# WireGuard VPN for Private Cloud Networking: Simple, Fast, Secure

> How to set up WireGuard VPN to create a private overlay network between cloud servers and development machines — faster than OpenVPN with a fraction of the configuration.

URL: https://www.matthewswong.com/en/blog/wireguard-vpn-cloud/

- Author: Matthews Wong (https://www.matthewswong.com/en/about/)
- Published: 2025-06-10
- Updated: 2026-10-17
- Category: DevOps

WireGuard achieves TCP throughput of 210 Mbps versus OpenVPN's 110 Mbps in comparable cloud environments — nearly 2x the throughput with significantly lower CPU usage and packet loss. More importantly, WireGuard's codebase is approximately 4,000 lines — roughly 1% the size of OpenVPN or IPsec stacks — making it dramatically easier to audit and maintain. Replacing an OpenVPN setup between cloud servers with WireGuard can noticeably shorten connection establishment time.

## What WireGuard Is and Is Not

WireGuard is a modern VPN protocol that runs in the Linux kernel (kernel 5.6+ includes it natively). It provides encrypted tunnels between hosts using Curve25519 for key exchange, ChaCha20-Poly1305 for encryption, and BLAKE2s for hashing. It is not a full VPN service solution — there is no user management, no web UI, no certificate authority. WireGuard is a lean cryptographic tunnel: you configure public and private key pairs and peer lists, and it creates encrypted routes between hosts. Tools like wg-easy (Docker-based), Tailscale, and Headscale add the management layer on top.

### Key Use Cases

WireGuard excels at: site-to-site networking between cloud servers (private database access without exposing ports publicly), remote access for developers to staging/production environments (SSH through WireGuard instead of exposing SSH to the internet), connecting DigitalOcean Droplets in different regions over a private overlay, and creating a hub-and-spoke network where development machines connect to a central VPS that has access to private cloud resources. A Singapore DigitalOcean Droplet works well as the WireGuard hub, with office machines and GCP instances as spokes.

### WireGuard vs OpenVPN Performance

In VMware environments, WireGuard demonstrated 210 Mbps TCP throughput versus OpenVPN's 110 Mbps — a 91% improvement. Packet loss was 12% for WireGuard versus 47% for OpenVPN under identical simulated network conditions. On gigabit networks, WireGuard achieves near-wire speed (7.88 Gbits/sec). WireGuard uses UDP exclusively, enabling kernel-level batching and offloads (GRO/GSO) that OpenVPN's TCP mode cannot leverage.

> When running WireGuard between DigitalOcean Singapore and GCP Asia-Southeast1, use PersistentKeepalive = 25 for any peer behind NAT — most office connections and development machines. Without it, the WireGuard tunnel silently goes idle after 3 minutes of no traffic and takes 1-2 seconds to re-establish on the next packet, causing dropped database connections and WebSocket disconnects. PersistentKeepalive sends a UDP keepalive every 25 seconds to keep NAT mappings alive.

## Setting Up a Hub-and-Spoke Network

The most useful WireGuard topology for a small team is hub-and-spoke: one VPS acts as the hub with a static public IP, and all clients (office machines, laptops, CI/CD runners) are spokes. Each spoke has a WireGuard interface with routes for the private subnet going through the hub. The hub has IP forwarding enabled and a WireGuard interface listening on UDP port 51820. Clients connect to the hub's public IP and reach private resources (databases, internal APIs) through the encrypted tunnel.

### Integrating with Cloud Firewall

On DigitalOcean, configure the Cloud Firewall to allow UDP 51820 from any IP (WireGuard clients may have dynamic IPs). Once peers are connected through WireGuard, restrict all other sensitive ports (PostgreSQL 5432, Redis 6379, NestJS 3000) to the WireGuard private subnet only — never exposing them to the internet. This is the correct production posture: only WireGuard and Nginx (80/443) are accessible from the internet, everything else is internal.

> **Lost Configuration Means Lost Access**

> WireGuard has no central authority or password recovery. If you lose the private key for a peer, that peer cannot reconnect — you must generate a new key pair, update the hub's configuration with the new public key, and reconnect. I keep WireGuard configurations in an encrypted 1Password vault and in our private GitLab repository (with private keys stored only in the vault, never in git). Document your WireGuard setup thoroughly — debugging a mis-configured WireGuard tunnel from a locked-out state is painful.

