To give a device a fixed public IP through a VPN, rent an Ubuntu VPS with a stable public IPv4 address, install WireGuard, and route the client through it. The VPS becomes the always-reachable WireGuard endpoint; in full-tunnel mode it forwards and source-NATs client traffic so Internet services see the VPS address. Split tunneling, site-to-site routing, IPv4-only, and dual-stack designs use the same encrypted tunnel but different routes and firewall rules.
Antihost offers VPS plans with one-click OpenVPN, NVMe storage and a 14-day free trial.
What this setup does
A VPS is an Internet-reachable virtual server. Its provider-assigned public IPv4 address is the endpoint that WireGuard clients contact. If the provider offers a reserved or static address separately from the virtual machine, attach that address so it survives a VM replacement or rebuild. Canonical’s site-to-site guidance describes an always-on peer as needing “a static endpoint, like a fixed IP address, or valid domain name.”
As an Amazon Associate I earn from qualifying purchases.
WireGuard creates an encrypted network interface rather than acting as a traditional proxy. Every peer has a private key and a public key. Private keys stay on their respective devices; only public keys are exchanged. Normal Linux interfaces, addresses, routes, forwarding, firewall rules, and (for Internet egress) source NAT determine what can actually pass through the tunnel.
There are two common outcomes:
- Full tunnel: the client sends its default IPv4 and, if configured, IPv6 routes through the VPS. Public websites see the VPS address.
- Split tunnel: only selected private networks or remote prefixes use WireGuard. Ordinary Internet traffic continues through the client’s existing connection.
A successful WireGuard handshake proves that encrypted control traffic is reaching the peer. It does not prove that forwarding, routes, NAT, DNS, or firewall policy is correct.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
Choose the architecture before installing anything
| Decision | Use this when | What changes |
|---|---|---|
| Full tunnel | You want all client Internet traffic to exit from the VPS public IP. | Client AllowedIPs includes 0.0.0.0/0 and, for IPv6, ::/0. The VPS must forward traffic and normally masquerade it on its public interface. |
| Split tunnel | You need access to a private network, game server, admin subnet, or other selected prefixes without moving all browsing traffic. | Each peer’s AllowedIPs contains only the required prefixes. Internet NAT on the VPS is unnecessary unless one of those prefixes is an Internet route. |
| One client | A laptop, desktop, phone, or single-console network needs access. | Use one unique tunnel address and one server-side [Peer] entry for that device. |
| Site-to-site | Two complete LANs must communicate through gateways. | Use non-overlapping LAN ranges and explicit routes. In this design, the gateways route between private networks; Ubuntu’s guidance does not apply NAT between them. |
| IPv4-only | Your applications and provider expose only IPv4. | Forward IPv4 and use an IPv4 tunnel address. Do not advertise an IPv6 default route. |
| Dual stack | You need IPv4 and IPv6 through the VPS. | Assign IPv6 addresses, enable IPv6 forwarding, permit IPv6 in firewalls, and provide IPv6 egress. A working IPv4 tunnel does not automatically provide IPv6 connectivity. |
| Provider-assigned address | The provider guarantees the address remains attached to this VM lifecycle. | Use that address in each client’s Endpoint; document what happens during rebuild or migration. |
| Reserved address | The provider separates a persistent address from the VM itself. | Attach the reserved address to the replacement VM and keep the same client endpoint. |
Requirements and information to collect
- An Ubuntu VPS with a public IPv4 address that is reachable from the Internet.
- Permission to open a UDP listen port in the provider’s cloud firewall or security group.
- Root or
sudoaccess to the VPS and administrator access to every client. - The VPS public interface name, such as
eth0or a provider-specific name, and its default gateway. - A dedicated private VPN subnet that does not overlap any client LAN or remote site. The examples below use
10.44.0.0/24; choose another RFC1918 range if that network already exists. - A WireGuard UDP listen port. The example uses
51820; the exact port is your choice, provided every firewall and peer agrees. - A plan for DNS. Routing packets through the VPS does not, by itself, make DNS queries use the VPS.
Step 1: Provision the VPS and preserve its endpoint
- Create the Ubuntu VPS and select a public IPv4 allocation. If the provider has a reserved-address product, allocate it before installing software and attach it to the VM.
