Free tools Windows power users keep installed
One-click scans. No signup required.
Make the VPN the VPS’s only public service: expose one UDP WireGuard port, then allow SSH, databases, dashboards and application ports solely on the WireGuard interface or tunnel subnet. Enforce that policy twice—first in the provider’s cloud firewall or security group, and again in the VPS host firewall. Keep a working console or tightly restricted temporary SSH path until VPN access has been tested from a second network.
Antihost offers VPS plans with one-click OpenVPN, NVMe storage and a 14-day free trial.
This guide uses Ubuntu or Debian, WireGuard, and an example tunnel range of 10.80.0.0/24. Adapt interface names, ports and addresses to your services. The examples are for private-service access, not for turning the VPS into an Internet gateway.
As an Amazon Associate I earn from qualifying purchases.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →What “VPN-only VPS access” actually means
A public VPS still needs one reachable entry point so a VPN peer can establish a tunnel. In this design, that entry point is WireGuard’s UDP listen port, normally 51820/udp. Every other inbound port is denied on the provider firewall and the operating-system firewall. Once a client has a tunnel address, the host firewall permits management and application traffic only through wg0 or from the VPN subnet.
WireGuard is described by Ubuntu as a simple, fast and modern VPN implementation. Authentication is based on a public/private key pair for every peer. Its AllowedIPs setting has two jobs: it selects routes for outbound traffic and limits which source addresses a peer may present when sending traffic to the VPS. A broad value can therefore create both a routing problem and an access-control hole.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
Exposure model
| Component | Internet-facing rule | Private rule |
|---|---|---|
| Provider cloud firewall | Allow the chosen WireGuard UDP port; optionally allow temporary SSH from one fixed administration address. | Deny unsolicited inbound traffic by default. |
| VPS host firewall | Allow WireGuard UDP on the public interface; deny public SSH and application ports. | Allow SSH and selected services on wg0 or from the tunnel subnet. |
| WireGuard | Listens on the public address and authenticates configured peers. | Assigns each peer a unique tunnel address and routes only the networks you specify. |
| Applications | Should not bind broadly unless a separate reason requires it. | Prefer listening on the tunnel address or an internal address, with application-level authentication still enabled. |
Plan recovery before changing a firewall
Firewall mistakes can cut off the only route into a remote machine. Open a provider console or maintenance session first and leave it running while you work. Confirm that the console actually reaches the VPS, that you know how to reboot it, and that you can log in with a second administrative account if your normal account is blocked.
- Record the VPS public address, operating-system release, SSH port and the provider’s console procedure.
- Identify the fixed public address from which temporary emergency SSH will be allowed. If your administration address changes frequently, use the console instead of opening SSH to a broad range.
- Inventory every service that currently listens with
sudo ss -tulpn. Mark which ports must be reachable through the VPN and which can be stopped. - Keep one existing SSH session open until a new SSH session over the VPN succeeds and public denial has been verified.
Install WireGuard on Ubuntu or Debian
Use the distribution packages so updates and service integration follow the operating system. On a current Ubuntu or Debian system:
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorssudo apt update
sudo apt install wireguardDo not paste private keys into shell history, chat, tickets or public issue trackers. Store them in files readable only by the account that needs them.
Generate a key pair for the VPS and each client
Generate one key pair for the server and a separate pair for every laptop, workstation or phone. The private key stays on its own device; only the corresponding public key is copied into the other side’s configuration.
sudo install -d -m 700 /etc/wireguard
sudo sh -c 'umask 077; wg genkey > /etc/wireguard/server.key'
sudo sh -c 'wg pubkey < /etc/wireguard/server.key > /etc/wireguard/server.pub'
sudo cat /etc/wireguard/server.pubRun the equivalent commands on a client with the WireGuard tools installed:
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
umask 077
wg genkey > client.key
wg pubkey < client.key > client.pubCopy public keys only. If a private key is exposed, revoke that peer by removing its public key from the server configuration, generate a replacement pair, and update the client.
