg genkey > wg0.key
wg pubkey < wg0.key > wg0.pubumask 077 makes newly created files readable only by their owner. Keep each wg0.key private; copy only the contents of wg0.pub to the other host. A private key decrypts traffic destined for its interface, while a peer public key identifies the key used to encrypt traffic sent to that peer.
You will need four values before editing configuration: host A’s private key, host A’s public key, host B’s private key and host B’s public key. Record which public key belongs to which host to avoid pairing the wrong keys.
Configure host A
Create /etc/wireguard/wg0.conf on host A as root. Replace the angle-bracketed values with the actual key text and host B’s reachable address.
[Interface]
Address = 10.10.10.1/24
ListenPort = 51820
PrivateKey = <host-A-private-key>
[Peer]
PublicKey = <host-B-public-key>
Endpoint = <host-B-public-ip-or-dns>:51820
AllowedIPs = 10.10.10.2/32
PersistentKeepalive = 25Address assigns host A’s tunnel address. ListenPort is the UDP socket on which A accepts WireGuard packets. The [Peer] block names B’s public key, identifies where A should send encrypted packets, and limits the peer’s tunnel destination and permitted source to 10.10.10.2.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
PersistentKeepalive = 25 sends a periodic authenticated packet approximately every 25 seconds. It is useful when a peer is behind stateful NAT that would otherwise expire its mapping. It is not a substitute for opening the listener or correcting an unreachable endpoint.
Configure host B
Create the inverse configuration on host B:
[Interface]
Address = 10.10.10.2/24
ListenPort = 51820
PrivateKey = <host-B-private-key>
[Peer]
PublicKey = <host-A-public-key>
Endpoint = <host-A-public-ip-or-dns>:51820
AllowedIPs = 10.10.10.1/32
PersistentKeepalive = 25Each side’s PublicKey must be the other side’s public key, never its own. Each side’s AllowedIPs must contain the opposite tunnel address. If both hosts have stable, mutually reachable public addresses, both can specify an Endpoint. If only one side is reachable, put that reachable address in the other side’s peer block and omit the endpoint on the side that must roam or initiate through NAT.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
WireGuard can learn a peer’s current endpoint from the first authenticated packet. Omitting an endpoint is therefore appropriate for a peer whose address is unknown or changes, provided that peer can initiate traffic toward the listening host.
Protect the files and bring the tunnel up
WireGuard configuration contains private keys, so restrict the file before starting it:
sudo chmod 600 /etc/wireguard/wg0.conf
sudo wg-quick up wg0wg-quick up wg0 creates the wg0 interface, assigns its address, applies the WireGuard parameters and installs routes inferred from peer AllowedIPs. Run the command on both hosts. A successful command normally returns without an error and leaves an active wg0 device.
To stop the temporary test tunnel, use:
sudo wg-quick down wg0Stopping the interface removes the routes and interface state created by wg-quick; it does not delete the configuration or key files.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsRank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Understand AllowedIPs before expanding the design
Why the two-host example uses /32
In a direct link, host A needs to send only traffic destined for 10.10.10.2 to host B, and B needs to send only traffic destined for 10.10.10.1 to A. The reciprocal /32 entries express exactly that relationship. The interface addresses remain in the same tunnel subnet, while the peer declarations stay narrowly scoped.
How site-to-site entries differ
Suppose host A is a gateway for 192.168.10.0/24 and host B is a gateway for 192.168.20.0/24. The peer section on A would include B’s remote LAN prefix, while B’s peer section would include A’s remote LAN prefix. Those prefixes tell the kernel to send matching traffic through wg0 and tell WireGuard which source ranges are valid from the peer. The exact entries depend on which networks are reachable behind each gateway; do not copy a broad prefix without matching routes and firewall policy.
Why 0.0.0.0/0 is a different project
AllowedIPs = 0.0.0.0/0 makes the peer a default gateway for IPv4 traffic. That full-tunnel design can also capture traffic needed to reach the peer’s own endpoint, and it requires careful endpoint routing, DNS handling and firewall rules. Use it only when the peer is intentionally serving as the default gateway, not as a shortcut for a two-host connection.
Verify the handshake, interface and route
Check both hosts after bringing the interfaces up:
sudo wg show
ip address show dev wg0
ip route | grep wg0
ping -c 3 10.10.10.2 # run on host A
ping -c 3 10.10.10.1 # run on host BWhat success looks like
wg showlists the expected peer public key, a recent handshake time and increasing receive/transmit counters after traffic.ip address show dev wg0shows the intended unique tunnel address on the local host.ip route | grep wg0shows routes corresponding to the peerAllowedIPs, such as a route for the opposite/32.- The tunnel-address ping receives replies from the opposite host.
