The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →To make websites and APIs see your home public IP instead of your VPS address, use the VPS as a WireGuard client and a home router or always-on Linux gateway as the Internet exit. Set the home peer as the VPS’s default route with AllowedIPs = 0.0.0.0/0, enable forwarding, and masquerade tunnel traffic on the home gateway’s ISP-facing interface. Keep the WireGuard server endpoint reachable through the VPS’s ordinary uplink; otherwise the new default route can send the tunnel’s own packets back into the tunnel and break it.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
The resulting path is VPS → WireGuard tunnel → home router or gateway → home ISP → Internet. External services then observe the public address assigned to the home connection. IPv6 requires a separately configured and tested ::/0 route; do not enable it merely because IPv4 works.
As an Amazon Associate I earn from qualifying purchases.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsWhat this setup does—and what it does not do
A full-tunnel WireGuard arrangement changes the VPS’s outbound route. Applications still run on the VPS, but their Internet-bound packets are encrypted to the home peer first. The home gateway decrypts them, forwards them to the Internet, and performs source NAT (masquerading) so replies return through the home connection.
This is different from exposing services hosted at home. The VPS remains the machine accepting your application traffic, while the home gateway acts as its egress point. Inbound connections to the VPS still arrive through the VPS provider unless you deliberately build a separate reverse path.
#1 Best Overall
- Please update the firmware upon initial setup of the router, as it greatly enhances the device's performance and ensures a superior user experience.*** 【WiFi 6 Standard with ultra-low latency】Wi-Fi 6 speeds up to 6 Gbps to let you enjoy smoother 4K streaming, gaming, video calls and more, DDR4 1GB / eMMC 8GB
- 【High Speed Gaming Router】Dominate with uninterrupted performance with the ultimate MT6000 gaming internet router, equipped with 8-stream Wi-Fi 6 technology, the Flint 2 delivers blazing speeds, ensuring a stable and high-speed connection during intense multiplayer battles.
- 【Rapid OpenVPN & Wireguard speed】Wireguard VPN and OpenVPN speeds up to 900Mbps and 880Mbps respectively, giving you complete control over your gaming, streaming and working bandwidth. Actual speed may differ depending on internet service provider, network environment, VPN server location, VPN service provider, etc.
- 【AdGuard Home Supported】Enabling the use of a DNS server for blocking unwanted tracking and offers a convenient web interface for filtering selected digital advertisements. Users can take full control of their online experience and enjoy a clutter-free browsing environment with ease.
- 【Mass device connectivity】Experience enhanced online connectivity with our higher storage capacity, catering to over a hundred devices and fulfilling the requirements of DIY users seeking to install additional plugins. Enjoy stable and reliable connections, ensuring seamless performance and accommodating a wide range of digital needs.
WireGuard’s own paper describes the model this way: “In the case of a WireGuard peer who wishes to route all traffic through another WireGuard peer, the cryptokey routing table could be configured more simply as:”. In practical terms, the home peer receives the default route and becomes the VPS’s Internet exit.
Prerequisites and network plan
Prepare the network before changing a default route. You need:
- A VPS with root access and a public, reachable UDP port for WireGuard.
- A home router or always-on Linux gateway capable of running WireGuard and forwarding packets.
- A home public IPv4 address or a dynamic-DNS hostname that resolves to it. If your ISP uses carrier-grade NAT (CGNAT), direct inbound WireGuard traffic may not be possible; plan for a public-IP VPS relay or another reachable coordinator.
- Separate, non-overlapping CIDR ranges for the WireGuard tunnel, the home LAN, and any remote LANs.
- Firewall permission for the WireGuard UDP listen port and for forwarding from the tunnel interface to the home WAN interface.
Use a dedicated tunnel range such as 10.90.0.0/24. Assign one address to the home gateway and another to the VPS, for example 10.90.0.1 and 10.90.0.2. These values are examples, not requirements; the important rule is that they do not overlap any network already used on either side.
Reference topology
VPS (10.90.0.2)
│ WireGuard UDP tunnel
▼
Home router or Linux gateway (10.90.0.1)
│ forwarding + masquerade
▼
Home ISP connection → InternetA home gateway behind CGNAT can often make outbound connections but cannot accept a new inbound WireGuard session from the VPS. In that case, a public-IP VPS relay or hub can provide the reachable rendezvous point. Relaying adds another hop and can reduce speed.