Choose a non-overlapping tunnel subnet
Use a private range that does not overlap networks from which your users connect. The example below reserves 10.80.0.0/24:
| Device | Tunnel address | Purpose |
|---|---|---|
| VPS | 10.80.0.1/24 |
WireGuard server address used for SSH and private services. |
| Client A | 10.80.0.2/32 |
First peer. |
| Client B | 10.80.0.3/32 |
Second peer. |
Give every peer a unique address. Avoid a range commonly used by home routers or corporate networks; overlapping routes can make a working tunnel appear broken when the client sends traffic to the wrong interface.
Create the VPS WireGuard configuration
Create /etc/wireguard/wg0.conf with mode 600:
sudo chmod 600 /etc/wireguard/wg0.confUse this structure, replacing the key values with the files you generated:
[Interface]
Address = 10.80.0.1/24
ListenPort = 51820
PrivateKey = SERVER_PRIVATE_KEY
[Peer]
PublicKey = CLIENT_A_PUBLIC_KEY
AllowedIPs = 10.80.0.2/32
[Peer]
PublicKey = CLIENT_B_PUBLIC_KEY
AllowedIPs = 10.80.0.3/32The server’s peer entries use each client’s single tunnel address. Do not put 0.0.0.0/0 in a server peer entry unless you deliberately understand the routing and security consequences; it can make one peer claim traffic that belongs elsewhere.
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
Configure each client for narrow access
A client configuration contains its own private key, its tunnel address, and a peer entry for the VPS. The VPS public endpoint is the VPS public IP or DNS name followed by the UDP port:
[Interface]
Address = 10.80.0.2/32
PrivateKey = CLIENT_A_PRIVATE_KEY
[Peer]
PublicKey = SERVER_PUBLIC_KEY
Endpoint = VPS_PUBLIC_ADDRESS:51820
AllowedIPs = 10.80.0.1/32
Add additional private networks to the client’s AllowedIPs only when they must traverse the tunnel. For a private-service endpoint, listing the VPS tunnel address is sufficient. A full-tunnel client would use 0.0.0.0/0 (and, where applicable, IPv6 routes), but that requires forwarding, NAT, DNS and egress policy that this private-only design intentionally omits.
When to use PersistentKeepalive
WireGuard is UDP and does not maintain a traditional persistent connection. Set PersistentKeepalive = 25 on a client only when it sits behind a NAT or firewall and must continue receiving packets after idle periods. The WireGuard quick-start guidance identifies 25 seconds as a sensible interval across many firewalls. Leave it off by default when the client does not need that behavior; unnecessary keepalives create extra traffic.
Apply the provider firewall first
In the provider control panel, create a default-deny inbound policy. Permit only:
Recommended Free Tools
- UDP 51820 (or the UDP port you selected) from the Internet, because WireGuard does not use TCP for its tunnel.
- TCP 22 from your fixed administration address during rollout, or no public SSH at all if the console is ready.
- Established or related return traffic, if the provider exposes that option.
Do not open database, dashboard, HTTP, HTTPS or custom application ports merely because the service is running. If a public website is not part of this VPS’s purpose, those ports remain closed. After VPN access is proven, remove the temporary public SSH rule. Keep the cloud policy and host policy aligned; a permissive rule at either layer can defeat the other layer’s intent.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
Apply the host firewall without locking yourself out
The exact commands depend on whether you use UFW, nftables or another firewall manager. The following UFW example demonstrates the required policy. Build the rules while your recovery session is open, and substitute the actual administration address for the documentation address shown.
