Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers VPS plans with one-click OpenVPN, NVMe storage and a 14-day free trial.
The secure pattern is simple: expose one UDP port for WireGuard, then allow SSH, databases, dashboards and every other private service only on the WireGuard interface or tunnel subnet. Enforce that policy twice—first in your VPS provider’s cloud firewall, then in the VPS host firewall. Keep a working console or tightly restricted emergency SSH session until you have tested both VPN access and public-port denial.
What “VPN-only VPS access” actually means
A VPS still needs a public IP so WireGuard peers can find it. “Only accessible through a VPN” therefore does not mean the server has no public address. It means the public address answers only on the WireGuard UDP listen port; administrative and application services accept traffic solely from the encrypted tunnel.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Use a dedicated tunnel range, such as 10.80.0.0/24, that does not overlap the home, office or mobile networks from which you will connect. Give the VPS one tunnel address (for example, 10.80.0.1) and every peer a unique host address (for example, 10.80.0.2).
- Public plane: the provider firewall and host firewall allow WireGuard’s UDP port, commonly
51820/udp. No TCP service is exposed for WireGuard. - Private plane: SSH, web administration, databases, metrics and internal APIs are reachable through
wg0or from the VPN subnet only. - Two enforcement layers: the cloud firewall filters packets before they reach the VM; the host firewall filters them on the VM. Configure both with the same minimum-exposure policy.
WireGuard uses a private/public key pair for each peer. Its AllowedIPs field is both a routing selector for outgoing traffic and an access-control list for source addresses a peer is permitted to present. A broad value can therefore route—and authorize—more traffic than intended.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application:Upgraded attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Warranty & Support: Our Electric air duster comes with 5 years warranty and 24/7 customer service. During this period, if you have any questions,pls kindly feel free to contact us.
Canonical’s Ubuntu Server documentation describes WireGuard as “a simple, fast and modern VPN implementation.”
Plan the design before changing a firewall
Decide whether this is private-service access or a full-tunnel gateway
For a private-service endpoint, route only the VPS tunnel address and any explicitly private networks. Do not enable IP forwarding, masquerading or Internet egress unless the VPS is deliberately intended to be a gateway for clients.
A full-tunnel design sends a client’s Internet traffic through the VPS. It requires kernel forwarding, forwarding firewall rules, NAT and a decision about DNS leakage. It also increases the blast radius of a compromised peer, so it should not be enabled merely because WireGuard is installed.
Choose the peer model
| Component | Example | Purpose |
|---|---|---|
| VPS public address | 203.0.113.10 |
WireGuard endpoint reachable from the Internet |
| WireGuard interface | wg0 |
Encrypted interface on the VPS |
| Tunnel subnet | 10.80.0.0/24 |
Private address space for the VPN |
| VPS tunnel address | 10.80.0.1/24 |
Address used for SSH and private services |
| Peer 1 | 10.80.0.2/32 |
One laptop, workstation or phone |
| Peer 2 | 10.80.0.3/32 |
Another device with its own key pair |
Do not reuse a tunnel address or a private key. If a device is lost, remove its peer entry and reload the interface; no other peer needs to be reconfigured.
Prepare recovery access
- Open the provider’s out-of-band console or serial/maintenance session.
- Confirm that you can log in through it before touching firewall rules.
- Keep that session open while applying the first policy.
- If you need temporary SSH over the public interface, restrict TCP 22 to one fixed administration IP and set a removal time for that rule.
Never close your only recovery path immediately after enabling a default-deny firewall. Verify a VPN login first, then remove the temporary exception.
Install WireGuard on the VPS
The commands below apply to a current Ubuntu or Debian server using the distribution packages. Run them from the recovery session or your existing administrative login.
Free tools Windows power users keep installed
One-click scans. No signup required.
- Update package metadata and install the tools:
sudo apt update
sudo apt install wireguard - Protect the directory that will hold private material:
sudo install -d -m 700 /etc/wireguard - Do not paste private keys into shell history, chat, tickets or public issue trackers. Generate them in a protected shell and write them directly to files.
WireGuard itself does not provide a user database or password reset. The private key is the peer’s identity, so treat it like an administrator credential.
Generate a key pair for the VPS and every client
Run this flow once for the server and once on each client device (or in a protected workstation directory for a client configuration):
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
umask 077
wg genkey | tee privatekey | wg pubkey > publickeyThe resulting privatekey must remain secret. The matching publickey is safe to place in the other side’s configuration. A practical server-side example is:
sudo sh -c 'umask 077; wg genkey > /etc/wireguard/server.key'
sudo sh -c 'wg pubkey < /etc/wireguard/server.key > /etc/wireguard/server.pub'
sudo chmod 600 /etc/wireguard/server.keyGenerate a separate pair for every peer. Do not copy the server’s private key to a laptop, and do not use one shared key for a group of devices.
