A VPS can act as your always-on WireGuard server and give your devices one stable public Internet address. The basic pattern is: assign the VPS a provider-managed public IPv4 address, create an encrypted wg0 interface, route either selected networks or all client traffic through it, enable forwarding, and add source NAT when the VPS is the Internet gateway. In full-tunnel mode, websites see the VPS address rather than the client’s local address.
Antihost offers VPS plans with one-click OpenVPN, NVMe storage and a 14-day free trial.
This guide uses Ubuntu and WireGuard. It covers static-address choices, split and full tunnels, one-device and site-to-site designs, IPv4 and IPv6, exact setup steps, firewall rules, testing, and the failures that commonly produce a handshake without usable traffic.
As an Amazon Associate I earn from qualifying purchases.
What you are building
The VPS is the reachable endpoint on the public Internet. Its public IPv4 address appears in each client’s Endpoint setting, such as 198.51.100.20:51820. WireGuard then creates an encrypted virtual interface named wg0. Each peer has its own private key and public key; only public keys are exchanged.
Use a private VPN subnet that does not overlap with networks your users already reach. The example in this article uses 10.66.66.0/24, with 10.66.66.1 on the VPS and 10.66.66.2 for the first client. Replace those addresses if they conflict with a home, office, or cloud network.
#1 Best Overall
- 【Five Gigabit Ports】1 Gigabit WAN Port plus 2 Gigabit WAN/LAN Ports plus 2 Gigabit LAN Port. Up to 3 WAN ports optimize bandwidth usage through one device.
- 【One USB WAN Port】Mobile broadband via 4G/3G modem is supported for WAN backup by connecting to the USB port. For complete list of compatible 4G/3G modems, please visit TP-Link website.
- 【Abundant Security Features】Advanced firewall policies, DoS defense, IP/MAC/URL filtering, speed test and more security functions protect your network and data.
- 【Highly Secure VPN】Supports up to 20× LAN-to-LAN IPsec, 16× OpenVPN, 16× L2TP, and 16× PPTP VPN connections.
- Security - SPI Firewall, VPN Pass through, FTP/H.323/PPTP/SIP/IPsec ALG, DoS Defence, Ping of Death and Local Management. Standards and Protocols IEEE 802.3, 802.3u, 802.3ab, IEEE 802.3x, IEEE 802.1q
Canonical describes WireGuard as “a simple, fast and modern VPN implementation.” Its Ubuntu documentation also states that AllowedIPs is both a routing key for outgoing traffic and an access-control list for received traffic. That dual role is why a tunnel may show a handshake while packets still go nowhere.
Choose the architecture before installing anything
| Decision | Use this when | What changes in the configuration |
|---|---|---|
| Full tunnel | You want web, app, and DNS traffic to leave through the VPS. | The client sends 0.0.0.0/0 and, when using IPv6, ::/0 through the peer. The VPS forwards and masquerades that traffic. |
| Split tunnel | You only need access to a private network or selected service. | AllowedIPs contains only the VPN subnet and remote private prefixes; ordinary Internet traffic keeps its local route. |
| One client | A laptop, phone, or server needs a fixed egress address. | Give that peer one unique VPN address and one server-side [Peer] entry. |
| Site-to-site | Two networks must reach each other through gateway machines. | Use non-overlapping LAN ranges and explicit routes on both gateways. Do not assume NAT is required; Ubuntu’s site-to-site model routes between gateways without NAT. |
| IPv4 only | Your provider or applications do not require IPv6. | Forward and firewall IPv4 only; use 0.0.0.0/0 for a full tunnel. |
| Dual stack | Clients must retain IPv6 connectivity through the VPN. | Assign IPv6 addresses, enable IPv6 forwarding, permit IPv6 in both firewalls, and route ::/0 or the required IPv6 prefixes. |
| Provider-assigned address | The provider guarantees the address remains attached to the VPS through normal reboots and you accept lifecycle risk. | Use that address as Endpoint. Rebuilds, deletion, or reassignment may change it. |
| Reserved or static address | The provider separates an address allocation from the virtual machine. | Attach the reserved address to the VPS and update DNS or client endpoints only when you intentionally move it. |
Why the public address matters
Always-on peers need a stable endpoint. Canonical’s site-to-site guidance says both peers should have “a static endpoint, like a fixed IP address, or valid domain name.” A reserved address is therefore preferable when the provider can detach an address during a rebuild or replacement. A DNS name can also work, but every client must resolve the new address and your DNS record must be updated promptly.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Provision the Ubuntu VPS and record its network details
- Create the VPS. Select a supported Ubuntu LTS image, attach a public IPv4 address, and choose a region close to the users or networks that will use the tunnel. If the control panel offers a reserved or floating address, allocate it and attach it to this instance.