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow 51820/udp
sudo ufw allow from 203.0.113.10 to any port 22 proto tcp
sudo ufw allow in on wg0 to any port 22 proto tcp
sudo ufw allow in on wg0 to any port 443 proto tcp
sudo ufw allow in on wg0 to any port 5432 proto tcp
sudo ufw enable
sudo ufw status verboseThe 203.0.113.10 address is reserved for documentation; replace it with the fixed address you control or omit that rule when using console-only recovery. Replace ports 443 and 5432 with the private services you actually operate. The interface-specific rules allow those ports only when packets arrive via wg0. If your VPN subnet is stable and you prefer source matching, use equivalent rules restricted to 10.80.0.0/24.
Allow established and related return traffic in your firewall’s normal stateful configuration. Do not add Internet forwarding or masquerading for a private-service endpoint. Those settings are for a gateway that intentionally carries client traffic onward to the public Internet.
Bring up WireGuard and make it persistent
- Start the interface manually:
sudo wg-quick up wg0. - Inspect the interface and peer state:
sudo wg show. - Check addresses and routes:
ip address show dev wg0andip route. - Enable automatic startup:
sudo systemctl enable wg-quick@wg0. - For later administration, use
sudo systemctl status wg-quick@wg0,sudo systemctl start wg-quick@wg0,sudo systemctl stop wg-quick@wg0,sudo systemctl reload wg-quick@wg0orsudo systemctl restart wg-quick@wg0.
A peer-only edit can normally be reloaded. Changes to routes, interface addresses or PostUp/PostDown firewall commands require a restart and deserve the same recovery precautions as the initial rollout.
Verify both access and denial
Testing from only the VPN can produce a false sense of security. Use two networks: one connected client and one unrelated Internet connection, such as a separate mobile or office network.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
From a connected VPN peer
- Activate the client profile and confirm a recent handshake with
wg showon the VPS. - Ping the VPS tunnel address if ICMP is allowed:
ping 10.80.0.1. - Open a second SSH session to the tunnel address, for example
ssh [email protected], rather than to the public address. - Connect to every intended private service using its tunnel address or the service’s private DNS name.
- Confirm that services not listed in the firewall remain unreachable even over the tunnel.
From an unrelated Internet connection
- Attempt SSH to the public address with a short timeout, such as
ssh -o ConnectTimeout=5 user@PUBLIC_ADDRESS; it should fail after the temporary exception is removed. - Probe the public address for the former application ports. Only the selected WireGuard UDP port should be intentionally reachable.
- Review provider firewall logs, host firewall counters and
sudo wg showfor the latest handshake.
Perform the public denial test before deleting your recovery path, and keep the console available during the first reboot with the new policy.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchDNS, routing and NAT decisions
Private-service routing
For this use case, route only the VPS tunnel address and any explicitly private networks. Do not enable kernel IP forwarding or NAT unless the VPS must route packets between the VPN and another network. Narrow routes reduce accidental access and make troubleshooting clearer.
Full-tunnel Internet egress
A gateway design is different: clients send Internet traffic through the VPS, the VPS enables IP forwarding, forwarding rules permit the traffic, and NAT translates it on the public interface. You also need a DNS plan and an egress policy. Adding those elements broadens both the attack surface and the failure modes, so do not copy gateway instructions into a private-only setup.
DNS over the tunnel
Configure DNS through the tunnel only when private names or a specific resolver policy requires it. Resolver integration varies by distribution and by the tools installed; wg-quick DNS behavior depends on resolver tooling. Verify which resolver service owns /etc/resolv.conf before adding DNS directives, and test both private-name resolution and ordinary lookups after connecting.
Make the applications private as well
A firewall is the primary network boundary, but services should not advertise more than necessary. Bind an administration dashboard or database to 10.80.0.1 or another internal address where the software supports it. If an application must listen on all interfaces, retain the interface- and source-restricted firewall rule and its own authentication, encryption and authorization controls. A VPN authenticates the tunnel peer; it does not replace application credentials or patching.
- Disable unused daemons and remove packages you no longer need.
- Use separate user accounts and keys for administration; avoid sharing one client private key among a team.