After the ping succeeds, test the actual application or protocol the VPN is meant to carry. A successful handshake proves that cryptographic peers exchanged packets; it does not prove that a particular service port, local firewall policy or routed LAN path is usable.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Add forwarding only when traffic must cross the host
A ping that begins and ends on the two WireGuard hosts does not require IPv4 forwarding. Forwarding becomes necessary when either host must carry packets between wg0 and another interface, such as a LAN.
Enable IPv4 forwarding persistently
On each gateway that must route IPv4 traffic, create a dedicated sysctl file and load it:
sudo tee /etc/sysctl.d/70-wireguard-routing.conf >/dev/null <<'EOF'
net.ipv4.ip_forward = 1
EOF
sudo sysctl -p /etc/sysctl.d/70-wireguard-routing.confEnabling this setting allows the kernel to route packets between interfaces. It does not automatically permit them through the firewall or teach the remote LAN how to return traffic.
Permit forwarding in the firewall
Adjust the host firewall to allow the intended flows from wg0 to the LAN interface and in the reverse direction. Also allow UDP on the WireGuard listening port from the addresses that should reach it. Cloud security groups and upstream firewalls must permit the same traffic; a local rule cannot compensate for a blocked packet upstream.
Recommended Free Tools
Provide a return path or deliberate NAT
Hosts on a remote LAN must know how to return packets to the other LAN through the WireGuard gateway. Add a route on the LAN router, or on the relevant hosts, pointing the remote CIDR at the local gateway. NAT can hide the remote network when adding routes is impossible, but it changes source-address visibility and should be an intentional choice documented with the firewall policy.
For routed troubleshooting, test a host behind the remote gateway rather than stopping at the gateway’s tunnel address. This distinguishes a functioning WireGuard link from a missing forward rule or return route.
Make the link survive reboots
For a permanent connection, enable the systemd unit and start it immediately:
sudo systemctl enable --now wg-quick@wg0This enables the interface at boot and starts it in the current session. Check its state with:
systemctl status wg-quick@wg0If the service fails, inspect the unit’s error output and then validate the configuration, file permissions, key values, endpoint syntax and any conflicting interface or route. Use sudo wg-quick down wg0 and sudo wg-quick up wg0 for a controlled manual restart when testing changes.
Troubleshoot by symptom
| Symptom | Likely causes | Checks and corrective action |
|---|---|---|
| No recent handshake | UDP is blocked, the endpoint is wrong, keys are mismatched, or a NAT/port-forward targets the wrong machine. | Confirm each peer has the other peer’s public key, verify the address and port, permit UDP through host and cloud firewalls, and check that any port-forward reaches the intended listener. |
| Handshake exists but tunnel ping fails | Duplicate or incorrect tunnel addresses, missing reciprocal /32 entries, or a local firewall blocking ICMP. |
Compare both Address values, inspect wg show and ip route, verify each peer’s AllowedIPs, and allow ICMP or test the intended application port. |
| Tunnel ping works but LAN traffic fails | IPv4 forwarding is disabled, forwarding is denied, or the remote LAN lacks a return route. | Enable net.ipv4.ip_forward, add explicit forward rules, and install a return route or intentionally configured NAT. |
| Unexpected traffic uses the tunnel | A peer AllowedIPs prefix is broader than intended. |
Inspect ip route and narrow the prefix. Remember that wg-quick derives routes from AllowedIPs. |
| Connection works briefly behind NAT | The NAT mapping expires while idle. | Set PersistentKeepalive = 25 on the NAT-side peer and ensure the reachable side’s endpoint and UDP rule are correct. |
Operational and security practices
- Keep private keys readable only by root and never place them in shell history, tickets or public configuration repositories.
- Exchange public keys through a channel where you can verify which host produced each key.
- Use a unique tunnel subnet that remains distinct from present and planned LAN, container and cloud ranges.
- Expose the UDP listener only where necessary, and restrict forwarded traffic to the networks and ports the design requires.
- Review
AllowedIPswhenever a new LAN, route or peer is added; a broad entry changes both route selection and accepted peer source ranges. - After changing keys or endpoints, bring the interface down and up or restart its systemd unit, then confirm a new handshake and increasing transfer counters.
Result
With matching key pairs, unique tunnel addresses, reciprocal /32 peer entries and reachable UDP endpoints, the two Ubuntu hosts form a direct WireGuard network on 10.10.10.0/24. The handshake and route checks prove the tunnel itself; forwarding, firewall rules and return routes are the additional pieces required only when that tunnel carries traffic beyond the two endpoints.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
