Security

Host WireGuard VPN on VeloxaHost

WireGuard is a VPN protocol built into the Linux kernel, configured with short text files and public/private key pairs. People run their own WireGuard server to reach private networks remotely, to route traffic through an address they control, or to link servers together.

The one-click install sets up the wireguard and qrencode packages on Ubuntu 24.04, generates the server's key pair in /etc/wireguard, and starts wg0 on 10.0.0.1/24, listening on UDP port 51820 with IP forwarding and NAT enabled. You add the clients.

Install it yourself

  1. Install WireGuard and, for phone setup by QR code, qrencode.
    apt install -y wireguard qrencode
  2. Generate the server's key pair.
    cd /etc/wireguard && umask 077
wg genkey | tee server_private.key | wg pubkey > server_public.key
  3. Create /etc/wireguard/wg0.conf. Replace eth0 with the interface shown by ip route show default.
    [Interface]
PrivateKey = <contents of server_private.key>
Address = 10.0.0.1/24
ListenPort = 51820
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
  4. Turn on IP forwarding permanently.
    echo 'net.ipv4.ip_forward=1' > /etc/sysctl.d/99-wireguard.conf && sysctl --system
  5. Start the tunnel and enable it at boot.
    systemctl enable --now wg-quick@wg0
  6. For each client, generate a key pair, add a [Peer] block with its public key and AllowedIPs = 10.0.0.2/32 to wg0.conf, and reload without dropping connections.
    wg syncconf wg0 <(wg-quick strip wg0)
  7. Write the client's config (its private key, Address = 10.0.0.2/24, and a [Peer] with the server's public key and Endpoint), then show it as a QR code for the mobile app.
    qrencode -t ansiutf8 < client.conf

FAQ

What license is WireGuard under?

The WireGuard kernel module is part of the mainline Linux kernel and, like the kernel, is licensed under the GPLv2. The wg and wg-quick tools in wireguard-tools are also GPLv2. "WireGuard" is a registered trademark of Jason A. Donenfeld.

How do clients reach the server on VeloxaHost?

Every server gets a block of ports on a shared public IPv4 address; IPv6 is not available in US East yet. From the server's page in the console, forward a UDP port in that block to port 51820, and use the shared address and that public port as the client's Endpoint. A dedicated IPv4 address is a paid option, with limited availability, if you want port 51820 itself.

What does the one-click install leave for me to do?

It configures the server side only: keys, the wg0 interface on 10.0.0.1/24, port 51820 and NAT. There are no peers yet, so add a [Peer] for each device as in steps 6 and 7 above. The server's public key is in /etc/wireguard/server_public.key.

Container or virtual machine?

A container shares the host's kernel, so WireGuard runs in the host kernel's WireGuard module, which is how the one-click app runs. Virtual machines, with a kernel of your own, are not available in US East yet.

How much server does a WireGuard VPN need?

Very little: the app's minimum is 1 vCPU, 256 MB of RAM and 5 GB of disk. Throughput depends mostly on CPU, and on a container you can raise CPU from the console while the tunnel stays up.

Which VeloxaHost size fits WireGuard?

A Veloxa Nano covers the recommended size: 1 vCPU, 1 GB RAM and 25 GB of disk for $5 a month, billed at $0.01 an hour and capped at the monthly price.