Deploy a WireGuard VPN Gateway with Quick Start in InMotion Central

Introduction

Servers on your private network have addresses like 192.168.10.22 that you can't reach from home or the office. A VPN gateway fixes that. It gives your computer a secure, encrypted path into the private network, so you can reach those servers without giving each one a public IP address.

The WireGuard Gateway Quick Start template in InMotion Central sets up that gateway for you. It launches an Ubuntu 24.04 LTS server with a public IP address, installs WireGuard, opens the VPN port (UDP 51820), turns on routing into your private network, and creates one ready-to-use client configuration for your computer.

In this tutorial, we'll show you how to deploy the gateway, get the client configuration, connect from your computer, and confirm the tunnel is working.

Steps to Deploy the WireGuard Gateway Template

1. Open Quick Start in Your Cloud Project

1. Log in to InMotion Central and select Projects from the left navigation bar.
2. Open your cloud project and click Quick Start in the project sidebar.
3. Locate the WireGuard Gateway template card and click Deploy.

2. Configure Your Deployment Settings

In the Deploy WireGuard Gateway dialog, review or customize the settings:

Basic

• Stack name: Enter a name for this deployment (for example, wireguard). Use letters, numbers, dots, underscores, or hyphens.
• Server name: Enter a hostname for the gateway (defaults to wireguard-1).
• Image: Choose Ubuntu 24.04 LTS.
• Flavor: Choose the server size (vCPU, RAM, and NVMe storage) that fits your workload.

Networking

• Public network: Keep External selected. This is the network your gateway's public IP address comes from.
• Private network: Select the private network you want to reach over the VPN. If your project does not have one yet, InMotion Central offers to create a Private Network + Router deployment first.
• Private network CIDR: The address range your computer can reach through the VPN (defaults to 192.168.10.0/24). Use the same range as your private network.

SSH

• SSH key: Select an existing SSH key, click Generate New Key, or click Paste Public Key. You need a key to sign in to the server.
• SSH whitelist: Confirm the comma-separated IP addresses or CIDR ranges allowed on port 22 (prefilled with your current public IP address). Leave this field empty if you want port 22 closed.

You need SSH access to copy the client configuration off the gateway, so attach a key and keep your IP address in the whitelist.

3. Launch and Monitor Your Deployment

1. Click Deploy (or Create Network And Deploy if you are creating a private network at the same time).
2. Scroll down to My Deployments at the bottom of the Quick Start page to track progress.
3. Wait a minute or two while the server boots and sets up WireGuard. When setup finishes, the Status column for wireguard changes to CREATE_COMPLETE.

4. Copy Your Gateway's Public IP Address

1. Next to your wireguard deployment under My Deployments, click Outputs.
2. Copy the floating_ip value. This is the public floating IP address your computer connects to.

5. Download the Client Configuration

The gateway saves your client configuration at /root/wg-client.conf. Run this from your own computer to copy it into a local file:

1$ ssh ubuntu@<floating_ip> 'sudo cat /root/wg-client.conf' > wg-client.conf
Copy

The file looks like this, with your own keys and IP address:

[Interface]
PrivateKey = <client-private-key>
Address = 10.8.0.2/24

[Peer]
PublicKey = <gateway-public-key>
Endpoint = <floating_ip>:51820
AllowedIPs = 10.8.0.0/24, 192.168.10.0/24
PersistentKeepalive = 25

This file contains a private key. Keep it safe, and don't share it or commit it to a code repository.

6. Connect from Your Computer

• Windows or macOS: Install the WireGuard app from wireguard.com, click Import tunnel(s) from file, choose wg-client.conf, and click Activate.
• Linux: Install wireguard-tools, copy the file to /etc/wireguard/wg0.conf, and run sudo wg-quick up wg0.

Only traffic for 10.8.0.0/24 and your private network goes through the tunnel. The rest of your internet traffic is not affected.

How to Know the Installation Was Successful

With the tunnel active, ping the gateway's VPN address. Our test connection returned:

1$ ping -c3 10.8.0.1
Copy

PING 10.8.0.1 (10.8.0.1) 56(84) bytes of data.
64 bytes from 10.8.0.1: icmp_seq=1 ttl=64 time=0.733 ms
64 bytes from 10.8.0.1: icmp_seq=2 ttl=64 time=0.877 ms
64 bytes from 10.8.0.1: icmp_seq=3 ttl=64 time=0.680 ms

Replies mean your computer and the gateway completed a WireGuard handshake, and you can now reach your other servers by their private addresses (for example, 192.168.10.22).

VPN traffic reaches your servers from the gateway's private address. To SSH to a server over the VPN, include your private network range (for example, 192.168.10.0/24) in that server's SSH whitelist when you deploy it.

What Was Automatically Installed

Running these checks on the gateway (signed in with ssh ubuntu@<floating_ip>) confirmed everything configured at first boot:

Check the Ubuntu version installed

1$ lsb_release -ds
Copy

Ubuntu 24.04.3 LTS

Check the version of WireGuard installed

1$ wg --version
Copy

wireguard-tools v1.0.20210914 - https://git.zx2c4.com/wireguard-tools/

Check that the VPN service is running

1$ systemctl is-active wg-quick@wg0
Copy

active

Check the VPN interface and your client

1$ sudo wg show
Copy

interface: wg0
  public key: <gateway-public-key>
  private key: (hidden)
  listening port: 51820

peer: <client-public-key>
  allowed ips: 10.8.0.2/32

The gateway listens on UDP port 51820 and knows one client, which uses the VPN address 10.8.0.2.

Check that routing into the private network is turned on

1$ sysctl net.ipv4.ip_forward
Copy

net.ipv4.ip_forward = 1

The template creates one client configuration. To connect more devices, add a [Peer] section for each one to /etc/wireguard/wg0.conf on the gateway, give each a new address such as 10.8.0.3, and restart the service with sudo systemctl restart wg-quick@wg0.