Create the VPS WireGuard configuration
Create /etc/wireguard/wg0.conf with mode 600:
sudo install -m 600 /dev/null /etc/wireguard/wg0.conf
sudoedit /etc/wireguard/wg0.confUse this structure, replacing the key values with your own:
[Interface]
Address = 10.80.0.1/24
ListenPort = 51820
PrivateKey = <VPS_PRIVATE_KEY>
[Peer]
# Laptop
PublicKey = <LAPTOP_PUBLIC_KEY>
AllowedIPs = 10.80.0.2/32
[Peer]
# Second device
PublicKey = <SECOND_DEVICE_PUBLIC_KEY>
AllowedIPs = 10.80.0.3/32Each peer’s AllowedIPs is a unique host route on the server. Do not put 0.0.0.0/0 there unless this peer is intentionally being used as a gateway. A duplicate or overlapping value can send traffic to the wrong peer and weaken source-address restrictions.
This private-service design needs no PostUp NAT rule. Omitting forwarding and masquerading keeps the VPS from becoming an accidental Internet router.
Configure each client peer
Install a WireGuard client on the laptop, workstation or phone, then import a configuration equivalent to:
[Interface]
PrivateKey = <LAPTOP_PRIVATE_KEY>
Address = 10.80.0.2/32
[Peer]
PublicKey = <VPS_PUBLIC_KEY>
Endpoint = 203.0.113.10:51820
AllowedIPs = 10.80.0.1/32
PersistentKeepalive = 25Replace the endpoint with the VPS public IP or a DNS name that resolves to it. Add other private networks to AllowedIPs only when the VPS is routing those networks. For example, a site-to-site design might include 10.90.0.0/16; do not add arbitrary public ranges.
PersistentKeepalive is off by default. Set it to 25 seconds on a client behind a NAT or restrictive firewall when that client must receive packets after an idle period. WireGuard is UDP and does not maintain a traditional persistent connection; the 25-second interval is a commonly sensible value across varied firewalls. A directly reachable server usually does not need keepalives.
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
If you need DNS over the tunnel, configure it deliberately in the client application or operating system. Resolver integration differs by platform, and wg-quick DNS behavior depends on the resolver tooling installed on the system. Test name resolution separately from tunnel reachability.
Lock down the provider’s cloud firewall first
In the provider control panel, security group or cloud firewall, create a default-deny inbound policy. The exact labels vary, but the effective rules should be:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
| Direction | Protocol and port | Source | When |
|---|---|---|---|
| Inbound | UDP 51820 | Any, or your chosen restricted ranges | Required for WireGuard handshakes |
| Inbound | TCP 22 | One fixed administration IP | Temporary rollout or emergency access only |
| Inbound | All other ports | Any | Deny |
| Outbound | Return and required egress | As needed by your policy | Do not accidentally block package updates or VPN replies |
WireGuard uses UDP, not TCP. Opening TCP 51820 does nothing for a normal WireGuard listener. If you choose a different UDP port, use that same port in the provider rule, the server’s ListenPort, and every client’s Endpoint.
Apply the provider rule before the host rule so unsolicited traffic is dropped at the outer layer. During rollout, leave the narrowly scoped TCP 22 exception in place until a VPN SSH test succeeds. Remove it afterward; a forgotten temporary rule is a common way to leave SSH publicly exposed.
Apply the VPS host firewall
The host firewall must enforce interface and source restrictions even if a cloud-firewall rule is later changed. The following UFW example is suitable for a private-service endpoint. Adapt the application ports to your server.
- Set conservative defaults:
sudo ufw default deny incoming
sudo ufw default allow outgoing - Allow only the WireGuard handshake on the public interface:
sudo ufw allow 51820/udp - Allow SSH only through the tunnel interface:
sudo ufw allow in on wg0 to any port 22 proto tcp - Allow each private application only through
wg0. For example:sudo ufw allow in on wg0 to any port 443 proto tcp
sudo ufw allow in on wg0 to any port 5432 proto tcp - Enable the firewall only while your console or temporary restricted SSH session remains available:
sudo ufw enable
sudo ufw status verbose
If you prefer source-based rules, restrict them to the tunnel range, for example sudo ufw allow from 10.80.0.0/24 to any port 22 proto tcp. Interface-based rules are often clearer for this design because they cannot be satisfied by a packet arriving on the public NIC.