Choose the home-side implementation
| Implementation | Address reachability | Control and complexity | Best fit |
|---|---|---|---|
| WireGuard on a home router with a public address | VPS can connect directly to the router’s UDP endpoint. | Simple packet path; firewall and NAT options depend on the router firmware. | Homes with a supported router and straightforward full-tunnel needs. |
| WireGuard on an always-on Linux gateway | Requires a reachable home address, port forwarding, or a dynamic-DNS hostname. | Most control over forwarding, firewall rules, policy routing, and logging; more administration. | Readers who need explicit rules or have a separate gateway device. |
| Public-IP relay or hub | Both peers connect to a reachable public VPS when the home ISP uses CGNAT. | Adds relay configuration, latency, and a possible throughput bottleneck. | Homes that cannot receive inbound UDP directly. |
Evaluate each option on six axes: whether a direct home public IP is available, WireGuard support in the router firmware, completeness of IPv4 and IPv6 routing, expected latency and upload capacity, policy-routing complexity, and the quality of firewall and key-management controls.
Step 1: Create keys and the tunnel
Generate one private/public key pair for the VPS and another for the home peer using the WireGuard tooling supplied by your operating system. Keep private keys readable only by the account that manages the tunnel. Never reuse a private key on both peers.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Rank #2
- 【DUAL BAND WIFI 7 TRAVEL ROUTER】Products with US, UK, EU, AU Plug; Dual band network with wireless speed 688Mbps (2.4G)+2882Mbps (5G); Dual 2.5G Ethernet Ports (1x WAN and 1x LAN Port); USB 3.0 port.
- 【NETWORK CONTROL WITH TOUCHSCREEN SIMPLICITY】Slate 7’s touchscreen interface lets you scan QR codes for quick Wi-Fi, monitor speed in real time, toggle VPN on/off, and switch providers directly on the display. Color-coded indicators provide instant network status updates for Ethernet, Tethering, Repeater, and Cellular modes, offering a seamless, user-friendly experience.
- 【OpenWrt 23.05 FIRMWARE】The Slate 7 (GL-BE3600) is a high-performance Wi-Fi 7 travel router, built with OpenWrt 23.05 (Kernel 5.4.213) for maximum customization and advanced networking capabilities. With 512MB storage, total customization with open-source freedom and flexible installation of OpenWrt plugins.
- 【VPN CLIENT & SERVER】OpenVPN and WireGuard are pre-installed, compatible with 30+ VPN service providers (active subscription required). Simply log in to your existing VPN account with our portable wifi device, and Slate 7 automatically encrypts all network traffic within the connected network. Max. VPN speed of 100 Mbps (OpenVPN); 540 Mbps (WireGuard). *Speed tests are conducted on a local network. Real-world speeds may differ depending on your network configuration.*
- 【PERFECT PORTABLE WIFI ROUTER FOR TRAVEL】The Slate 7 is an ideal portable internet device perfect for international travel. With its mini size and travel-friendly features, the pocket Wi-Fi router is the perfect companion for travelers in need of a secure internet connectivity on the go in which includes hotels or cruise ships.
Assign the dedicated tunnel addresses selected in your plan. The VPS and home gateway must agree on the tunnel subnet, but each peer should have its own address. Record the VPS public key and the home public key; each configuration references the other side’s public key.
Step 2: Configure the home peer
The home peer listens on a UDP port and identifies the VPS as its peer. A conceptual configuration looks like this:
[Interface]
Address = 10.90.0.1/24
PrivateKey = <home-private-key>
ListenPort = <wireguard-udp-port>
[Peer]
PublicKey = <vps-public-key>
AllowedIPs = 10.90.0.2/32Replace the bracketed values with real values; do not paste angle-bracket placeholders into a live file. If the home public address changes, use a dynamic-DNS hostname as the VPS’s endpoint and update it when the address changes. A persistent keepalive on the peer is useful when the home side sits behind NAT because it keeps the NAT mapping active.