- Allow administrative access. Permit SSH from your administration address before enabling a host firewall. Keep the provider security group and the Ubuntu firewall in mind: they are separate controls.
- Connect and update packages.
sudo apt update sudo apt full-upgrade - Identify the public interface and default gateway.
ip -br addr ip route show defaultRecord the interface shown after
devon the default route, for exampleens3. Do not assume the interface is namedeth0. - Confirm the public address. Compare
ip -br addrwith the address shown by the provider. If the provider uses separate private and public interfaces, follow its documented routing model rather than adding a second default route.
Install WireGuard and create keys
Install the Ubuntu package and create a protected directory for keys:
sudo apt install wireguard
sudo install -d -m 700 /etc/wireguard
sudo sh -c 'umask 077; wg genkey > /etc/wireguard/server.key; wg pubkey < /etc/wireguard/server.key > /etc/wireguard/server.pub'
Generate one key pair for every client. Run the following on a trusted client, or generate it on the VPS and transfer the private key through a protected channel:
umask 077
wg genkey > client1.key
wg pubkey < client1.key > client1.pub- Keep
server.keyand each client private key secret. Anyone who obtains a private key can impersonate that peer. - Exchange only the public keys. A server configuration needs the client public key; the client configuration needs the server public key.
- Back up keys in an encrypted password manager or secured administrative store. Do not paste private keys into tickets, chat rooms, or shell history.
Build the WireGuard server configuration
Create /etc/wireguard/wg0.conf with mode 600:
sudo touch /etc/wireguard/wg0.conf
sudo chmod 600 /etc/wireguard/wg0.confUse this structure, substituting the generated key contents and the client’s public key inside the code block:
Rank #2
- 【AC1200 Dual-band Wireless Router】Simultaneous dual-band with wireless speed up to 300 Mbps (2.4GHz) + 867 Mbps (5GHz). 2.4GHz band can handles some simple tasks like emails or web browsing while bandwidth intensive tasks such as gaming or 4K video streaming can be handled by the 5GHz band.*Speed tests are conducted on a local network. Real-world speeds may differ depending on your network configuration.*
- 【Easy Setup】Please refer to the User Manual and the Unboxing & Setup video guide on Amazon for detailed setup instructions and methods for connecting to the Internet.
- 【Pocket-friendly】Lightweight design(145g) which designed for your next trip or adventure. Alongside its portable, compact design makes it easy to take with you on the go.
- 【Full Gigabit Ports】Gigabit Wireless Internet Router with 2 Gigabit LAN ports and 1 Gigabit WAN ports, ideal for lots of internet plan and allow you to connect your wired devices directly.
- 【Keep your Internet Safe】IPv6 supported. OpenVPN & WireGuard pre-installed, compatible with 30+ VPN service providers. Cloudflare encryption supported to protect the privacy.
[Interface]
Address = 10.66.66.1/24
ListenPort = 51820
PrivateKey = <contents of /etc/wireguard/server.key>
[Peer]
PublicKey = <contents of client1.pub>
AllowedIPs = 10.66.66.2/32The server’s AllowedIPs entry is the address that belongs to that peer. Give every additional client a different address, such as 10.66.66.3/32, and add another [Peer] block. Do not put the entire VPN subnet in every client peer entry on the server; overlapping peer routes make WireGuard unable to choose the intended recipient.
