Deploying a WireGuard VPN Gateway on InMotion Cloud

Introduction

A VPN gateway enables secure connectivity between your office network (or remote devices) and InMotion Cloud. This configuration allows your on-premises systems to communicate with cloud instances over an encrypted tunnel, as if both networks were directly connected.

This guide walks through deploying a WireGuard VPN gateway instance on InMotion Cloud, configuring the tunnel, and validating end-to-end connectivity.

Intended audience: System administrators and network engineers deploying hybrid cloud infrastructure.

Network Architecture

The VPN gateway creates a secure tunnel between two networks:

1┌─────────────────────┐          ┌─────────────────────┐
2│   Office Network    │          │   InMotion Cloud    │
3│   or Remote Device  │          │                     │
4│                     │          │  ┌───────────────┐  │
5│  ┌───────────────┐  │          │  │Cloud Instances│  │
6│  │    Clients    │  │          │  │  10.0.0.0/24  │  │
7│  │ 10.100.0.x/32 │  │          │  └───────┬───────┘  │
8│  └───────┬───────┘  │          │          │          │
9│          │          │          │  ┌───────┴───────┐  │
10│          │          │  Tunnel  │  │  VPN Gateway  │  │
11│          └──────────┼──────────┼─►│  10.100.0.1   │  │
12│                     │ UDP 51820│  │(Floating IP)  │  │
13│                     │          │  └───────────────┘  │
14└─────────────────────┘          └─────────────────────┘
15              │                           │
16              └───────── Internet ────────┘
Copy

In this configuration:

• Cloud private network: 10.0.0.0/24 (where your cloud instances live)
• WireGuard tunnel network: 10.100.0.0/24 (virtual network for VPN clients)
• VPN gateway: 10.100.0.1 on the tunnel, with a floating IP for external access

Prerequisites

Before starting, ensure you have:

• Active InMotion Cloud account with project access
• SSH client for connecting to the VPN gateway
• WireGuard client installed on your local device (download here)

Step 1: Create the Private Network

Create a private network for the VPN gateway and cloud instances.

1. Navigate to Project > Network > Networks

2. Click Create Network
3. On the Network tab:

• Network Name: private-net
• Click Next

4. On the Subnet tab:

• Subnet Name: private-sub
• Network Address: 10.0.0.0/24
• Gateway IP: 10.0.0.1
• Click Next

5. On the Subnet Details tab:

• Allocation Pools: 10.0.0.2,10.0.0.10
• DNS Name Servers:
• • 1.1.1.1
  • 1.0.0.1
• Click Create

Connect to External Network

After creating the network, create a router to provide internet access:

1. Navigate to Project > Network > Routers
2. Click Create Router
3. Configure:

• Router Name: private-router
• External Network: Select your external network

4. Click Create Router
5. Click on the router name to open details
6. Select the Interfaces tab
7. Click Add Interface
8. Select private-sub and click Submit

Step 2: Create the Security Group

Create a security group to allow VPN and SSH traffic before launching the instance.

1. Navigate to Project > Network > Security Groups

2. Click Create Security Group
3. Configure:

• Name: vpn-sg
• Click Create Security Group

4. On the Manage Security Group Rules page, click +Add Rule

5. Add the WireGuard rule:

• Rule: Custom UDP Rule
• Description: WireGuard
• Port: 51820
• CIDR: 0.0.0.0/0 (or restrict to your office public IP)
• Click Add

6. Repeat to add an SSH rule:

• Rule: SSH
• CIDR: Your management IP/32 (restrict SSH access to your IP)

Step 3: Deploy the VPN Gateway Instance

With the network and security group ready, deploy the VPN gateway instance.

1. Navigate to Project > Compute > Instances

2. Click Launch Instance
3. On the Details tab:

• Instance Name: vpn
• Click Next

4. On the Source tab:

• Click the up arrow next to Debian 13 to select it
• Click Next

5. On the Flavor tab:

• Click the up arrow next to m7i.medium (or your preferred flavor)
• Click Next

6. On the Networks tab:

• Click the up arrow next to private-net
• Click Next

7. Skip the Network Ports page (click Next)
8. On the Security Groups tab:

• Click the up arrow next to vpn-sg to allocate it
• Click Next

9. On the Key Pair tab, click +Create Key Pair:

• Key Pair Name: vpn
• Key Type: SSH Key
• Click Create Keypair

10. Important: Copy the private key data and save it to a file (e.g., ~/.ssh/vpn.pem on Linux/Mac)

11. Set the file permissions:

1    chmod 600 ~/.ssh/vpn.pem
Copy

12. Click Done. Verify the key is in the Allocated section.

13. Click Launch Instance

Step 4: Assign Floating IP

The VPN gateway requires a public IP for external clients to connect.

1. Navigate to Project > Compute > Instances
2. Click the dropdown arrow next to your VPN instance, then click Associate Floating IP

3. The Manage Floating IP Associations dialog appears

4. Click the + icon next to the IP address dropdown
5. In the Allocate Floating IP dialog:

• Description: vpn
• Click Allocate IP

6. Back in the associations dialog, click Associate

Record the floating IP address - this is the VPN endpoint your clients will connect to.

Step 5: Install and Configure WireGuard

Connect to the VPN gateway and install WireGuard.