## Monitoring and Troubleshooting

WireGuard provides minimal built-in diagnostics, which is both a strength (simplicity) and a weakness (troubleshooting). Check peer status with wg show — it displays each peer's public key, endpoint, allowed IPs, last handshake time, and bytes transferred. A last handshake time older than 3 minutes indicates the peer is not connected. For connectivity issues: check that UDP 51820 is allowed in the firewall on both sides, verify the peer's public key is correct, and ensure AllowedIPs includes the private subnet you are trying to reach.

## wg-easy: Adding a UI Layer

For teams that need a UI for peer management, wg-easy is a Docker-based WireGuard management interface. Run it as a Docker container on your hub VPS: it manages WireGuard configuration, generates QR codes for mobile clients, provides a web UI for adding/removing peers, and shows connection status. wg-easy is significantly simpler than Tailscale (which requires an account and uses a proprietary coordination server) and gives you full control of your VPN infrastructure.

## My Production WireGuard Setup

An example WireGuard setup: DigitalOcean Singapore Droplet (2 vCPU / 2GB) as the hub running wg-easy in Docker, with WireGuard subnet 10.8.0.0/24. Connected peers: 2 GCP Asia-Southeast1 instances (PostgreSQL and Redis, private IPs only), 3 DigitalOcean Droplets (NestJS app servers), an office static IP, and a development laptop. All inter-server communication goes through the WireGuard tunnel. Only Nginx on port 80/443 and WireGuard on UDP 51820 are publicly accessible. A layout like this needs very little maintenance once it is running.

## Sources & Further Reading

- WireGuard — Official Website and Performance Data
- MDPI — Empirical Performance Analysis WireGuard vs OpenVPN in Cloud Environments
- Contabo — Maximizing WireGuard Performance Advanced Tuning and Benchmarking

## Source links

- https://www.wireguard.com/performance/
- https://www.mdpi.com/2073-431X/14/8/326
- https://contabo.com/blog/maximizing-wireguard-performance/

## FAQ

### How does WireGuard compare to OpenVPN in terms of performance?

In comparable cloud environments, WireGuard achieves 210 Mbps TCP throughput versus OpenVPN's 110 Mbps — nearly a 2x improvement. Packet loss under identical simulated conditions is also far lower: 12% for WireGuard versus 47% for OpenVPN. WireGuard uses UDP exclusively, enabling kernel-level batching and offloads (GRO/GSO) that OpenVPN's TCP mode cannot leverage.

### Why is PersistentKeepalive important for WireGuard peers behind NAT?

Without PersistentKeepalive, a WireGuard tunnel silently goes idle after 3 minutes of no traffic and takes 1–2 seconds to re-establish on the next packet, causing dropped database connections and WebSocket disconnects. Setting PersistentKeepalive = 25 sends a UDP keepalive every 25 seconds to keep NAT mappings alive. This setting is essential for any peer on an office or development machine connection.

### What is WireGuard NOT, and when should you add a tool like wg-easy on top?

WireGuard is a lean cryptographic tunnel — it has no user management, no web UI, and no certificate authority. It only handles encrypted routes between hosts using public and private key pairs. Tools like wg-easy (Docker-based) add a web interface for peer management, QR code generation for mobile clients, and connection status visibility without requiring proprietary coordination servers like Tailscale.

### How should cloud firewall rules be structured when using WireGuard?

Only UDP port 51820 (WireGuard) and Nginx on ports 80/443 should be publicly accessible. All sensitive ports — PostgreSQL 5432, Redis 6379, NestJS 3000 — should be restricted to the WireGuard private subnet only. On DigitalOcean, the Cloud Firewall should allow UDP 51820 from any IP since WireGuard clients may have dynamic addresses.

### What happens if you lose a WireGuard private key, and how should you back up your configuration?

If you lose a peer's private key, that peer cannot reconnect — WireGuard has no central authority or password recovery. You must generate a new key pair, update the hub's configuration with the new public key, and reconnect. The recommended approach is to store WireGuard configurations in an encrypted vault (such as 1Password) and in a private Git repository, keeping private keys only in the vault and never in git.

---

- HTML version: https://www.matthewswong.com/en/blog/wireguard-vpn-cloud/
- Bahasa Indonesia: https://www.matthewswong.com/id/blog/wireguard-vpn-cloud/
- Site index for agents: https://www.matthewswong.com/llms.txt
- Sitemap: https://www.matthewswong.com/sitemap.xml
- API description (OpenAPI): https://www.matthewswong.com/openapi.json