For a site-to-site peer, include the remote LAN prefixes in that peer’s server-side AllowedIPs, for example 10.20.0.0/16, only when that peer is responsible for reaching that network. Ensure no two peers claim the same prefix.
Enable forwarding, firewall access, and Internet NAT
Turn on IP forwarding
IPv4 forwarding is required when the VPS passes packets between wg0 and its public interface. Add a persistent setting:
sudo tee /etc/sysctl.d/99-wireguard-forward.conf > /dev/null <<'EOF'
net.ipv4.ip_forward=1
EOF
sudo sysctl --systemFor a dual-stack tunnel, add net.ipv6.conf.all.forwarding=1 to the same file and reload it. IPv6 forwarding alone does not provide an address or a working route; the provider must supply usable IPv6 connectivity and your firewall must allow it.
Open the provider and host firewalls
In the VPS provider’s security group or cloud firewall, allow inbound UDP on the WireGuard listen port, here 51820. Restrict the source range when every client has a known address; otherwise allow the port from the Internet and rely on WireGuard keys for peer authentication.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Rank #3
- New-Gen WiFi Standard – WiFi 6(802.11ax) standard supporting MU-MIMO and OFDMA technology for better efficiency and throughput.Antenna : External antenna x 4. Processor : Dual-core (4 VPE). Power Supply : AC Input : 110V~240V(50~60Hz), DC Output : 12 V with max. 1.5A current.
- Ultra-fast WiFi Speed – RT-AX1800S supports 1024-QAM for dramatically faster wireless connections
- Increase Capacity and Efficiency – Supporting not only MU-MIMO but also OFDMA technique to efficiently allocate channels, communicate with multiple devices simultaneously
- 5 Gigabit ports – One Gigabit WAN port and four Gigabit LAN ports, 10X faster than 100–Base T Ethernet.
- Commercial-grade Security Anywhere – Protect your home network with AiProtection Classic, powered by Trend Micro. And when away from home, ASUS Instant Guard gives you a one-click secure VPN.
If UFW is enabled, allow SSH first and then the WireGuard port:
sudo ufw allow OpenSSH
sudo ufw allow 51820/udpWhen using UFW as the forwarding firewall, add route rules from wg0 to the actual public interface and permit return traffic. For example, if the interface discovered earlier is ens3:
sudo ufw route allow in on wg0 out on ens3
sudo ufw route allow in on ens3 out on wg0Review UFW’s default forward policy and your existing rules before enabling it. A mistake can disconnect SSH even though WireGuard itself is configured correctly.
Masquerade a full-tunnel client
For clients whose Internet traffic should appear to come from the VPS, add source NAT from the VPN subnet to the public interface. Replace the interface name with the one shown by ip route show default:
sudo iptables -t nat -A POSTROUTING -s 10.66.66.0/24 -o <public-interface> -j MASQUERADE
sudo iptables -A FORWARD -i wg0 -o <public-interface> -j ACCEPT
sudo iptables -A FORWARD -i <public-interface> -o wg0 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPTPersist these rules using the firewall system you administer; rules entered interactively can disappear after a reboot. If you route IPv6 through the VPS and your design uses NAT66, apply equivalent, deliberately reviewed ip6tables rules. Many deployments instead route a provider-assigned IPv6 prefix directly and filter it without NAT.
Rank #4
- 【DUAL BAND WIFI 7 TRAVEL ROUTER】Products with US, UK, EU, AU Plug; Dual band network with wireless speed 688Mbps (2.4G)+2882Mbps (5G); Dual 2.5G Ethernet Ports (1x WAN and 1x LAN Port); USB 3.0 port.
- 【NETWORK CONTROL WITH TOUCHSCREEN SIMPLICITY】Slate 7’s touchscreen interface lets you scan QR codes for quick Wi-Fi, monitor speed in real time, toggle VPN on/off, and switch providers directly on the display. Color-coded indicators provide instant network status updates for Ethernet, Tethering, Repeater, and Cellular modes, offering a seamless, user-friendly experience.
