Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers VPS plans with one-click OpenVPN, NVMe storage and a 14-day free trial.
To use a VPS as a fixed public VPN gateway, assign it a stable public IPv4 address, install WireGuard, give the tunnel its own private subnet, enable IP forwarding, and add firewall and source-NAT rules when Internet traffic should exit through the VPS. Configure each client with the VPS address as its endpoint and choose either split tunneling or a full tunnel. A successful handshake alone is not enough: routes, forwarding, NAT, DNS, and both cloud and host firewalls must also be correct.
What this setup does
A virtual private server (VPS) is an always-on Linux host in a provider’s network. Its public IPv4 address becomes the stable Internet endpoint that WireGuard clients contact. When the provider offers a reserved or floating address separately from the virtual machine, reserve that address and attach it to the VPS so replacing or rebuilding the VM does not change the endpoint. If the address is tied to the VM, record the provider-assigned address and understand that a replacement may require client configuration changes.
Free tools Windows power users keep installed
One-click scans. No signup required.
WireGuard creates an encrypted network interface, commonly named wg0. Every peer has its own private key and public key. Private keys stay on the device that owns them; only public keys are exchanged. The tunnel uses ordinary Linux addresses and routes, while WireGuard’s AllowedIPs field determines which destinations are sent to a peer and which source addresses that peer is permitted to use. Canonical describes WireGuard as “a simple, fast and modern VPN implementation” and notes that AllowedIPs acts both as a routing key when sending and an access-control list when receiving.
In a full-tunnel design, client default traffic travels through the encrypted interface and is source-NATed to the VPS public address. Websites and other Internet services then see the VPS address. In a split tunnel, only selected private networks use WireGuard; ordinary Internet traffic keeps using the client’s local connection.
#1 Best Overall
- 【Five Gigabit Ports】1 Gigabit WAN Port plus 2 Gigabit WAN/LAN Ports plus 2 Gigabit LAN Port. Up to 3 WAN ports optimize bandwidth usage through one device.
- 【One USB WAN Port】Mobile broadband via 4G/3G modem is supported for WAN backup by connecting to the USB port. For complete list of compatible 4G/3G modems, please visit TP-Link website.
- 【Abundant Security Features】Advanced firewall policies, DoS defense, IP/MAC/URL filtering, speed test and more security functions protect your network and data.
- 【Highly Secure VPN】Supports up to 20× LAN-to-LAN IPsec, 16× OpenVPN, 16× L2TP, and 16× PPTP VPN connections.
- Security - SPI Firewall, VPN Pass through, FTP/H.323/PPTP/SIP/IPsec ALG, DoS Defence, Ping of Death and Local Management. Standards and Protocols IEEE 802.3, 802.3u, 802.3ab, IEEE 802.3x, IEEE 802.1q
Choose the architecture before installing anything
| Decision | Use this when | What changes in configuration |
|---|---|---|
| Full tunnel | You want all client IPv4 traffic, and optionally IPv6 traffic, to leave through the VPS. | The client uses AllowedIPs = 0.0.0.0/0 and, for IPv6, ::/0. The VPS forwards packets and normally masquerades them on its public interface. |
| Split tunnel | You need access to a private network, administration subnet, or service without changing the client’s normal Internet route. | Each peer lists only the required private prefixes in AllowedIPs. NAT is usually unnecessary when the private networks have return routes. |
| One client | A laptop, phone, or single workstation needs the fixed egress address. | Create one client key pair and one unique tunnel address, such as 10.66.0.2/32. |
| Site-to-site | Two offices, homes, or cloud networks must reach one another continuously. | Use non-overlapping LAN ranges, explicit routes, and a peer definition at each gateway. Ubuntu’s site-to-site guidance says always-on peers should have a static endpoint, such as a fixed IP address or valid domain name. No NAT is applied between the site gateways in that model. |
| IPv4 only | Your applications and provider connectivity do not require IPv6. | Forward and firewall IPv4 only; use 0.0.0.0/0 for a full tunnel. |
| Dual stack | You want IPv6 traffic protected as well as IPv4 traffic. | Give the tunnel IPv6 addresses, enable IPv6 forwarding, permit IPv6 in the firewall, and route ::/0. If IPv6 is omitted, IPv6-capable clients may bypass the VPN. |
| Provider-assigned address | You accept that rebuilding or detaching the VM may change the public address. | Update every client’s Endpoint after an address change, or point clients at a DNS name that you can update. |
| Reserved address | You need the endpoint to survive VM replacement or want a long-lived service address. | Attach the reserved address to the VPS and keep it documented as the WireGuard endpoint. |
| NAT gateway | Clients need Internet access through the VPS and their private tunnel addresses are not routable on the provider network. | Enable forwarding and masquerade traffic from wg0 to the public interface. |
| Router only | Both private networks know routes back to the WireGuard subnets. | Enable forwarding and firewall rules, but do not add masquerading; preserve the original private source addresses. |
Prerequisites and address planning
- An Ubuntu VPS with administrative access, a stable public IPv4 address, and enough network access for a UDP WireGuard listener.
