Skip to content
Odinex Cloud
DELog inSign up
WireGuard VPN
Networking

WireGuard VPN

A private VPN with the wg-easy web interface.

Your own WireGuard VPN with the wg-easy web interface on Ubuntu 24.04. Add devices, download configs or scan QR codes, with a German IP address.

Deploy WireGuard VPNGetting started

Opens the Odinex console with WireGuard VPN selected. No licence fee: you pay for the server only.

Base image
Ubuntu 24.04 LTS
Minimum
1 GB RAM · 20 GB disk
Recommended plan
S1 (1 vCPU · 2 GB RAM · 40 GB NVMe)
Ready after boot
1 to 2 minutes
Image slug
wireguard

About WireGuard VPN

WireGuard is a modern VPN protocol: fast, simple and built into the Linux kernel. wg-easy adds a web interface to manage it, so you can create a client for each phone or laptop and hand it over as a configuration file or QR code.

This image runs wg-easy 15 with the WireGuard server on UDP port 51820 and its web interface behind Caddy with HTTPS. On first boot it is configured with this server's public IP and your administrator account; there is no open setup page.

What’s included

Software installed on the image and the ports it uses.

Software
ComponentVersion
Ubuntu24.04 LTS
WireGuardLinux kernel module
wg-easy15
Caddy2 (automatic HTTPS)
Docker Engine and ComposeFrom Docker's repository
Ports
PortProtocolUsed for
22TCPSSH
51820UDPWireGuard VPN
80TCPHTTP (redirects to HTTPS, certificate validation)
443TCP + UDPHTTPS: wg-easy web interface

Who it’s for

  • Remote workers and small teams who need secure access to private servers
  • Travellers who want a trusted connection on public Wi-Fi
  • Administrators linking offices or cloud networks

Use cases

  • Remote access to private networks

    Attach the VPN server to an Odinex private network and reach servers that have no public IP.

  • Secure Wi-Fi on the road

    Route a laptop or phone through your own server in Frankfurt on hotel and café networks.

  • Site-to-site links

    Connect an office router or another cloud to your Odinex servers over WireGuard.

Resources

WireGuard VPN needs at least 1 GB of RAM and a 20 GB disk. Every plan includes an NVMe disk and 20 TB of traffic.

Smallest plan

S1

  • 1 vCPU (shared)
  • 2 GB RAM
  • 40 GB NVMe disk

The smallest plan that meets the minimum.

Recommended

S1

  • 1 vCPU (shared)
  • 2 GB RAM
  • 40 GB NVMe disk

A comfortable size for regular use.

WireGuard is light: S1 serves a team comfortably. Every plan includes 20 TB of traffic, which VPN traffic counts towards. You can resize the server later. See current prices.

Getting started after deploy

  1. Find your address and password

    The address, user name and password are written to /root/APP-INFO.txt and printed when you log in over SSH as root. If you created the server with a root password and it meets wg-easy's policy (12 or more characters with upper-case, lower-case, a digit and a special character), the app uses that same password, so you can sign in with what the console showed you at creation. If you used an SSH key (or the password does not meet the policy), a strong password is generated for this server and written to /root/APP-INFO.txt.

    ssh [email protected]
cat /root/APP-INFO.txt

  2. Sign in to wg-easy

    Open the web interface and sign in as admin. Until you add your own domain, the app is served at https://<your-ip-with-dashes>.sslip.io (for example https://203-0-113-10.sslip.io), a public wildcard DNS name that resolves to your server, with a Let's Encrypt certificate obtained automatically. Opening the bare IP address redirects there.

  3. Add a client

    Create a client for each device. Download its configuration file, or scan the QR code with the WireGuard app on iOS or Android.

  4. Connect

    Import the configuration into the WireGuard app and connect. Clients use 1.1.1.1 and 8.8.8.8 for DNS by default; you can change this in wg-easy.

  5. Use your own domain

    Create an A record for your domain that points to the server's IPv4 address and wait until it resolves. Then run the domain helper as root: it switches the app to the new name and obtains a new certificate.

    nexoran-app-domain app.example.com

Security notes

  • A server without a firewall accepts all inbound traffic. Create an Odinex firewall that allows only SSH (22), WireGuard (51820/UDP) and HTTPS (443, plus 80 for certificates) and apply it to the server. Odinex firewalls filter traffic before it reaches the server, so Docker's own iptables rules cannot bypass them.
  • If you only manage clients occasionally, you can also restrict ports 80 and 443 to your own IP addresses; the VPN itself only needs UDP 51820.
  • Remove clients you no longer use; a configuration file is a key to your network.
  • The VPN carries IPv4 only (IPv6 is disabled in wg-easy on this image).

WireGuard VPN questions

Clear answers about location, infrastructure and billing.

Which IP address do VPN clients get on the internet?
The server's public IPv4 address in Frankfurt, Germany.
How many devices can I connect?
wg-easy's default address range has room for about 250 clients. In practice the limit is the server's CPU and bandwidth; S1 serves a small team.
Can I reach my private servers through the VPN?
Yes. Attach the VPN server to an Odinex private network; clients can then reach the other servers on it.
What happens if I change the server's IP?
Client configurations contain the server address set in wg-easy (the IPv4 address at first boot). If you change it, for example to your own domain, update the host in wg-easy's settings and download the client configurations again.

Documentation

WireGuard VPN

Odinex Cloud

More from the marketplace

Deploy WireGuard VPN in Frankfurt

Your own server with full root access, NVMe storage and 20 TB of traffic, billed by the hour.

Deploy WireGuard VPNAll apps