How to Connect to Your VPS Through WireGuard

WireGuard makes an encrypted tunnel between your own PC and your VPS. Remote Desktop (SSH on Ubuntu) then goes through the tunnel. When that works, you lock Remote Desktop to the tunnel, so bots on the internet cannot reach it.

How the Tunnel Works

• The VPS waits for the tunnel on UDP port 51820. Its tunnel address is 10.8.0.1.
• Your own PC connects to the VPS's public IP address. Its tunnel address is 10.8.0.2.
• Only traffic to 10.8.0.1 goes through the tunnel. Your PC's other internet traffic and all of the VPS's own traffic stay as they are.
• Each side has a private key, which never leaves it, and a public key, which you copy to the other side.

If your home network already uses addresses that start with 10.8.0, choose another range everywhere below, such as 10.77.0.

Before You Start

• Make sure you can connect to the VPS with Remote Desktop (or SSH) the usual way. Keep that way until the tunnel works.
• In your QuantVPS dashboard, open Control Panel › Connection details. Note the IP address. If it ends in a colon and a number, for example 203.0.113.10:24817, the part before the colon is the VPS's public IP address and the number is your Remote Desktop port. No number means port 3389.

Step 1: Make the Tunnel on Your Own PC

1. On your own PC, download WireGuard from wireguard.com/install and install it. On a Mac, install WireGuard from the Mac App Store. Its buttons can have slightly different names.
2. Open WireGuard. Click the arrow next to Add Tunnel, then click Add empty tunnel… in its menu. WireGuard makes a new key pair.
3. In Name, type quantvps.
4. Copy the Public key and keep it in a note. You need it on the VPS in Step 2.
5. Click Save. You finish this tunnel in Step 3.

Step 2: Set Up the VPS

On a Windows VPS

1. Connect to the VPS with Remote Desktop the usual way.
2. On the VPS, download WireGuard from wireguard.com/install and install it.
3. Open WireGuard. Click the arrow next to Add Tunnel, then click Add empty tunnel… in its menu.
4. In Name, type quantvps. Copy the Public key into your note. This is the VPS's public key.
5. Keep the PrivateKey line WireGuard filled in. Add the other lines, so the configuration reads:

   [Interface]
   PrivateKey = (the key WireGuard filled in)
   ListenPort = 51820
   Address = 10.8.0.1/24
   
   [Peer]
   PublicKey = (your own PC's public key from Step 1)
   AllowedIPs = 10.8.0.2/32

6. Click Save.
7. Open the tunnel's port in Windows Firewall. Click Start, type PowerShell, right-click Windows PowerShell, click Run as administrator, and run:

   New-NetFirewallRule -DisplayName "WireGuard (UDP 51820)" -Direction Inbound -Protocol UDP -LocalPort 51820 -Action Allow

8. In WireGuard, select the quantvps tunnel and click Activate.

WireGuard runs an active tunnel as a Windows service. It starts again by itself after the VPS restarts, with nobody signed in.

On an Ubuntu VPS

1. Connect to the VPS with SSH the usual way.
2. Install WireGuard and make the VPS's keys. The last command shows the VPS's public key: copy it into your note.

   sudo apt update
   sudo apt install wireguard
   sudo -i
   cd /etc/wireguard
   umask 077
   wg genkey > vps.key
   wg pubkey < vps.key > vps.pub
   cat vps.pub

3. Show the private key with cat vps.key. Then make the tunnel's file with nano /etc/wireguard/wg0.conf:

   [Interface]
   PrivateKey = (the VPS's private key from vps.key)
   ListenPort = 51820
   Address = 10.8.0.1/24
   
   [Peer]
   PublicKey = (your own PC's public key from Step 1)
   AllowedIPs = 10.8.0.2/32

4. Save with Ctrl + O, then Enter, and close with Ctrl + X.
5. Start the tunnel now and at every restart:

   systemctl enable --now wg-quick@wg0

6. If ufw status says Status: active, open the tunnel's port with ufw allow 51820/udp. A new Ubuntu VPS has no firewall turned on.
7. Type exit to leave the root shell.

Step 3: Finish the Tunnel on Your Own PC

1. On your own PC, open WireGuard, select the quantvps tunnel and click Edit.
2. Keep the PrivateKey line. Add the other lines, so the configuration reads:

   [Interface]
   PrivateKey = (the key WireGuard filled in)
   Address = 10.8.0.2/32
   
   [Peer]
   PublicKey = (the VPS's public key from Step 2)
   AllowedIPs = 10.8.0.1/32
   Endpoint = 203.0.113.10:51820
   PersistentKeepalive = 25

   In Endpoint, use your VPS's public IP address and port 51820, never the Remote Desktop port. PersistentKeepalive keeps the tunnel open through your home router.
3. Click Save, then click Activate.
4. A line Latest handshake appears with a time of a few seconds ago. The tunnel works.