- The VPS public interface name and default gateway. Determine them with
ip addrandip route; interface names are not alwayseth0. - A private VPN range that does not overlap with the client’s local LANs or site-to-site networks. The example below uses
10.66.0.0/24. - One unique tunnel address per peer. The server uses
10.66.0.1, the first client uses10.66.0.2, and additional peers receive different addresses. - A UDP listen port, such as
51820, allowed in both the provider’s cloud firewall or security group and Ubuntu’s host firewall. - A key pair for the server and a separate key pair for every client. Generate keys on the device that will use the private key whenever practical.
Do not reuse a private VPN range that already exists behind a client. Overlapping ranges make route selection ambiguous and are a common reason site-to-site tunnels appear connected but cannot reach hosts.
Build the WireGuard server on the VPS
1. Install the package and create server keys
Log in over SSH, update package metadata, and install WireGuard from Ubuntu’s supported repositories.
Recommended Free Tools
sudo apt update
sudo apt install wireguard
sudo umask 077
wg genkey | sudo tee /etc/wireguard/server.key | wg pubkey | sudo tee /etc/wireguard/server.pubRead the public key when you need to add the server to a client. Never publish or paste the contents of /etc/wireguard/server.key into a ticket, chat, or configuration shared with another peer.
2. Generate a key pair for each client
On a Linux client, install WireGuard and run:
umask 077
wg genkey | tee client.key | wg pubkey > client.pubOn other operating systems, use the official WireGuard application’s key-generation control. Transfer only the client public key to the VPS. Each additional phone, laptop, or gateway needs its own key pair and tunnel address; do not copy one client configuration to multiple devices.
3. Create the server interface
Create /etc/wireguard/wg0.conf with the server’s private key, tunnel address, and listener port. Replace the value shown as SERVER_PRIVATE_KEY with the file’s actual contents and replace CLIENT_PUBLIC_KEY with the client’s public key.
Rank #2
- 【AC1200 Dual-band Wireless Router】Simultaneous dual-band with wireless speed up to 300 Mbps (2.4GHz) + 867 Mbps (5GHz). 2.4GHz band can handles some simple tasks like emails or web browsing while bandwidth intensive tasks such as gaming or 4K video streaming can be handled by the 5GHz band.*Speed tests are conducted on a local network. Real-world speeds may differ depending on your network configuration.*
- 【Easy Setup】Please refer to the User Manual and the Unboxing & Setup video guide on Amazon for detailed setup instructions and methods for connecting to the Internet.
- 【Pocket-friendly】Lightweight design(145g) which designed for your next trip or adventure. Alongside its portable, compact design makes it easy to take with you on the go.
- 【Full Gigabit Ports】Gigabit Wireless Internet Router with 2 Gigabit LAN ports and 1 Gigabit WAN ports, ideal for lots of internet plan and allow you to connect your wired devices directly.
- 【Keep your Internet Safe】IPv6 supported. OpenVPN & WireGuard pre-installed, compatible with 30+ VPN service providers. Cloudflare encryption supported to protect the privacy.
[Interface]
Address = 10.66.0.1/24
ListenPort = 51820
PrivateKey = SERVER_PRIVATE_KEY
[Peer]
PublicKey = CLIENT_PUBLIC_KEY
AllowedIPs = 10.66.0.2/32The server-side AllowedIPs entry identifies the address that belongs to that peer. Use a single host route such as 10.66.0.2/32 for an individual client. For a site gateway, list the remote LAN prefixes that gateway is allowed to originate, provided they do not overlap with another peer.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware match4. Enable forwarding
For an IPv4 full tunnel or routed site-to-site design, enable IPv4 forwarding persistently:
echo 'net.ipv4.ip_forward=1' | sudo tee /etc/sysctl.d/99-wireguard-forwarding.conf
sudo sysctl --systemIf the tunnel carries IPv6, also enable IPv6 forwarding:
echo 'net.ipv6.conf.all.forwarding=1' | sudo tee -a /etc/sysctl.d/99-wireguard-forwarding.conf
sudo sysctl --systemForwarding only permits the kernel to move packets between interfaces; it does not itself create routes, permit them through a firewall, or provide Internet source NAT.
