WireGuard VPN for admin access

Mon, 03 Aug 2026 00:00:00 +0000

WireGuard VPN for admin access

Once your VPS is in production, you don’t want to expose admin UIs (Grafana, Netdata, internal tools) to the public internet. WireGuard gives you a private tunnel to your VPS — only clients with the right keys can reach those services.

Server setup

apt install -y wireguard

# Generate server keys
wg genkey | tee /etc/wireguard/server_private.key | wg pubkey > /etc/wireguard/server_public.key
chmod 600 /etc/wireguard/server_private.key

# Server config
cat > /etc/wireguard/wg0.conf <<EOF
[Interface]
Address = 10.10.10.1/24
ListenPort = 51820
PrivateKey = $(cat /etc/wireguard/server_private.key)
# Forward traffic from VPN clients
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

[Peer]
# admin-laptop
PublicKey = <client_public_key>
AllowedIPs = 10.10.10.2/32
EOF

# Enable IP forwarding
echo "net.ipv4.ip_forward=1" >> /etc/sysctl.conf
sysctl -p

systemctl enable --now wg-quick@wg0

# Open firewall
ufw allow 51820/udp comment 'WireGuard'

Client setup (macOS, Linux, iOS, Android)

For each client:

Networking on nuteo.info

WireGuard VPN for admin access

WireGuard VPN for admin access

Server setup

Client setup (macOS, Linux, iOS, Android)