Why use WireGuard on Proxmox?

WireGuard brings several advantages for Proxmox users:

• Simplicity and performance: small codebase, fast cryptography, minimal CPU and memory overhead.
• Easy peer configuration: straightforward key-based authentication and compact configuration files.
• Flexible topology: connect Proxmox host, VMs, containers, and remote clients in a single mesh or hub-and-spoke network.
• Strong security defaults: modern crypto, simple rules, and easy to audit.

However, there are considerations:

• You may want to avoid mixing host-level VPNs with per-VM routing policies unless you have a clear topology plan.
• Firewall rules (ufsufw, nftables) should be updated to allow WireGuard traffic (ports and protocols) as needed.
• Keep WireGuard cryptography and kernel module support up to date on the Proxmox host.

Prerequisites and planning

Before starting, gather a few details:

• Proxmox VE version that supports WireGuard in kernel (most recent Proxmox releases do).
• A stable public IP or accessible domain for the host if you want remote peers to connect directly.
• Network range planning: decide on a dedicated VPN subnet (for example, 10.99.0.0/24) and ensure it doesn’t overlap with existing LANs.
• Access to the Proxmox host with root or sudo privileges.

Key tasks:

• Ensure the Proxmox host can reach the internet to install packages.
• Decide whether to run WireGuard at the host level or inside a VM/CT. Host-level is simplest for cluster-wide VPNs. Per-VM VPNs give you per-VM isolation.
• Prepare a pair of private/public keys for each peer (server and clients).

Installing WireGuard on the Proxmox host

Steps you’ll typically follow: WireGuard on OPNsense: How to implement VPN securely and efficiently

• Update the system: apt update && apt upgrade -y
• Install WireGuard tools: apt install wireguard-tools linux-headers-$(uname -r) -y
• Load the WireGuard kernel module if needed: modprobe wireguard
• Enable and start a simple service or manually bring up wg0 with a configuration file

A sample set of commands:

• apt update
• apt install wireguard-tools linux-headers-$(uname -r) -y
• modprobe wireguard
• Create /etc/wireguard/wg0.conf with [Interface] and [Peer] sections
• Bring up: wg-quick up wg0
• Enable on boot: systemctl enable wg-quick@wg0

Note: On some Proxmox setups, you may prefer to manage WireGuard via systemd units or use wg-quick for simplicity. You can also integrate with the firewall (iptables/nftables) to allow traffic through the VPN.

Creating keys and basic configuration

WireGuard uses simple key-based authentication:

• Generate keys on the host:
• umask 077
• wg genkey | tee privatekey | wg pubkey > publickey
• Store them securely, and reference them in wg0.conf.

Example server wg0.conf (basic):

• [Interface] WireGuard on pfSense: a practical guide to setting up and using WireGuard on pfSense

• Address = 10.99.0.1/24

• ListenPort = 51820

• PrivateKey =

• PostUp = iptables -A FORWARD -i wg0 -j ACCEPT. Iptables -t nat -A POSTROUTING -o -j MASQUERADE

• PostDown = iptables -D FORWARD -i wg0 -j ACCEPT. Iptables -t nat -D POSTROUTING -o -j MASQUERADE WireGuard on TrueNAS

• [Peer]

• PublicKey =

• AllowedIPs = 10.99.0.2/32

Example client wg0.conf:

• [Interface]
• Address = 10.99.0.2/24
• PrivateKey =
• DNS = 1.1.1.1
• [Peer]
• PublicKey =
• Endpoint = your-proxmox-host:51820
• AllowedIPs = 0.0.0.0/0,::/0

A few tips: WireGuard on Docker

• Use distinct IPs for each client (e.g., 10.99.0.2, 10.99.0.3, etc.).
• Keep the server’s ListenPort consistent and open it in the firewall if you’re behind NAT.
• Consider using Dynamic DNS if your Proxmox host doesn’t have a fixed IP.

Deploying WireGuard inside a VM or container

If you prefer isolating VPN handling from the host, you can install WireGuard inside a VM or LXC container:

• Create a dedicated VM/CT for VPN duties or reuse on-demand VMs.
• Install the same WireGuard packages inside the VM/CT.
• Configure wg0 there with the same peer layout.
• Route traffic from other VMs through the VPN by adjusting routing tables or using the VPN host as a gateway.