- 【OpenWrt 23.05 FIRMWARE】The Slate 7 (GL-BE3600) is a high-performance Wi-Fi 7 travel router, built with OpenWrt 23.05 (Kernel 5.4.213) for maximum customization and advanced networking capabilities. With 512MB storage, total customization with open-source freedom and flexible installation of OpenWrt plugins.
- 【VPN CLIENT & SERVER】OpenVPN and WireGuard are pre-installed, compatible with 30+ VPN service providers (active subscription required). Simply log in to your existing VPN account with our portable wifi device, and Slate 7 automatically encrypts all network traffic within the connected network. Max. VPN speed of 100 Mbps (OpenVPN); 540 Mbps (WireGuard). *Speed tests are conducted on a local network. Real-world speeds may differ depending on your network configuration.*
- 【PERFECT PORTABLE WIFI ROUTER FOR TRAVEL】The Slate 7 is an ideal portable internet device perfect for international travel. With its mini size and travel-friendly features, the pocket Wi-Fi router is the perfect companion for travelers in need of a secure internet connectivity on the go in which includes hotels or cruise ships.
If the VPS is only a site-to-site router, omit masquerading. Add forwarding rules and routes for the remote LANs so each side sees the original private source address. Ubuntu’s site-to-site guidance specifically treats this as routed traffic rather than an Internet gateway.
Start the interface and make it persistent
Enable the systemd unit so the tunnel starts at boot, then bring it up now:
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →sudo systemctl enable --now wg-quick@wg0
sudo wg show
sudo systemctl status wg-quick@wg0wg show should display the interface, listen port, each peer public key, and eventually a latest-handshake timestamp. A configured peer with no handshake has not completed cryptographic negotiation; a recent handshake proves only that encrypted control traffic is reaching both ends, not that forwarding or DNS works.
Create the client configuration
On the first client, create a WireGuard profile containing its own address and private key:
[Interface]
Address = 10.66.66.2/24
PrivateKey = <contents of client1.key>
[Peer]
PublicKey = <contents of server.pub>
Endpoint = <VPS-public-address>:51820
AllowedIPs = 0.0.0.0/0, ::/0
PersistentKeepalive = 25The full-tunnel AllowedIPs value sends IPv4 and IPv6 traffic to the VPS. The keepalive value is useful for a client behind a NAT that otherwise drops idle UDP mappings; it is not a replacement for opening the server’s UDP port.
Best Value
- Next-Gen Gigabit Wi-Fi 6 Speeds: 2402 Mbps on 5 GHz and 574 Mbps on 2.4 GHz bands ensure smoother streaming and faster downloads; support VPN server and VPN client¹
- A More Responsive Experience: Enjoy smooth gaming, video streaming, and live feeds simultaneously. OFDMA makes your Wi-Fi stronger by allowing multiple clients to share one band at the same time, cutting latency and jitter.²
- Expanded Wi-Fi Coverage: 4 high-gain external antennas and Beamforming technology combine to extend strong, reliable, Wi-Fi throughout your home.
- Improved Battery Life: Target Wake Time helps your devices to communicate efficiently while consuming less power.
- Improved Cooling Design: No heat ups, no throttles. A larger heat sink and redefined case design cools the WiFi 6 system and enables your network to stay at top speeds in more versatile environments.
For split tunneling, replace the default routes with only the networks that belong across the VPN. A client that needs the VPS itself and one remote LAN might use:
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallAllowedIPs = 10.66.66.0/24, 10.20.0.0/16In a site-to-site design, put each remote LAN in the peer’s AllowedIPs and add matching routes on the gateway operating system. Ensure the two sites use different private ranges; if both sides use 192.168.1.0/24, routing cannot distinguish the destinations without redesign or translation.
Bring up the client and verify each layer
- Import the profile. Use the WireGuard client for your operating system, or save the profile as a root-readable file and run
sudo wg-quick up ./client1.confon Linux. Protect the file because it contains a private key. - Check the virtual address.
ip addr show ip routeConfirm the client has
10.66.66.2and that the expected private prefixes or default route point to the WireGuard interface. - Check the handshake on both ends.
sudo wg showRefresh after generating traffic. The latest-handshake time should update on the client and VPS.