Permit the selected UDP listen port on the home firewall and, if the gateway is behind another router, forward that port to the WireGuard device. Restrict administrative interfaces separately; opening the WireGuard port does not require exposing router management services.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Step 3: Configure the VPS as a full-tunnel client
On the VPS, define the home peer and make it responsible for every IPv4 destination:
[Interface]
Address = 10.90.0.2/24
PrivateKey = <vps-private-key>
[Peer]
PublicKey = <home-public-key>
Endpoint = <home-dynamic-dns-or-public-address>:<wireguard-udp-port>
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25AllowedIPs = 0.0.0.0/0 is the critical IPv4 setting: it installs the home peer as the VPS’s default route. The keepalive value shown is an example commonly used for a peer behind NAT; choose a value appropriate for your network and router.
Rank #3
- Next-Gen Gigabit Wi-Fi 6 Speeds: 2402 Mbps on 5 GHz and 574 Mbps on 2.4 GHz bands ensure smoother streaming and faster downloads; support VPN server and VPN client¹
- A More Responsive Experience: Enjoy smooth gaming, video streaming, and live feeds simultaneously. OFDMA makes your Wi-Fi stronger by allowing multiple clients to share one band at the same time, cutting latency and jitter.²
- Expanded Wi-Fi Coverage: 4 high-gain external antennas and Beamforming technology combine to extend strong, reliable, Wi-Fi throughout your home.
- Improved Battery Life: Target Wake Time helps your devices to communicate efficiently while consuming less power.
- Improved Cooling Design: No heat ups, no throttles. A larger heat sink and redefined case design cools the WiFi 6 system and enables your network to stay at top speeds in more versatile environments.
Prevent the endpoint routing loop
The VPS must continue reaching the home peer’s WireGuard endpoint through its ordinary provider interface. If the endpoint’s own packets follow 0.0.0.0/0 into the tunnel, the tunnel can drop immediately after activation. Use wg-quick‘s policy-routing behavior or install an explicit host route for the endpoint through the VPS’s normal gateway before enabling the full tunnel.
Determine the endpoint’s current address and the VPS’s normal next hop before changing routes. After activation, verify that the endpoint route still selects the ordinary uplink rather than the WireGuard interface. If the home address is a hostname, account for address changes so the exception remains valid.
Recommended Free Tools
Adding IPv6
::/0 is the IPv6 counterpart to 0.0.0.0/0, but it is safe only when the home gateway forwards IPv6 and has working IPv6 egress. Configure IPv6 addresses and forwarding on both ends, add the IPv6 default route, and test it independently. If you configure only the IPv4 tunnel, applications that prefer IPv6 may continue using the VPS provider’s IPv6 path; that can make an address-checking site show a different source address than expected.
Step 4: Enable forwarding on the home gateway
The home gateway is a router for tunnel traffic, not merely a WireGuard endpoint. Enable IPv4 forwarding on Linux and make the setting persistent using the mechanism provided by your distribution. Also enable IPv6 forwarding if you intend to carry ::/0.
sysctl -w net.ipv4.ip_forward=1
# Enable net.ipv6.conf.all.forwarding=1 only for a configured IPv6 tunnelThen permit forwarding from the WireGuard interface to the ISP-facing WAN interface, plus established and related return traffic. The exact interface names differ: a Linux gateway may use wg0 and eth0, while a router firmware uses its own zone names. Make the rule as narrow as practical by limiting it to the tunnel source range and the intended WAN.
Step 5: Masquerade Internet-bound traffic at home
Internet destinations generally do not have routes back to the private tunnel subnet. Masquerade packets arriving from the VPS tunnel as they leave the home WAN so replies return to the gateway and can be translated back to 10.90.0.2.
Rank #4
- 【Five Gigabit Ports】1 Gigabit WAN Port plus 2 Gigabit WAN/LAN Ports plus 2 Gigabit LAN Port. Up to 3 WAN ports optimize bandwidth usage through one device.
- 【One USB WAN Port】Mobile broadband via 4G/3G modem is supported for WAN backup by connecting to the USB port. For complete list of compatible 4G/3G modems, please visit TP-Link website.
- 【Abundant Security Features】Advanced firewall policies, DoS defense, IP/MAC/URL filtering, speed test and more security functions protect your network and data.