Routing considerations:

• For VM-to-VM VPN, set AllowedIPs on peers to cover internal subnets, and adjust routes accordingly.
• For remote access, ensure firewall/NAT rules permit traffic from wg0 to your internal networks.

Pros of a VM/CT approach:

• Clear separation of concerns.
• Easier to back up and snapshot VPN state along with the VM.

Cons:

• Slightly higher overhead.
• More complex to maintain if you’re not comfortable with multiple network interfaces.

Firewall, NAT, and routing considerations

WireGuard itself is straightforward, but you must configure the surrounding network properly: WireGuard on Ubuntu

• Allow UDP on the WireGuard port (default 51820) through the host firewall.
• If you use NAT (shared internet connection for VPN clients), set POSTROUTING Masquerade on the host.
• Enable IP forwarding on the host:
• sysctl -w net.ipv4.ip_forward=1
• echo net.ipv4.ip_forward=1 >> /etc/sysctl.d/99-sysctl.conf
• If you’re routing VPN clients into the Proxmox LAN, add appropriate routes on the client side and ensure the server knows how to reach internal subnets.
• Use nftables or ufw to create strict rules for the VPN interface (wg0) and to prevent leaks.

Sample nftables rules (simplified):

• table inet filter {
• chain input { type ifaddr. Policy drop; }
• chain forward { type filter hook forward priority 0. Policy drop; }
• chain output { type route hook output priority 0; }

• Allow traffic on wg0

• add iifname wg0 oifname eth0 accept
• }

Monitoring:

• wg show to view peers and transfer statistics
• ip -4 addr show to verify wg0 IP assignments
• tail -f /var/log/syslog or journalctl -u wg-quick@wg0 to monitor startup messages

A small comparison: host-level VPN vs. VM/CT VPN

Tips for choosing:

• If you want quick remote access to your Proxmox host for administration, host-level is ideal.
• If you need strict isolation between VPN traffic and your virtualization workloads, run WireGuard inside a VM/CT.
• For a hybrid setup, run the server on the host and clients in VMs/containers, connecting clients to the server or to individual peers.

Common pitfalls and troubleshooting tips

• Port forwarding and NAT: If you’re behind NAT, you must forward UDP 51820 (or your chosen port) to the Proxmox host.
• Key management: Keep private keys secure. Rotate keys if you suspect compromise and update peer configs accordingly.
• DNS leakage: If you don’t want DNS to leak, set DNS in client config to a trusted resolver (e.g., 1.1.1.1) and verify with test queries.
• Firewall conflicts: Ensure the WireGuard interface is allowed in your firewall rules and no conflicting rules block tun interfaces.
• Persistent rules: If you reboot and the VPN doesn’t come up, verify that wg-quick@wg0 is enabled on boot and that crontabs or systemd units aren’t overwriting configurations.

Practical deployment example: a small, working setup

• Server:
• Address: 10.99.0.1/24
• ListenPort: 51820
• Peer: client1 10.99.0.2/32
• Client1:
• Address: 10.99.0.2/24
• Peer server: Endpoint = proxmox.example.com:51820
• Firewall:
• UDP 51820 open to the Proxmox host
• NAT masquerade on the external interface for 10.99.0.0/24
• Routing:
• Client1 AllowedIPs = 0.0.0.0/0,::/0 to send all traffic through VPN
• Server PostUp = iptables rules for forwarding and Masquerade

This example provides a minimal, functional VPN that routes all client traffic through the Proxmox host, giving you secure remote access to your network.

Final recommendations

• Start with a host-level WireGuard setup on Proxmox if you’re new to VPNs. It’s the simplest path to a working VPN.
• Move to a VM/CT-based deployment if you need stricter isolation or you want to centralize VPN management per-VM.
• Document your topology: who connects, what subnets exist, and how routes should flow. This makes future changes safer and easier.
• Keep your Proxmox host and WireGuard packages up to date, and monitor traffic to detect unusual activity.
• Consider implementing a small, scripted deployment for generating keys and peer configurations to scale beyond a single client.

If you’d like, I can tailor this guide to your exact Proxmox version, provide exact commands for your network layout, or help you draft a complete wg0.conf and per-peer configurations for a multi-peer setup. WireGuard on Windows Server: a practical guide to setting up and managing WireGuard on Windows Server