- Record the address, login method, public interface name, and default route. On Ubuntu, these commands display the relevant values:
ip addr
ip route - Confirm that the address is the one clients will use in
Endpoint. If the address later changes, every client using the old endpoint will stop connecting until its configuration or DNS name is updated. - Apply system updates and install WireGuard:
sudo apt update
sudo apt install wireguard
Do not assume the public interface is named eth0. Substitute the interface shown by ip route in every forwarding and NAT rule.
Step 2: Generate keys without exposing private material
Generate one key pair on the VPS and one separate pair on each client. Run the following on the VPS and protect the files:
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →sudo install -d -m 700 /etc/wireguard
sudo sh -c 'umask 077; wg genkey > /etc/wireguard/server_private.key; wg pubkey < /etc/wireguard/server_private.key > /etc/wireguard/server_public.key'
sudo cat /etc/wireguard/server_public.keyOn a Linux client, use the same pattern locally:
umask 077
wg genkey > client_private.key
wg pubkey < client_private.key > client_public.keyCopy the server public key to the client and the client public key to the server. Never paste a private key into chat, tickets, shell history, or a configuration shared with another peer. If a private key is exposed, generate a replacement and update the corresponding public-key entry.
Step 3: Build the VPS WireGuard configuration
Create /etc/wireguard/wg0.conf. This full-tunnel example assumes the public interface is eth0, the VPN gateway is 10.44.0.1, and the first client is 10.44.0.2:
[Interface]
Address = 10.44.0.1/24
ListenPort = 51820
PrivateKey = SERVER_PRIVATE_KEY
PostUp = iptables -A FORWARD -i %i -o eth0 -j ACCEPT; iptables -A FORWARD -i eth0 -o %i -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i %i -o eth0 -j ACCEPT; iptables -D FORWARD -i eth0 -o %i -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
[Peer]
PublicKey = CLIENT_PUBLIC_KEY
AllowedIPs = 10.44.0.2/32Replace SERVER_PRIVATE_KEY and CLIENT_PUBLIC_KEY with the contents of the appropriate key files. Keep the server-side peer’s AllowedIPs limited to that client’s tunnel address unless the peer is a routed site gateway. On WireGuard, AllowedIPs acts as a routing key when sending and an access-control list when receiving, so an incorrect value can send packets to the wrong peer or reject expected source addresses.
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
The PostUp and PostDown lines implement the gateway pattern: permit forwarding from wg0 to the public interface, permit return traffic, and masquerade outbound packets. If you use UFW or another firewall manager, implement equivalent forwarding and NAT rules there instead of creating conflicting duplicate policy.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsStep 4: Enable forwarding and open both firewall layers
Enable IPv4 forwarding
Set forwarding persistently on the VPS:
sudo sh -c 'printf "net.ipv4.ip_forward=1n" > /etc/sysctl.d/99-wireguard-forward.conf'
sudo sysctl --systemFor dual-stack routing, also set net.ipv6.conf.all.forwarding=1 in the same file and reload it. IPv6 forwarding is not needed for an IPv4-only design, but advertising an IPv6 default route without it creates a broken half-tunnel.
Permit the WireGuard UDP port in the provider firewall
In the VPS provider’s cloud firewall or security group, allow inbound UDP 51820 to the VPS. Restrict the source range when your clients have predictable addresses; otherwise, the port must be reachable from the networks where clients will connect. Also allow the VPS’s outbound and forwarded traffic according to the provider’s policy.
Permit the same traffic in Ubuntu’s host firewall
Cloud filtering and the Ubuntu host firewall are separate controls. Both must allow the WireGuard UDP port. If UFW is enabled, the basic listener rule is:
sudo ufw allow 51820/udpFor a full-tunnel gateway, UFW must also allow routing from wg0 to the public interface, and its forwarding policy must permit return traffic. DigitalOcean’s WireGuard gateway procedure demonstrates UFW route rules and iptables/ip6tables masquerading; the important principle is that the host firewall must permit forwarding and NAT, not merely the UDP handshake.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
If you choose direct iptables rules, make them persistent using the mechanism supported by your Ubuntu image. Do not mix an automatically managed UFW policy with ad hoc rules unless you understand which system will reload and remove them.