5. Allow the WireGuard port at both firewall layers
Open UDP port 51820 in the VPS provider’s cloud firewall or security group, restricted to expected source addresses when your use case permits. Then allow the same port in Ubuntu’s host firewall. These controls are independent: opening one does not open the other.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #3
- New-Gen WiFi Standard – WiFi 6(802.11ax) standard supporting MU-MIMO and OFDMA technology for better efficiency and throughput.Antenna : External antenna x 4. Processor : Dual-core (4 VPE). Power Supply : AC Input : 110V~240V(50~60Hz), DC Output : 12 V with max. 1.5A current.
- Ultra-fast WiFi Speed – RT-AX1800S supports 1024-QAM for dramatically faster wireless connections
- Increase Capacity and Efficiency – Supporting not only MU-MIMO but also OFDMA technique to efficiently allocate channels, communicate with multiple devices simultaneously
- 5 Gigabit ports – One Gigabit WAN port and four Gigabit LAN ports, 10X faster than 100–Base T Ethernet.
- Commercial-grade Security Anywhere – Protect your home network with AiProtection Classic, powered by Trend Micro. And when away from home, ASUS Instant Guard gives you a one-click secure VPN.
sudo ufw allow 51820/udpIf UFW is not being used, create equivalent rules in the host firewall you administer. Keep the SSH management port available before enabling or tightening firewall policy, or you may lock yourself out.
6. Add forwarding and NAT for a full-tunnel gateway
Find the interface that owns the VPS default route:
ip route show defaultThe output identifies the public interface, for example ens3. Substitute that actual name for PUBLIC_IFACE in the rules below. The first two rules permit forwarding between the VPN and public interface; the masquerade rule changes Internet-bound packets from the private tunnel range to the VPS public address.
sudo iptables -A FORWARD -i wg0 -o PUBLIC_IFACE -j ACCEPT
sudo iptables -A FORWARD -i PUBLIC_IFACE -o wg0 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
sudo iptables -t nat -A POSTROUTING -s 10.66.0.0/24 -o PUBLIC_IFACE -j MASQUERADEMake equivalent rules persistent with the firewall system you selected; rules entered interactively can disappear on reboot. DigitalOcean’s WireGuard gateway guidance demonstrates this forwarding and masquerading pattern, including UFW route rules. If you use UFW, permit routed traffic between wg0 and the public interface and set its forwarding policy appropriately rather than relying on an iptables rule that UFW later overrides.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →For IPv6 full tunneling, add IPv6 forwarding and IPv6 firewall policy. Do not assume IPv4 masquerading will handle IPv6; use a provider-routed IPv6 prefix and appropriate routing, or deliberately keep IPv6 outside the tunnel.
Rank #4
- 【DUAL BAND WIFI 7 TRAVEL ROUTER】Products with US, UK, EU, AU Plug; Dual band network with wireless speed 688Mbps (2.4G)+2882Mbps (5G); Dual 2.5G Ethernet Ports (1x WAN and 1x LAN Port); USB 3.0 port.
- 【NETWORK CONTROL WITH TOUCHSCREEN SIMPLICITY】Slate 7’s touchscreen interface lets you scan QR codes for quick Wi-Fi, monitor speed in real time, toggle VPN on/off, and switch providers directly on the display. Color-coded indicators provide instant network status updates for Ethernet, Tethering, Repeater, and Cellular modes, offering a seamless, user-friendly experience.
- 【OpenWrt 23.05 FIRMWARE】The Slate 7 (GL-BE3600) is a high-performance Wi-Fi 7 travel router, built with OpenWrt 23.05 (Kernel 5.4.213) for maximum customization and advanced networking capabilities. With 512MB storage, total customization with open-source freedom and flexible installation of OpenWrt plugins.
- 【VPN CLIENT & SERVER】OpenVPN and WireGuard are pre-installed, compatible with 30+ VPN service providers (active subscription required). Simply log in to your existing VPN account with our portable wifi device, and Slate 7 automatically encrypts all network traffic within the connected network. Max. VPN speed of 100 Mbps (OpenVPN); 540 Mbps (WireGuard). *Speed tests are conducted on a local network. Real-world speeds may differ depending on your network configuration.*
- 【PERFECT PORTABLE WIFI ROUTER FOR TRAVEL】The Slate 7 is an ideal portable internet device perfect for international travel. With its mini size and travel-friendly features, the pocket Wi-Fi router is the perfect companion for travelers in need of a secure internet connectivity on the go in which includes hotels or cruise ships.
