To connect two Ubuntu servers directly, install WireGuard on both hosts, give each end of a dedicated tunnel subnet, exchange public keys, and put the opposite tunnel address in each peer’s AllowedIPs. Bring the interface up with wg-quick, verify the handshake and routes, then enable the systemd unit if the link must return after reboot.
Antihost offers VPS plans with one-click OpenVPN, NVMe storage and a 14-day free trial.
The configuration below is a strict host-to-host VPN. It carries traffic between the two Ubuntu machines themselves. Routing an entire office, cloud VPC, container network, or game-server LAN requires the forwarding, firewall, and return-route changes described later.
As an Amazon Associate I earn from qualifying purchases.
What a point-to-point WireGuard VPN does
WireGuard is configured independently on every host. Each host has a private key, a tunnel address on a private subnet, and a peer entry containing the other host’s public key. The private key never leaves its host; only the corresponding public key is exchanged.
For a direct two-host link, use a dedicated subnet such as 10.10.10.0/24. Assign 10.10.10.1 to host A and 10.10.10.2 to host B. Each peer then lists the other tunnel address in AllowedIPs as a /32. This tells WireGuard which destination should be encrypted for that peer and, on the receiving side, which source addresses are accepted from it.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
wg-quick turns that configuration into a working interface. It assigns the interface address, applies WireGuard parameters, and installs routes inferred from the peer definitions. A tunnel handshake alone does not prove that an application can communicate; you must also inspect the interface and route and perform an end-to-end test.
Direct host-to-host versus routed site-to-site
Decide which design you need before choosing AllowedIPs. A point-to-point VPN terminates on the two machines that exchange traffic. A site-to-site VPN terminates on gateways and forwards traffic for other networks.
| Decision point | Direct host-to-host | Routed site-to-site |
|---|---|---|
| WireGuard endpoints | The two Ubuntu servers or workstations that need to communicate | A gateway at each site, often separate from the clients that use the VPN |
| Forwarding | Not required when traffic ends on the WireGuard hosts | Required on gateways so packets can cross between wg0 and a LAN or other interface |
| AllowedIPs | Usually the opposite tunnel address as a /32 |
The remote LAN or other routed CIDR, plus any tunnel addresses needed for management |
| Firewall exposure | Allow the WireGuard UDP port and the desired traffic to the host | Also allow forwarding between interfaces and account for return traffic |
| Startup | Enable wg-quick@wg0 when the direct link must persist |
Enable the same service on every gateway that must maintain the site link |
Do not put a broad network or 0.0.0.0/0 in a host-to-host peer entry merely because it is convenient. A broad prefix changes route selection and can capture traffic that was never intended to use the VPN.
Prerequisites and network planning
Two reachable Ubuntu systems
Both systems must already be installed and administered. Install the WireGuard tools from the Ubuntu repository appropriate to each deployed Ubuntu release. The exact package command can vary by release, so use that release’s standard repository instructions rather than mixing packages from another distribution.
At least one host must be able to send UDP traffic to the other host’s WireGuard listening port. The endpoints may be public addresses, DNS names, private addresses reachable over an existing network, or a port-forward on a NAT gateway. If a firewall or cloud security group blocks the UDP port, no key or route change can create a handshake.
Choose a non-overlapping tunnel subnet
The example uses 10.10.10.0/24. Confirm that this range does not overlap either host’s physical LAN, cloud network, container bridge, VPN, or other route. Overlap can make the kernel select a local route instead of the WireGuard route.
A /24 is easy to read, but a two-host deployment only needs two addresses. You can use a smaller private subnet if it fits your addressing plan. Whatever prefix you choose, assign unique interface addresses and use the correct opposite address in each peer’s AllowedIPs.
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
Pick the endpoint and UDP port
The sample uses UDP port 51820, WireGuard’s commonly used example port. It is not mandatory and is not security by itself. Choose a port permitted by the host firewall, cloud firewall, and any NAT or port-forward. An endpoint is written as an address or DNS name followed by the port, for example vpn-b.example.net:51820.
Generate one key pair on each host
Run these commands separately on host A and host B. The umask prevents newly created key files from being readable by other users.
umask 077
wg genkey > wg0.key
wg pubkey < wg0.key > wg0.pubDisplay a public key when you need to copy it into the other host’s configuration:
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemscat wg0.pubKeep each wg0.key private. Anyone who obtains a private key can impersonate that WireGuard interface. Transfer only the public key to the peer. Ubuntu’s WireGuard configuration uses PrivateKey to decrypt traffic destined for the interface and uses a peer’s PublicKey to encrypt traffic sent to that peer.
Label the two values while you work. For example, host A has A_PRIVATE and A_PUBLIC; host B has B_PRIVATE and B_PUBLIC. Never paste a private key into the other host’s [Peer] section.