Step 5: Configure the client
Create a client profile with the client’s private key and the server’s public key:
[Interface]
Address = 10.44.0.2/24
PrivateKey = CLIENT_PRIVATE_KEY
[Peer]
PublicKey = SERVER_PUBLIC_KEY
Endpoint = VPS_PUBLIC_IP:51820
AllowedIPs = 0.0.0.0/0, ::/0
PersistentKeepalive = 25Use AllowedIPs = 0.0.0.0/0 for an IPv4 full tunnel. Include ::/0 only after the VPS and client have working IPv6 addresses, forwarding, firewall rules, and an IPv6 route to the Internet. The example’s PersistentKeepalive helps a client behind a stateful NAT keep its mapping open; it is not a substitute for a reachable VPS endpoint.
For split tunneling, replace the default routes with only the networks that should use the tunnel. For example, a private remote network might use:
AllowedIPs = 10.20.0.0/16, 10.44.0.0/24Do not put a broad private range in AllowedIPs if it overlaps the client’s local LAN. Overlap makes route selection ambiguous and commonly prevents access to one of the networks.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
On a Linux client, save the profile as /etc/wireguard/wg0.conf, protect it, and start it:
sudo chmod 600 /etc/wireguard/wg0.conf
sudo wg-quick up wg0On desktop or mobile clients, import the same profile into the WireGuard application and activate it. The UI label varies by platform, but the required values are the tunnel address, private key, server public key, endpoint, and intended AllowedIPs.
Step 6: Start the VPS tunnel and make it survive reboots
Bring up the server interface and enable its systemd unit:
sudo wg-quick up wg0
sudo systemctl enable --now wg-quick@wg0Check the effective configuration and handshake state:
sudo wg show
ip addr show wg0
ip routeA recent handshake and increasing transfer counters indicate that encrypted packets are moving. They do not, by themselves, confirm Internet forwarding or DNS. Check those separately from the client.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
Step 7: Verify the path in the right order
- Inspect addressing: confirm the client has its intended
wg0address and the VPS has10.44.0.1/24. - Check the handshake: run
sudo wg showon the VPS and confirm a recent handshake for the client’s public key. - Ping the VPN gateway: from the client, ping
10.44.0.1. If this fails, investigate keys, tunnel addresses, the UDP listener, and both firewall layers before testing the Internet. - Inspect routes: run
ip routeon the client. Full IPv4 mode should install a default route through WireGuard; split mode should show only the selected prefixes. Check IPv6 routes separately when dual stack is enabled. - Test DNS: resolve a known hostname. A tunnel can carry IP packets while DNS still points to an unreachable resolver or leaks through the original connection. Configure a resolver reachable from the chosen routing design.
- Check the external address: use an external IP-check service in a browser. In full-tunnel mode, the observed public IPv4 should be the VPS address, not the client’s usual address.
- Compare counters: generate traffic, then run
wg showagain. Client and server receive/transmit counters should increase in the expected directions.
Routing patterns beyond a single full-tunnel client
Several individual clients
Give every client a unique tunnel address, such as 10.44.0.2/32, 10.44.0.3/32, and 10.44.0.4/32. Add one server-side [Peer] block per public key. Never assign the same tunnel address to two peers; the server then cannot reliably determine which peer owns a packet.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Site-to-site gateways
For two LANs, use non-overlapping ranges, for example a VPS-side LAN of 10.20.0.0/16 and a remote LAN of 10.30.0.0/16. Each gateway needs routes for the opposite LAN through WireGuard, and each LAN needs a return route to the other side. Put the remote LAN prefixes in the peer’s AllowedIPs rather than a default route. Ubuntu’s site-to-site model does not NAT traffic between the site gateways, so the networks must know how to return packets.
If a gateway represents an entire LAN, its server-side AllowedIPs may contain that LAN prefix. Ensure no second peer claims the same prefix. Keep Internet masquerading disabled for pure site-to-site traffic unless you intentionally want the remote LAN to see the gateway’s address instead of the original host address.