7. Start WireGuard and enable it at boot
sudo systemctl enable --now wg-quick@wg0
sudo wg show
ip addr show wg0wg show displays the interface, peer public keys, latest handshake, and transfer counters. The service should start automatically after a reboot. If the interface fails to start, inspect the service log with sudo journalctl -u wg-quick@wg0 --no-pager and correct syntax, key, or interface-name errors before testing a client.
Configure a client
Split-tunnel client
Use a client configuration like this when only the VPN subnet or a remote private network should use WireGuard:
[Interface]
Address = 10.66.0.2/32
PrivateKey = CLIENT_PRIVATE_KEY
[Peer]
PublicKey = SERVER_PUBLIC_KEY
Endpoint = VPS_PUBLIC_ADDRESS:51820
AllowedIPs = 10.66.0.0/24
PersistentKeepalive = 25Add the remote LAN prefix instead of, or in addition to, 10.66.0.0/24 when the VPS routes a site network. PersistentKeepalive = 25 is useful for a peer behind a stateful NAT because it periodically keeps the mapping open; it is not a substitute for correct firewall and route rules.
Full-tunnel client
For all IPv4 traffic to exit at the VPS, change the client’s routes:
[Interface]
Address = 10.66.0.2/32
PrivateKey = CLIENT_PRIVATE_KEY
DNS = YOUR_TRUSTED_DNS_RESOLVER
[Peer]
PublicKey = SERVER_PUBLIC_KEY
Endpoint = VPS_PUBLIC_ADDRESS:51820
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25To include IPv6, set AllowedIPs = 0.0.0.0/0, ::/0 and ensure the VPS has usable IPv6 connectivity, forwarding, and firewall rules. A full tunnel without working IPv6 handling can produce leaks or broken IPv6 connections, depending on the client operating system.
Best Value
- Next-Gen Gigabit Wi-Fi 6 Speeds: 2402 Mbps on 5 GHz and 574 Mbps on 2.4 GHz bands ensure smoother streaming and faster downloads; support VPN server and VPN client¹
- A More Responsive Experience: Enjoy smooth gaming, video streaming, and live feeds simultaneously. OFDMA makes your Wi-Fi stronger by allowing multiple clients to share one band at the same time, cutting latency and jitter.²
- Expanded Wi-Fi Coverage: 4 high-gain external antennas and Beamforming technology combine to extend strong, reliable, Wi-Fi throughout your home.
- Improved Battery Life: Target Wake Time helps your devices to communicate efficiently while consuming less power.
- Improved Cooling Design: No heat ups, no throttles. A larger heat sink and redefined case design cools the WiFi 6 system and enables your network to stay at top speeds in more versatile environments.
Import the file into the WireGuard application or place it in the operating system’s WireGuard configuration directory. Activate the tunnel only after confirming that the endpoint is the VPS’s current public address and that the server has the matching client public key.
Test in an order that isolates failures
- Check interface addresses. On the client, run
ip addrand confirm that the WireGuard interface has its assigned address. On the server, confirm10.66.0.1/24is present onwg0. - Check routes. Run
ip route. A split tunnel should show only the listed private prefixes through WireGuard. A full IPv4 tunnel should install a default route through the VPN, using the client’s platform-specific WireGuard routing behavior. - Check the handshake. Run
sudo wg showon the server and inspect the peer’s latest handshake and transfer counters. A recent handshake proves that encrypted packets reached the peer and were authenticated; it does not prove that forwarded traffic works. - Ping the VPN gateway. From the client, ping
10.66.0.1. Failure here points to keys, tunnel addresses, the UDP port, or a local firewall before Internet routing is considered. - Test DNS separately. Resolve a known hostname while the tunnel is active. If IP connectivity works but names do not, inspect the client’s DNS setting and any DNS firewall policy rather than changing WireGuard routes.
- Check the external address. In full-tunnel mode, visit an external IP-check service or query one from the client. The observed public IPv4 should be the VPS address, not the client’s local ISP address.
- Test the intended private networks. For site-to-site use, test an address in each LAN and verify return routes on both gateways. A handshake and gateway ping do not establish reachability to every host behind a gateway.