Do not add an Internet-facing allow rule for a database, dashboard or SSH merely because the service is also listening on 0.0.0.0. The firewall is the enforcement point. For defense in depth, bind applications to 10.80.0.1 where their software supports it, but keep the firewall restriction even when you bind addresses.
Applications packaged with containers can publish ports directly on the host and bypass an expected UFW path depending on the container runtime’s rule handling. Check the runtime’s published-port rules and ensure that only the WireGuard address or tunnel subnet is accepted.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
Bring up the interface and make it persistent
- Start the interface immediately:
sudo wg-quick up wg0 - Inspect the effective configuration and handshake state:
sudo wg show - Enable automatic startup after reboot:
sudo systemctl enable wg-quick@wg0 - When diagnosing startup failures, inspect service state and logs:
sudo systemctl status wg-quick@wg0
sudo journalctl -u wg-quick@wg0
Ubuntu documents the systemctl actions status, start, stop, reload and restart for the WireGuard unit. A peer-only edit can generally use:
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorssudo systemctl reload wg-quick@wg0Changes to addresses, routes, firewall hooks or PostUp/PostDown commands require a controlled restart:
sudo systemctl restart wg-quick@wg0Keep a console session open for a restart that changes routing or firewall behavior.
Verify the tunnel and prove public denial
Do not consider the setup complete after seeing a configuration file. Test from two genuinely different network positions.
From a connected VPN peer
- Activate the client tunnel.
- Ping the VPS tunnel address, if ICMP is permitted:
ping 10.80.0.1. - Connect to SSH using the tunnel address, not the public address:
ssh user@10.80.0.1. - Open each intended private service at its tunnel address or private DNS name.
- Check
sudo wg showon the VPS for a recent handshake and increasing transfer counters.
From an unrelated Internet connection
Use a mobile hotspot or another network that is not one of the VPN peers. Confirm that:
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →- The VPS public IP does not accept SSH on TCP 22.
- Databases, dashboards and application ports do not answer publicly.
- The WireGuard UDP port is the only intentionally reachable service port.
- Provider-firewall and host-firewall counters show the expected drops and allows.
A UDP port scanner may report an ambiguous state because WireGuard does not respond like a TCP service. The meaningful test is whether a legitimate peer completes a handshake and whether no unauthenticated path reaches private services.
Record a rollback point
Save a known-good copy of /etc/wireguard/wg0.conf, the provider firewall rule set and the host-firewall status in a protected location. Do not include private keys in an unencrypted ticket or shared repository. Document the console URL and the exact command that disables the host firewall in case a future change locks you out.
How routing, NAT and forwarding change the design
Private-service endpoint (recommended default)
- Client
AllowedIPs: the VPS tunnel address and explicitly private networks only. - Server peer
AllowedIPs: one unique/32per peer. - No IP forwarding requirement for traffic terminating on the VPS.
- No masquerading or Internet gateway rules.
This arrangement lets an administrator reach SSH and private applications while ordinary web browsing continues through the client’s normal connection.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
Full-tunnel Internet gateway
If the client configuration uses AllowedIPs = 0.0.0.0/0 (and, on IPv6-capable designs, the corresponding IPv6 default route), the VPS must forward packets and perform NAT or route a public address for the client. You must also decide how DNS requests travel, prevent forwarding from untrusted peers, and account for the VPS bandwidth and egress cost. A minimal forwarding design typically includes:
Recommended Free Tools
- Enabling IPv4 forwarding in the kernel and loading the setting at boot.
- Allowing forwarding from
wg0to the intended external interface and established return traffic. - Masquerading the tunnel subnet on that external interface, unless routed public addresses are used.
- Restricting which peers may use gateway capability.
Do not add these rules to a private-only server. Forwarding broadens the consequences of a stolen peer key and can expose the VPS as an unintended open gateway.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Restrict services beyond the firewall
Firewall rules are mandatory, but service-level restrictions provide useful defense in depth.
- SSH: disable password authentication where practical, use individual keys, and keep the daemon’s listen and firewall policy consistent. Test a second VPN session before ending the first.
- Databases: bind to
10.80.0.1or localhost plus a controlled tunnel proxy when supported; require database authentication and encryption appropriate to the engine. - Web dashboards: bind to the tunnel address or place them behind an internal reverse proxy. Do not assume an obscure URL is access control.
- Monitoring: collect host-firewall logs and alert on unexpected public-interface drops or repeated WireGuard handshake failures.