- 【Highly Secure VPN】Supports up to 20× LAN-to-LAN IPsec, 16× OpenVPN, 16× L2TP, and 16× PPTP VPN connections.
- Security - SPI Firewall, VPN Pass through, FTP/H.323/PPTP/SIP/IPsec ALG, DoS Defence, Ping of Death and Local Management. Standards and Protocols IEEE 802.3, 802.3u, 802.3ab, IEEE 802.3x, IEEE 802.1q
iptables -t nat -A POSTROUTING -s 10.90.0.0/24 -o <home-wan-interface> -j MASQUERADEAdapt the rule to the firewall system on your gateway and persist it according to that system’s configuration method. The source range and WAN interface must match your actual plan.
Do not apply this Internet masquerade to traffic that should remain routed between private sites. Ubuntu’s site-to-site guidance states: “Do NOT masquerade or NAT the traffic coming from the internal network and going out via the WireGuard interface towards the other site.” For private-site routes, use explicit routes and forwarding rules instead of hiding the source address.
Step 6: Firewall only what the tunnel needs
- Allow the selected WireGuard UDP listen port from the intended peer or, where necessary, from the Internet.
- Allow forwarding from the WireGuard interface to the home WAN for the tunnel source range.
- Allow established and related return traffic back to the tunnel.
- Keep router and gateway administration restricted to trusted management networks.
- Limit private-site forwarding to the specific CIDRs that should communicate.
A tunnel handshake can succeed even when forwarding is blocked, so treat WireGuard’s cryptographic connection and the gateway’s packet policy as separate controls.
Free tools Windows power users keep installed
One-click scans. No signup required.
Step 7: Bring up and test in layers
- Check the handshake. Run
wg showon both peers. Confirm a recent handshake time and increasing transfer counters. A missing handshake points to keys, endpoint, UDP filtering, CGNAT, or keepalive problems. - Check tunnel reachability. From the VPS, reach the home peer’s tunnel address. This isolates WireGuard from Internet forwarding.
- Inspect route selection. Run
ip routeon the VPS and verify that the default route uses the WireGuard policy while the endpoint exception remains on the ordinary uplink. - Check forwarding and NAT. Watch firewall counters on the home gateway while generating traffic from the VPS. Counters should increase on the tunnel-to-WAN forwarding and masquerade rules.
- Test DNS. Resolve a known hostname from the VPS. If DNS fails while tunnel pings work, inspect the VPS resolver and the home gateway’s forwarding policy separately.
- Verify the observed IPv4 address. Make an HTTPS request to a service that reports the caller’s public address. The result should be the home connection’s public IPv4 address, not the VPS address.
- Verify IPv6 separately. If
::/0is enabled, make an IPv6 request and confirm that IPv6 egress is also through the home connection. A successful IPv4 test does not validate IPv6. - Test recovery. Stop WireGuard and confirm that the VPS returns to its normal provider route. This protects you from leaving a server stranded after a tunnel failure.
Diagnosing common failures
No handshake appears
Recheck that each peer has the other peer’s current public key and that the endpoint hostname resolves to the current home address. Confirm the UDP port is permitted through every firewall and port-forwarding device. A home peer behind CGNAT may need persistent keepalive; if inbound reachability is impossible, use a public-IP relay or hub.
Handshake works, but the VPS has no Internet
Check IPv4 forwarding on the home gateway, the tunnel-to-WAN forwarding rule, and the WAN masquerade rule. A home firewall can accept WireGuard packets while dropping forwarded packets. Confirm the NAT rule uses the actual WAN interface and the tunnel source subnet.
The tunnel drops as soon as the default route is enabled
This is usually the endpoint routing loop. The VPS has sent its own WireGuard UDP traffic into the new tunnel, so the peer cannot remain reachable. Restore the normal route, add an endpoint host route or policy-routing exception through the VPS uplink, and activate the full tunnel again.