Configure host A
Create /etc/wireguard/wg0.conf as root on host A. Replace every placeholder with the real value from your environment.
[Interface]
Address = 10.10.10.1/24
ListenPort = 51820
PrivateKey = <host-A-private-key>
[Peer]
PublicKey = <host-B-public-key>
Endpoint = <host-B-public-ip-or-dns>:51820
AllowedIPs = 10.10.10.2/32
PersistentKeepalive = 25What each host A setting means
- Address: The address assigned to A’s WireGuard interface. It must be different from B’s address.
- ListenPort: The UDP port on which A accepts WireGuard packets. Permit it in the relevant host or cloud firewall if B will initiate directly.
- PrivateKey: A’s secret key, generated on A.
- PublicKey: B’s public key. This associates encrypted traffic with B.
- Endpoint: B’s currently reachable UDP address. Include it when A should initiate toward a known address.
- AllowedIPs: A sends traffic destined for
10.10.10.2to this peer. The/32keeps the route limited to B’s tunnel address. - PersistentKeepalive: A sends periodic keepalive packets. The value
25seconds is useful when a host sits behind NAT and needs its mapping kept open; it is not required on every unrestricted network.
If B has a stable, reachable address, retaining the endpoint on A is straightforward. If B’s address changes, B can initiate and A can learn B’s current authenticated endpoint, provided the surrounding NAT and firewall rules permit the exchange.
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
Configure host B
Create the inverse configuration on host B at /etc/wireguard/wg0.conf.
[Interface]
Address = 10.10.10.2/24
ListenPort = 51820
PrivateKey = <host-B-private-key>
[Peer]
PublicKey = <host-A-public-key>
Endpoint = <host-A-public-ip-or-dns>:51820
AllowedIPs = 10.10.10.1/32
PersistentKeepalive = 25B’s interface address is 10.10.10.2, and its peer route points only to A’s 10.10.10.1. The endpoint on B should name A’s reachable address. If only one side has a stable public endpoint, put the endpoint on that side’s peer section and let the other side initiate.
Both sides may specify endpoints when both addresses are stable. Do not accidentally use the same private key, interface address, or peer public key on both systems.
Protect the files and bring the tunnel up
WireGuard configuration contains a private key, so restrict the file to root and start it with wg-quick.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallsudo chmod 600 /etc/wireguard/wg0.conf
sudo wg-quick up wg0When the command succeeds, wg-quick creates wg0, assigns its address, applies the peer and cryptographic settings, and installs routes derived from AllowedIPs. A successful command means the local configuration was accepted; it does not guarantee that the remote peer is reachable.
To stop the interface during changes or troubleshooting, use:
sudo wg-quick down wg0Edit the file while the interface is down, then run sudo wg-quick up wg0 again. For a live configuration change, use wg syncconf only if you are comfortable managing the generated configuration; bringing the interface down and up is easier to audit for a first deployment.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
Verify the handshake, addresses, routes, and traffic
Run the following checks on both hosts, adapting the ping destination to the opposite host.
Free tools Windows power users keep installed
One-click scans. No signup required.
sudo wg show
ip address show dev wg0
ip route | grep wg0
ping -c 3 10.10.10.2 # run on host A
ping -c 3 10.10.10.1 # run on host BRead wg show
Look for the expected peer public key, an endpoint, a recent handshake time, and transfer counters that increase after traffic. A recent handshake proves that authenticated WireGuard packets have crossed the network. It does not prove that every application port is allowed.
Inspect the interface
ip address show dev wg0 should show the configured address on the interface and an interface state suitable for use. Confirm that A shows 10.10.10.1/24 and B shows 10.10.10.2/24, without a duplicate address.
Inspect route selection
ip route | grep wg0 should show a route for the opposite tunnel address through wg0. Because wg-quick derives routes from AllowedIPs, this check catches typos and unexpectedly broad prefixes.
Test an actual path
Ping the opposite tunnel address first. Then test the application port you intend to use, such as an SSH connection or a game-server connection bound to the WireGuard address. Testing the real service catches a host firewall rule that allows ICMP but blocks the application.
Recommended Free Tools
Add forwarding only when traffic must cross the host
A pure host-to-host ping terminates on the WireGuard hosts and does not require IPv4 forwarding. You need forwarding when A or B acts as a gateway for another LAN, a container network, a virtual machine network, or an additional interface.
Enable IPv4 forwarding persistently
On every Ubuntu gateway that must route between wg0 and another interface, create a sysctl drop-in:
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
sudo tee /etc/sysctl.d/70-wireguard-routing.conf >/dev/null <<'EOF'
net.ipv4.ip_forward = 1
EOF
sudo sysctl -p /etc/sysctl.d/70-wireguard-routing.confVerify the active value:
sysctl net.ipv4.ip_forwardThe result should report net.ipv4.ip_forward = 1. IPv6 traffic requires separate IPv6 forwarding and address planning; enabling IPv4 forwarding does not route IPv6.