Step 4: Connect Through the Tunnel

• Windows VPS: open Remote Desktop Connection (Windows) or Windows App (Mac). As the computer, type 10.8.0.1. If your port is not 3389, add a colon and the port: 10.8.0.1:24817. Sign in with the username and password from Connection details, as usual.
• Ubuntu VPS: connect with ssh root@10.8.0.1, with the username from Connection details.

If the tunnel shows a handshake but Remote Desktop does not answer on 10.8.0.1, Windows Firewall on the VPS blocks Remote Desktop on the tunnel. Windows usually treats the tunnel as a Public network. In Windows Defender Firewall with Advanced Security, check that the Remote Desktop rules for your port apply to the Public profile.

Step 5: Lock Remote Desktop to the Tunnel

On a Windows VPS, QuantVPS Detect+ locks Remote Desktop from your dashboard. After the lock, Remote Desktop answers only the tunnel's addresses. The lock does not touch WireGuard's port 51820.

1. Stay connected to the VPS through the tunnel.
2. Sign in to your QuantVPS dashboard. If you have more than one VPS, choose it in the Selected server menu at the top.
3. Click Detect+ in the sidebar. In the Detect+ menu, click Remote Desktop, then click Settings under it.
4. In the Lock Remote Desktop to my addresses card, click Use my WireGuard network. Type 10.8.0.0/24 in the box that opens and click Add.
5. Click Lock.
6. Within 10 minutes, disconnect Remote Desktop and connect again to 10.8.0.1. The card shows Locked to your addresses.

If nobody signs in from an allowed address within 10 minutes, the VPS undoes the lock by itself. From now on, connect through the tunnel. If Lock is greyed out, the card says why, for example while Detect+ updates itself.

On an Ubuntu VPS, Detect+ cannot lock SSH yet. Use ufw in an SSH session through the tunnel, and keep that session open. This closes every port that answers the internet, not only SSH: allow any other port you need first.

sudo ufw allow 51820/udp
sudo ufw allow in on wg0
sudo ufw default deny incoming
sudo ufw default allow outgoing

Before you turn ufw on, make sure no rule still lets SSH in from the internet. Run sudo ufw show added. It lists your rules, also while ufw is off. If a line has 22 or OpenSSH, delete that rule: type sudo ufw delete and the words after ufw on that line, for example sudo ufw delete allow OpenSSH or sudo ufw delete allow 22/tcp. Then turn ufw on:

sudo ufw enable

Then open a second SSH session through the tunnel. If it does not connect, run sudo ufw disable in the first one. Detect+ cannot see ufw yet, so turn off the Remote Desktop not answering alert (on Ubuntu, it watches SSH) in Detect+ › Settings › Alerts, or it emails you.

If the Tunnel Stops Working

• No Latest handshake on your own PC. Check the Endpoint address and port, the UDP 51820 rule on the VPS, and that each side has the other side's public key, not its own.
• Your network blocks it. WireGuard uses UDP only. Some work, hotel and public networks block it. Connect from another network, or use Tailscale, which can still connect through such networks.
• The VPS has a new IP address after a move to another location, or a new system after a reinstall. Set up the VPS side again (Step 2) and change Endpoint on your own PC.

To get back in while Remote Desktop is locked, open Detect+ › Remote Desktop › Settings in your dashboard. In the Lock Remote Desktop to my addresses card, click Add my address (Detect+ saves it at once) or Unlock. After about a minute, connect with your usual RDP file and fix the tunnel. Then remove your address and click Save addresses, or lock again. If Detect+ has not reported for over 15 minutes, use the console: see How to Access Your VPS Using Console (VNC).

Further Reading

WireGuard's Quick Start and Installation pages, the wg-quick manual, Ubuntu's WireGuard VPN common tasks, and Microsoft's New-NetFirewallRule.

Related

• How to Connect to Your VPS Through Tailscale
• How to Secure Remote Desktop on Your VPS
• How to Connect to Ubuntu/Linux via SSH

Need Assistance?

Our support team is available 24/7. If you have any questions or run into issues, open a support ticket from your QuantVPS dashboard and we'll get back to you as quickly as possible.