Best Value
- 𝐑𝐨𝐚𝐦 𝟔 𝐀𝐗𝟏𝟓𝟎𝟎 𝐝𝐮𝐚𝐥-𝐛𝐚𝐧𝐝 𝐬𝐩𝐞𝐞𝐝𝐬 - Wi-Fi 6 Speeds up to 1,201 Mbps (5 GHz) and 300 Mbps (2.4 GHz) for up to 60 devices simultaneously. Actual Wi-Fi speeds vary based on source bandwidth, environment, distance to devices, and obstacles. ◇§
- 𝐏𝐨𝐫𝐭𝐚𝐛𝐥𝐞 𝐚𝐧𝐝 𝐝𝐮𝐫𝐚𝐛𝐥𝐞 𝐝𝐞𝐬𝐢𝐠𝐧 - Roam 6 AX1500 is a pocket-sized travel router compactly designed for trips and adventures, featuring a 1 Gbps WAN/LAN port and a 1 Gbps LAN port for reliable wired connectivity.
- 𝗦𝗲𝗰𝘂𝗿𝗲 𝗪𝗶-𝗙𝗶 𝗼𝗻-𝘁𝗵𝗲-𝗴𝗼 - Connects to public Wi-Fi and creates a private, secure network for all your devices. Supports multiple devices at once, ideal for hotels, Airbnbs, airports, and even home use. VPN connectivity enables secure remote work.
- 𝐌𝐮𝐥𝐭𝐢𝐩𝐥𝐞 𝐰𝐚𝐲𝐬 𝐭𝐨 𝐜𝐨𝐧𝐧𝐞𝐜𝐭 - (1) Router Mode: Connects to public Wi-Fi, ISP, or phone (USB tethering). (2) AP/RE/Client Mode: Adds WiFi to wired setups, extends WiFi, or connects wired devices wirelessly.
- 𝐎𝐮𝐫 𝐜𝐲𝐛𝐞𝐫𝐬𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐜𝐨𝐦𝐦𝐢𝐭𝐦𝐞𝐧𝐭 - TP-Link is a signatory of the U.S. Cybersecurity and Infrastructure Security Agency’s (CISA) Secure-by-Design pledge. Advanced security is integrated into the device’s design, development, and ongoing maintenance.
Private-site traffic breaks
Look for overlapping CIDRs between the tunnel, home LAN, VPS LAN, and any remote LAN. Overlap makes route selection ambiguous. Also remove accidental NAT from traffic that should be routed between private sites; private peers need routes and forwarding, not Internet masquerade.
Public checks still show the VPS address
Confirm the VPS default route actually points to the WireGuard policy and that the home gateway is forwarding and masquerading. If IPv6 is enabled outside the tunnel, an application may be using that IPv6 path while your IPv4 test is correct. Check both address families independently. Finally, determine whether the home connection itself is behind another upstream NAT; the observed address may belong to that upstream provider rather than the router’s local WAN address.
Throughput is poor or the connection is unstable
The path can be limited by relay traversal, the home’s upload capacity, router CPU, MTU or fragmentation problems, or ISP filtering. There is no universal performance figure for this design: results depend on those variables and on the specific hardware and links. Start by checking whether a relay is involved, then compare transfer counters and latency with and without the tunnel. Adjust MTU only after confirming fragmentation symptoms, and keep firewall logging focused so an overloaded gateway is not mistaken for a routing error.
Operational safeguards
- Keep a console or out-of-band recovery method for the VPS before changing its default route.
- Store private keys with restrictive permissions and rotate a peer’s key if it may have been exposed.
- Document the endpoint exception, tunnel CIDR, forwarding rules, and NAT rule so a reboot or firmware change does not silently remove one component.
- Monitor handshake age and transfer counters; a tunnel can remain configured while the home peer is offline.
- Re-test the observed IPv4 and IPv6 addresses after ISP changes, router updates, or edits to policy routing.
When a full tunnel is the wrong design
A full tunnel sends every VPS destination through the home connection, including traffic that might be better served locally. If only a private home subnet or a small set of services is needed, advertise those specific CIDRs instead of 0.0.0.0/0. That reduces bandwidth use and avoids making the home’s upload link a bottleneck, while preserving ordinary VPS egress for other destinations.
Use the full-tunnel design when the reader’s actual requirement is that general Internet services observe the home public address. Use selective routes when the requirement is site-to-site access, management of home devices, or access to one private application. In either case, keep the networks non-overlapping and avoid NAT on traffic that should remain routed.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