- Rotate a peer by removing its old public key and adding a newly generated pair.
- Back up configuration files securely, excluding private keys from general-purpose backups.
- Monitor handshake times, rejected firewall packets and service logs so a failed client is distinguishable from a blocked public probe.
Troubleshoot by symptom
| Symptom | Likely cause | Checks and correction |
|---|---|---|
| No handshake | Provider firewall blocks UDP, wrong endpoint or key mismatch. | Confirm the selected UDP port is allowed, verify the endpoint address, compare each public key and inspect wg show. |
| Handshake exists but tunnel address is unreachable | Address overlap, incorrect AllowedIPs or a down interface. |
Compare client routes with ip route, ensure every peer has a unique host address, and restart wg-quick@wg0 after correcting configuration. |
| SSH works publicly after lockdown | A cloud rule, host rule or alternate SSH listener remains open. | List provider rules, run sudo ufw status numbered or the equivalent firewall listing, inspect ss -tulpn, then remove the broad rule. |
| VPN connects but an application fails | The service binds only to loopback, the port is not allowed on wg0, or application authentication rejects the client. |
Check the listening address, add a narrowly scoped interface rule, and read the application log. |
| Connection dies after idle time | NAT mapping expired on the client’s network. | Add PersistentKeepalive = 25 to that client peer and retest; do not enable it on every peer without a reason. |
| Private DNS fails | Resolver ownership or routing is wrong. | Check the active resolver, route only the DNS server’s network through the tunnel, and test with the resolver’s address directly. |
WireGuard compared with another VPN implementation
WireGuard is a strong fit when the requirement is a small, explicit set of peers and narrow routes. An alternative such as OpenVPN may be preferable where an organization already operates certificate infrastructure or needs its established client and authentication integrations. The choice should follow the access model, not the desire to expose more ports.
| Decision axis | WireGuard | Another VPN implementation (for example, OpenVPN) |
|---|---|---|
| Client platforms | Modern operating systems generally have WireGuard clients or built-in support. | Often has broad legacy support, but client packaging and configuration vary by platform. |
| Identity management | One public/private key pair per peer; revocation means removing or replacing a peer key. | May use certificates, usernames, passwords or an external identity provider, depending on deployment. |
| Narrow routing | AllowedIPs expresses routes and accepted source addresses in each peer entry. |
Can provide selective routes, but the exact controls depend on server and client configuration. |
| Firewall integration | Expose one UDP listen port and restrict services to wg0 or the tunnel subnet. |
Use the protocol’s listen port and interface or source restrictions; do not assume a VPN alone closes service ports. |
| Recovery | Keep console access and a temporary restricted SSH rule while validating the key-based tunnel. | Use the same recovery discipline; changing VPN software does not remove the risk of a firewall lockout. |
| Best fit here | Private VPS services with a few explicitly assigned peers. | Existing organizational deployments whose identity, compliance or client requirements outweigh a simpler key-based design. |
Operational checklist
- Provider firewall defaults to deny inbound and allows only the chosen WireGuard UDP port after rollout.
- Host firewall defaults to deny inbound, permits stateful return traffic, and allows private ports only on
wg0or the VPN subnet. - Every peer has a unique tunnel address and its own protected private key.
- Client
AllowedIPscontains only the VPS address and private networks that client needs. - SSH over the tunnel has been tested from a second session before public SSH was removed.
- An unrelated Internet connection cannot reach SSH or private application ports at the public address.
- Forwarding, masquerading and full-tunnel routes are absent unless the VPS is intentionally an Internet gateway.
- Configuration, firewall rules, key rotation and console recovery are documented for the next administrator.
The resulting VPS is not invisible—the WireGuard UDP port remains a deliberate public entry point—but every administrative and application service is reachable only after a peer proves possession of its key and enters the restricted tunnel. Maintaining both firewall layers and repeating the two-network test after changes keeps that boundary intact.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