Advertise the remote LAN in AllowedIPs
Suppose host A is a gateway for 192.168.50.0/24 and host B is a gateway for 192.168.60.0/24. The peer entry on A would include B’s tunnel address and the remote LAN, for example AllowedIPs = 10.10.10.2/32, 192.168.60.0/24. B would include 10.10.10.1/32, 192.168.50.0/24 for A. Use only networks that really reside behind that peer.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Allow forwarding and return traffic
Permit the intended traffic in the host firewall’s forward chain, not only its input chain. The remote LAN also needs a route back to the VPN subnet through the gateway. If you cannot add a return route, deliberate source NAT may be used, but NAT hides the original source and should be chosen as an explicit design decision rather than as a repair for an unknown routing problem.
Ubuntu’s site-to-site guidance emphasizes that existing firewall and routing rules may need changes. A successful tunnel ping between gateways does not prove that a workstation behind either gateway can reply.
Start WireGuard automatically at boot
For a permanent connection, enable and start the systemd unit:
sudo systemctl enable --now wg-quick@wg0This both starts wg0 immediately and enables it for later boots. Check the service if startup fails:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
sudo systemctl status wg-quick@wg0
sudo journalctl -u wg-quick@wg0Keep the configuration at /etc/wireguard/wg0.conf; the instance name in wg-quick@wg0 corresponds to the filename without .conf.
Troubleshoot by symptom
No recent handshake
- Confirm that each peer has the other peer’s public key, not its own key or a copied private key.
- Check that the endpoint resolves to the intended address and uses the same UDP port configured on the remote host.
- Allow the UDP port through Ubuntu’s host firewall, cloud security group, and any upstream firewall.
- For NAT, verify that the port-forward targets the correct internal host and that the initiating side can send outbound UDP.
- Use
PersistentKeepalive = 25on a peer that must maintain a NAT mapping, then generate traffic and inspectwg showagain.
Handshake exists but tunnel ping fails
- Check that the two
Addressvalues are unique and belong to the chosen tunnel subnet. - Verify that A’s peer has
AllowedIPs = 10.10.10.2/32and B’s peer hasAllowedIPs = 10.10.10.1/32. - Inspect
ip routefor a competing or overly broad route. - Review local firewall policy for ICMP and for the application you are testing.
Tunnel ping works but LAN traffic fails
- Enable forwarding on the gateway.
- Add firewall rules permitting forwarding in both directions and established return traffic.
- Put the remote LAN CIDR in the correct peer’s
AllowedIPs. - Add a return route on the remote LAN, or configure intentional NAT on the gateway.
- Test a host behind the gateway, not only the gateway’s own tunnel address.
Unexpected traffic uses the VPN
Inspect ip route and each peer’s AllowedIPs. A broad prefix installs a broad route. For a full-tunnel design, AllowedIPs = 0.0.0.0/0 makes the peer the default route; that requires careful endpoint reachability, DNS handling, firewall policy, and usually a plan for preventing the VPN’s own endpoint traffic from being routed into the tunnel. Use a default route only when the peer is intentionally the gateway for all IPv4 traffic.
Quick Recap
Security and maintenance practices
- Keep private keys readable only by root and back them up through an encrypted, access-controlled method.
- Exchange public keys through a channel that lets you verify which host they belong to.
- Expose only the WireGuard UDP port and the application ports that the VPN actually needs.
- Use narrow
AllowedIPsprefixes. They document intended reachability and reduce accidental route capture. - Rotate a key pair when a private key may have been exposed, when a host is decommissioned, or when your operational policy requires it. Update the corresponding peer public key on the other host during a planned maintenance window.
- After upgrades or network changes, verify the service status, handshake timestamp, route table, and an application-level connection.
A repeatable deployment checklist
- Confirm both Ubuntu hosts can reach the planned UDP endpoint and choose a non-overlapping tunnel subnet.
- Generate a separate key pair on each host and exchange public keys only.
- Create the two
wg0.conffiles with inverse addresses, peer keys, endpoints, and opposite/32tunnel routes. - Set the configuration mode to
600. - Run
sudo wg-quick up wg0on both hosts. - Check
wg showfor a recent handshake and increasing transfer counters. - Check interface addresses and routes with
ip address show dev wg0andip route. - Ping the opposite tunnel address, then test the real service over its WireGuard address.
- If routing another network, enable forwarding, adjust firewall rules, and install return routes or deliberate NAT.
- Run
sudo systemctl enable --now wg-quick@wg0when the VPN must survive a reboot.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