Connect to the Instance

1ssh -i ~/.ssh/vpn.pem debian@YOUR_FLOATING_IP
Copy

Update the System

1sudo apt update && sudo apt upgrade -y && sudo reboot
Copy

Wait a minute, then reconnect:

1ssh -i ~/.ssh/vpn.pem debian@YOUR_FLOATING_IP
Copy

Install WireGuard

1sudo apt install -y wireguard
Copy

Enable IP Forwarding

1sudo nano /etc/sysctl.d/99-wireguard.conf
Copy

Add this line:

1net.ipv4.ip_forward=1
Copy

Save the file (Ctrl+X, then Y, then Enter), then apply:

1sudo sysctl --system
Copy

Generate Server Keys

1# Create WireGuard directory with secure permissions
2sudo install -m 700 -d /etc/wireguard
3
4# Generate the server private key
5sudo sh -c 'umask 077; wg genkey > /etc/wireguard/server.key'
6
7# Generate the server public key
8sudo sh -c 'wg pubkey < /etc/wireguard/server.key > /etc/wireguard/server.pub'
9
10# View the public key (you'll need this for client configuration)
11sudo cat /etc/wireguard/server.pub
Copy

Save the public key output - clients will need it.

Configure WireGuard Server

1sudo nano /etc/wireguard/wg0.conf
Copy

Paste this configuration:

1[Interface]
2Address = 10.100.0.1/24
3ListenPort = 51820
4PrivateKey = SERVER_PRIVATE_KEY_HERE
5
6PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -A FORWARD -o wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -s 10.100.0.0/24 -o ens3 -j MASQUERADE
7PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -D FORWARD -o wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -s 10.100.0.0/24 -o ens3 -j MASQUERADE
Copy

Replace SERVER_PRIVATE_KEY_HERE with your actual private key:

1sudo cat /etc/wireguard/server.key
Copy

Note: Verify your network interface name with ip address. If it's not ens3, update the PostUp and PostDown lines accordingly.

Set secure permissions:

1sudo chmod 600 /etc/wireguard/wg0.conf
Copy

Start WireGuard

1sudo systemctl enable --now wg-quick@wg0
Copy

Verify the service is running:

1sudo systemctl status wg-quick@wg0
2sudo wg
3ip addr show wg0
Copy

Step 6: Configure WireGuard Client

Install the WireGuard client on your device.

Generate Client Keys

On the client device (or on the server if you prefer to manage keys centrally):

1# Generate client keys
2wg genkey | tee client.key | wg pubkey > client.pub
Copy

Add Client to Server

On the VPN gateway server, edit the WireGuard configuration:

1sudo nano /etc/wireguard/wg0.conf
Copy

Add a [Peer] section for the client:

1[Peer]
2PublicKey = CLIENT_PUBLIC_KEY_HERE
3AllowedIPs = 10.100.0.2/32
Copy

Replace CLIENT_PUBLIC_KEY_HERE with the contents of client.pub.

Restart WireGuard to apply:

1sudo systemctl restart wg-quick@wg0
Copy

Configure the Client

Create a configuration file on your client device (e.g., vpn.conf):

1[Interface]
2PrivateKey = CLIENT_PRIVATE_KEY_HERE
3Address = 10.100.0.2/32
4
5[Peer]
6PublicKey = SERVER_PUBLIC_KEY_HERE
7Endpoint = YOUR_FLOATING_IP:51820
8AllowedIPs = 10.0.0.0/24, 10.100.0.0/24
9PersistentKeepalive = 25
Copy

Replace:

• CLIENT_PRIVATE_KEY_HERE with the contents of client.key
• SERVER_PUBLIC_KEY_HERE with the server's public key (from sudo cat /etc/wireguard/server.pub)
• YOUR_FLOATING_IP with the VPN gateway's floating IP

Import this configuration into your WireGuard client application and activate the connection.

Step 7: Test the VPN Connection

From the Client

Test connectivity to the VPN gateway:

1ping 10.100.0.1
Copy

Test connectivity to a cloud instance on the private network:

1ping 10.0.0.X
Copy

Replace X with the last octet of a server on the private cloud network.

Test a real service:

1ssh username@10.0.0.X
Copy

From the VPN Gateway

Check WireGuard status:

1sudo wg
Copy

A recent "latest handshake" timestamp confirms the tunnel is working.

Troubleshooting

Tunnel Won't Establish

Symptoms: WireGuard running but no handshake.

Check:

1. Security group allows UDP 51820
2. Client endpoint IP and port are correct
3. Public keys are correct on both sides

1# Check WireGuard status
2sudo wg
3
4# Check security group
5openstack security group rule list vpn-sg
Copy

Can Ping VPN Gateway But Not Cloud Instances

Symptoms: ping 10.100.0.1 works but ping 10.0.0.X fails.

Check:

1. IP forwarding is enabled on the VPN gateway
2. iptables NAT rules are active
3. Security groups on destination instances allow traffic from 10.100.0.0/24

1# Verify IP forwarding
2cat /proc/sys/net/ipv4/ip_forward
3# Should return: 1
4
5# Verify iptables rules
6sudo iptables -t nat -L -v
Copy

Security Group Considerations

Instances you want to access through the VPN need security group rules allowing traffic from the VPN network. If an instance only allows connections from 10.0.0.0/24, VPN clients (coming from 10.100.0.0/24) will be blocked.

Solution: Add 10.100.0.0/24 to the security group rules for instances that need VPN access.

Summary

Deploying a WireGuard VPN gateway on InMotion Cloud enables secure access to your cloud resources from anywhere. The key steps are:

1. Create a private network with external connectivity
2. Create a security group allowing WireGuard (UDP 51820) and SSH traffic
3. Deploy a Debian instance as the VPN gateway
4. Assign a floating IP for external access
5. Install and configure WireGuard with IP forwarding and NAT
6. Configure WireGuard clients with the server's public key and endpoint
7. Update security groups on other instances to allow VPN traffic

Once configured, you can securely access any instance on your private cloud network through the encrypted WireGuard tunnel.

Related Resources

• Creating and Managing Networks in OpenStack Horizon
• Managing Security Groups and Rules in OpenStack
• Allocating and Assigning Floating IPs in OpenStack
• WireGuard Official Documentation