WireGuard VPN on a $5 VPS

WireGuard gives you a private exit on clean NoctisNode IP space in minutes. Everything below assumes Ubuntu 24.04 or Debian 12 — both are one-click images in the order flow.

Install and enable

apt update && apt install -y wireguard
systemctl enable wg-quick@wg0

Server config

Generate keys with wg genkey | tee server.key | wg pubkey. Enable forwarding permanently in /etc/sysctl.conf rather than relying on PostUp if you prefer.

[Interface]
Address = 10.66.0.1/24, fd42::1/64
ListenPort = 51820
PrivateKey = <server-private-key>
PostUp = sysctl -w net.ipv4.ip_forward=1; ip6tables -t nat -A POSTROUTING -s fd42::/64 -o eth0 -j MASQUERADE; iptables -t nat -A POSTROUTING -s 10.66.0.0/24 -o eth0 -j MASQUERADE
PostDown = sysctl -w net.ipv4.ip_forward=0

Add a peer

Each peer gets a /32 in IPv4 and a /128 in IPv6. Restart with systemctl restart wg-quick@wg0 and connect from the client using the matching AllowedIPs = 0.0.0.0/0, ::/0 to route all traffic through the VPS.

[Peer]
PublicKey = <client-public-key>
AllowedIPs = 10.66.0.2/32, fd42::2/128

Hardening defaults

• ▹Open only 51820/udp plus SSH in the firewall; keep SSH key-only.
• ▹Rotate peer keys when a device leaves your control — deleting a peer block is instant.
• ▹IPv6 is included on every NoctisNode plan; use it rather than tunneling IPv4-only traffic.