IPv4-only versus dual stack
IPv4-only is simpler: one tunnel subnet, IPv4 forwarding, and IPv4 firewall/NAT rules. Dual stack requires a separate IPv6 tunnel range, IPv6 addresses on both peers, IPv6 forwarding, matching firewall rules, and IPv6 egress from the VPS. If the VPS provider does not supply usable IPv6 routing, omit ::/0 from the client rather than creating an IPv6 black hole.
Why a handshake can exist while traffic fails
| Symptom | Likely cause | Check and correction |
|---|---|---|
Handshake is recent, but the client cannot ping 10.44.0.1. |
Wrong tunnel address, key, or peer AllowedIPs. |
Compare public keys, inspect both wg0 addresses, and ensure the server peer owns exactly the client’s tunnel address. |
| The gateway responds, but websites do not load in full-tunnel mode. | IP forwarding, FORWARD policy, or masquerading is missing. | Check sysctl forwarding, the public-interface name in NAT rules, and forward counters. Add equivalent UFW route rules if UFW manages the host. |
| No handshake at all. | Wrong endpoint, changed public IP, blocked UDP port, or incorrect keys. | Verify the endpoint and port, check the provider security group and host firewall separately, and compare each public key with the peer that owns it. |
| IPv4 works but IPv6 fails. | The client advertises ::/0 without complete IPv6 forwarding, firewall, or egress. |
Remove ::/0 until IPv6 is configured end to end, or complete the IPv6 address and route design. |
| Some private hosts work and others do not. | Overlapping LAN ranges or missing return routes. | Choose non-overlapping networks and add explicit routes on both site gateways and LAN routers. |
| IP addresses work but hostnames fail. | DNS resolver is unreachable, misconfigured, or following an unintended route. | Test DNS independently, select a resolver reachable through the intended tunnel, and verify the client DNS setting. |
| A replacement VPS is unreachable. | Clients still use the old endpoint or a DNS record still resolves to the old address. | Update each Endpoint or update the endpoint DNS, then reactivate the profiles. |
Ubuntu’s troubleshooting guidance emphasizes checking public and private keys, interface addresses, and route tables. Those checks should precede changing firewall rules at random; otherwise, a correct policy can be mistaken for the cause.
Recommended Free Tools
Security and maintenance checklist
- Keep every private key readable only by the account that needs it.
- Use a different key pair for every client and revoke a lost device by removing its public key from the VPS configuration.
- Limit each peer’s
AllowedIPsto the addresses or networks that peer should own. - Allow only the required UDP listen port in the provider firewall and host firewall.
- Keep Ubuntu and WireGuard packages updated through the normal system update process.
- Back up configuration without exposing private keys; store encrypted backups separately from the VPS.
- Document the reserved-address attachment, endpoint DNS, tunnel subnet, peer addresses, and firewall ownership.
- After rebooting or replacing the VPS, verify the systemd unit, public address, forwarding settings, handshake, routes, DNS, and external address in that order.
What the VPS does not guarantee
A fixed VPS address gives you a stable endpoint, not a guaranteed latency, uptime, or gaming performance figure. The route between a client and the VPS, the route from the VPS to a destination, provider maintenance, and congestion all affect the result. A self-hosted WireGuard VPS also does not automatically provide anonymity: the VPS operator can observe traffic metadata, and applications may identify users through accounts, cookies, or other signals.
For a game server or other service that must be reachable, decide whether the service should bind to the VPS public address, a private tunnel address, or a separate site-to-site route. Exposing a service requires its own application listener and firewall policy; opening WireGuard’s UDP port does not expose unrelated ports.
Quick Recap
Final verification before relying on it
- Confirm the VPS public address is stable or reserved and recorded.
- Confirm every peer has a unique tunnel address and matching public-key entry.
- Confirm the cloud security group and Ubuntu firewall both permit the WireGuard UDP port.
- Confirm forwarding is enabled for every address family you advertise.
- Confirm full-tunnel clients have the intended default routes and split-tunnel clients do not.
- Confirm NAT is enabled only for Internet egress, not accidentally for site-to-site routes.
- Confirm the client can reach the VPN gateway, resolve DNS, and observe the VPS public address when full tunneling is selected.
- Confirm
wg-quick@wg0starts at boot and that a recent handshake appears after reconnecting a client.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