- Test the VPN gateway.
ping -c 3 10.66.66.1Failure here points to keys, addresses, the peer’s
AllowedIPs, or a firewall rule before Internet routing is involved. - Test DNS separately. Query a known domain with the client’s resolver and inspect the result. A working ping to the gateway does not prove that DNS requests are permitted or that the chosen resolver is reachable through the tunnel.
- Check the observed public address. With a full tunnel, use an external IP-check service and confirm that it reports the VPS public address. In split mode, it should continue to report the client’s normal Internet address.
- Inspect logs if the interface will not start.
sudo journalctl -u wg-quick@wg0 --no-pagerSyntax errors, missing key files, duplicate addresses, and invalid firewall commands normally appear here.
Diagnose a handshake with no usable traffic
No latest handshake
- Verify the client’s
Endpointaddress and UDP port. If the VPS address changed, every client using the old endpoint must be updated, or the DNS name must be corrected. - Check that the provider security group and Ubuntu firewall both allow the same UDP listen port. Opening only one layer is insufficient.
- Compare the server and client public keys character for character. A peer must use its own private key with the matching public key configured at the other end.
- Confirm the VPS is listening with
sudo ss -lunp | grep 51820and inspectsudo wg show.
Handshake updates, but the VPN gateway cannot be pinged
- Check that the server interface address is
10.66.66.1/24and the client address is unique. - On the server, the client peer should claim the client’s single address, such as
10.66.66.2/32. On the client, the server peer should include the VPN subnet or the specific gateway address. - Look for host-firewall rules that allow UDP 51820 but block traffic arriving on
wg0.
Gateway works, but Internet traffic fails
- For full tunnel, confirm the client has
0.0.0.0/0and, if applicable,::/0in the server peer entry. - Confirm
net.ipv4.ip_forward=1is active and that forwarding rules allow traffic fromwg0to the public interface and established return traffic back. - Check the masquerade rule’s source subnet and interface. A rule attached to the wrong interface will never translate packets.
- Test DNS independently. An IP address test can work while name resolution fails because the client is using an unreachable resolver.
One private network works, another does not
- Inspect both route tables and every peer’s
AllowedIPs. The prefix must be present on the client, the VPS, and the site gateway that owns the destination. - Remove overlapping private ranges. Ubuntu’s site-to-site model requires non-overlapping networks and explicit routes; it does not automatically NAT one site into the other.
- Check return routes. The destination host or its router must know how to send replies back to the client VPN subnet, unless you intentionally use NAT.
Static-address operations and ongoing security
When an address changes
A provider-assigned public address can change after deletion, recreation, migration, or a lifecycle event defined by that provider. A client still pointing at the old Endpoint will not connect. Update the endpoint on every client or use a DNS name whose record you control. A reserved address reduces this risk, but it does not remove the need to verify attachment after rebuilding the VPS.
Limit exposure
- Expose only the WireGuard UDP port and the administration services you need.
- Use separate key pairs and VPN addresses for separate people or devices so one compromised key can be revoked without replacing every peer.
- Keep private keys readable only by their owner or by root, and rotate a peer’s key when the device is lost or access should end.
- Apply Ubuntu security updates and review
journalctl,wg show, and firewall logs for unexpected activity.
Plan for IPv6 deliberately
Putting ::/0 in a client profile without providing IPv6 forwarding, routes, and firewall rules can create partial connectivity: IPv4 works while IPv6 leaks over the local connection or fails entirely. Decide whether IPv6 should be tunneled, blocked on the client during the VPN session, or left outside the tunnel in a documented split-tunnel design.
What success looks like
A correctly configured full tunnel has a recent handshake, a unique VPN address on every peer, a client route for the default prefixes, enabled forwarding on the VPS, permitted traffic in both firewall layers, and source NAT or an equivalent routed public address. The client can reach 10.66.66.1, resolve DNS, and an external address check reports the VPS’s public address. A split tunnel intentionally differs: only listed private prefixes use WireGuard, while ordinary Internet traffic keeps its local exit.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