Troubleshoot a handshake with no usable traffic
| Symptom | Likely cause | What to inspect or change |
|---|---|---|
| No latest handshake | Wrong endpoint, stale public address, blocked UDP port, or mismatched keys. | Confirm the VPS address and port, compare each public key with the opposite configuration, and allow UDP in both the cloud firewall and host firewall. |
Handshake exists but the client cannot ping 10.66.0.1 |
Incorrect tunnel addresses, peer AllowedIPs, or a local firewall rule. |
Check ip addr, the server’s per-peer AllowedIPs, and interface firewall policy. |
| Gateway ping works but Internet traffic fails | IP forwarding is disabled, forwarding is denied, or source NAT is missing. | Verify net.ipv4.ip_forward=1, forwarding rules, the public interface name, and a masquerade rule for the VPN subnet. |
| Private site works but Internet bypasses the VPN | The client is configured as split tunnel. | Use 0.0.0.0/0 for full IPv4 tunneling, and add ::/0 only when IPv6 forwarding and routing are ready. |
| Internet works by IP but not by hostname | DNS is unreachable, incorrectly selected, or blocked by policy. | Set a reachable resolver in the client profile, test resolver reachability, and check whether the operating system accepted the profile’s DNS setting. |
| One site-to-site LAN cannot reach the other | Overlapping private ranges, missing return routes, or an overly broad peer AllowedIPs entry. |
Use non-overlapping networks, add explicit routes in both directions, and assign each remote prefix to the correct peer. Do not add NAT when the gateways can route the original private addresses. |
| Connections stop after the VPS is rebuilt | The provider-assigned public address changed. | Attach a reserved address, update every client’s Endpoint, or update the DNS name used as the endpoint. |
| Only some clients work | Duplicate tunnel addresses or reused keys cause peer identity and route conflicts. | Give each device a unique key pair and unique address, then add a separate server [Peer] block. |
Ubuntu’s troubleshooting guidance specifically recommends checking public and private keys, interface addresses, and route tables. Those checks should precede changing cryptographic settings or repeatedly restarting the service.
Site-to-site routing without NAT
For two networks, suppose the VPS-side LAN is 192.168.10.0/24 and the remote gateway protects 192.168.20.0/24. The ranges must not overlap with each other, the WireGuard subnet, or either site’s local networks. The remote gateway’s server-side peer entry would include 10.66.0.2/32, 192.168.20.0/24 as appropriate for that gateway. The VPS or its LAN router needs a route for 192.168.20.0/24 via the WireGuard gateway, and the remote LAN needs a return route for 192.168.10.0/24.
Enable forwarding on both gateways and permit the relevant interfaces and prefixes in both firewalls. Because the gateways have routes back to one another, leave masquerading disabled. Preserving source addresses makes host-level access controls and logs meaningful; NAT should be used only when routing cannot be arranged or when a deliberate gateway design requires it.
Security and maintenance practices
- Protect private keys with restrictive file permissions and never place them in public repositories or shared logs.
- Use a separate peer key for every device so one lost device can be revoked by removing only its server-side
[Peer]block. - Limit the cloud firewall’s UDP rule to expected source networks when roaming clients do not require access from arbitrary addresses. If clients roam, keep the port exposed but rely on WireGuard keys and host firewall policy for access control.
- Keep the VPS operating system and WireGuard package updated through the normal Ubuntu maintenance process.
- Back up the configuration securely, but encrypt backups because they contain private keys. Record which tunnel address belongs to each device.
- Monitor handshake times and transfer counters. A peer that has not handshaken recently may be offline, behind a changed network, or using an obsolete endpoint.
- Document whether each peer is full tunnel, split tunnel, or site-to-site. This prevents a later route change from unexpectedly redirecting all Internet traffic.
Costs, limits, and operational expectations
The required paid component is hosted compute with a public address; pricing, bandwidth allowances, IPv4 charges, and reserved-address fees vary by provider, region, and plan. No universal cost or performance figure applies to every VPS. A self-hosted WireGuard endpoint is not equivalent to a consumer VPN subscription: you administer the server, keys, updates, routing, firewall, and abuse response yourself, while the VPS address is the egress identity for your traffic.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsBefore choosing a plan, verify that it supplies a public IPv4 address, permits inbound UDP on your chosen port, supports the required IPv6 features if you need dual stack, and allows the bandwidth and concurrent connections your use case demands. The smallest instance may be sufficient for a few low-volume clients, but the provider’s CPU, network, and traffic policies—not WireGuard’s protocol name—determine the practical capacity.
When this design is the right fit
Use a VPS with WireGuard when you need a public address you control, encrypted access to private networks, or a simple gateway for a small set of devices. Choose split tunneling when local Internet breakout matters, full tunneling when a single fixed egress address matters, and site-to-site routing when two private networks must communicate without hiding their original addresses. The reliable implementation is the one whose endpoint, routes, forwarding, NAT, DNS, and firewall rules all match that decision.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