- Containers: review published ports after every deployment. A newly published port can create a public listener even when the base image was private.
Common failure modes and fixes
| Symptom | Likely cause | What to check |
|---|---|---|
| No latest handshake | Wrong endpoint, blocked UDP, key mismatch or inactive client | Confirm the public IP and UDP port in both firewalls, compare public keys, and inspect wg show |
| Handshake exists but ping fails | Wrong tunnel address, overlapping subnet or host-firewall rule | Check each peer’s unique /32, ip addr show wg0, routes and UFW counters |
| SSH works publicly | Temporary provider or host exception remains | List cloud rules and sudo ufw status numbered; remove the public TCP 22 rule |
| SSH works over VPN, application does not | Service bound only to localhost, wrong port or application ACL | Inspect the listening address with ss -lntup and the application’s allow-list |
| Client loses access after idle time | NAT mapping expired | Set PersistentKeepalive = 25 on the NATed client and test again |
| Only some private networks work | Incomplete AllowedIPs or missing route |
Inspect ip route on both ends and add only the required private prefixes |
| DNS fails while IP access works | Resolver not reachable through the tunnel or client DNS integration mismatch | Test the resolver address, inspect client DNS settings and verify split-DNS intent |
| Firewall change locks out administrators | Policy applied before VPN verification | Use the provider console, restore the last known-good rule, then repeat with a second session open |
Remove a peer, rotate keys and recover safely
Revoke a lost device
Delete that peer’s [Peer] block from the VPS configuration, then reload:
sudo systemctl reload wg-quick@wg0Also delete the old client configuration and generate a new key pair for a replacement device. There is no central revocation list; removing the public key from the server is the revocation action.
Rotate the VPS key
Generate a new server key, update the server’s PrivateKey, copy the new public key into every client’s peer section, and restart the interface during a maintenance window. Keep the old configuration securely archived only if your change-control policy requires it; never leave both identities active accidentally.
Emergency recovery
If a firewall edit blocks VPN traffic, use the provider console to restore UDP 51820 and the required tunnel rules, or temporarily disable the host firewall from the console. Once access returns, inspect the exact rule ordering and retest from both networks. Do not solve a lockout by opening every port indefinitely.
WireGuard compared with another VPN implementation
WireGuard is a strong fit when the goal is a small, auditable private-access overlay. Other VPN implementations can be appropriate when an organization already depends on certificate authorities, legacy clients or centralized identity integration. Compare the operational properties before choosing:
| Decision axis | WireGuard | Certificate- or TLS-based VPN implementation |
|---|---|---|
| Client platforms | Native or third-party clients are available on major desktop, mobile and server operating systems; verify support for your exact edition | Often broad platform support, with more variation between client packages |
| Identity management | One key pair per peer; revocation means removing or replacing a peer key | May integrate with certificates, directories, MFA and centralized policy, at the cost of more components |
| Narrow routing | AllowedIPs makes per-peer routes and source restrictions explicit |
Usually supported, but policy syntax and enforcement differ by implementation |
| Firewall integration | One UDP listener plus interface/source rules is straightforward | May use TCP or UDP listeners and additional service processes |
| Recovery | Provider console plus a small text configuration is usually sufficient | Recovery can also involve certificate stores, servers and identity back ends |
| Best fit here | Private services on one VPS or a small set of peers | Existing enterprise identity, legacy clients or requirements outside a simple key-based overlay |
Operational checklist
- Use a non-overlapping tunnel subnet and unique peer addresses.
- Protect every private key with restrictive file permissions and secure backups.
- Allow only the WireGuard UDP port publicly; never expose TCP 51820 as a substitute.
- Mirror the minimum-exposure policy in the provider firewall and host firewall.
- Permit SSH and private services only on
wg0or from the VPN subnet. - Keep console access or a narrowly scoped temporary administration rule during rollout.
- Use narrow
AllowedIPs; reserve default routes and NAT for an intentional gateway design. - Set
PersistentKeepalive = 25only where NAT or a restrictive firewall requires it. - Verify a recent handshake, tunnel-address SSH and every private service from a peer.
- From an unrelated network, verify that public SSH and application ports are denied.
- Review container-published ports, firewall changes and peer membership after deployments.
Final configuration test
The setup is complete when a legitimate peer can reach the VPS at 10.80.0.1, SSH and intended applications work through wg0, and an unrelated Internet connection cannot reach those same services through the public IP. At that point remove the temporary public SSH rule, retain the provider console as a break-glass path, and treat every new peer or service as a deliberate firewall change.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
