WireGuard

In the Azure Portal, open Marketplace, search for WireGuard, select the SecureAnyCloud publisher entry and choose Create.

On the Networking tab, attach a network security group that allows inbound TCP 22 from your management IP range and inbound UDP 51820 from your peer client source IPs. If peers connect from the open internet, you can use 0.0.0.0/0, because the WireGuard handshake itself is the access control.

Do not open UDP 51820 to the world unless you accept that any internet host may probe the listener. WireGuard does not respond to handshakes from unknown peers, so this is safe in practice. You may still prefer to scope the rule to known client networks.

Choose Review + create, wait for validation, then choose Create. Deployment takes around two minutes.

Run these commands on your own workstation. They create the network, a network security group with SSH and WireGuard rules, and the VM:

RG="wireguard-prod" LOCATION="eastus" VM_NAME="wireguard-01" ADMIN_USER="azureuser" IMAGE_URN="sac1647283583153:wireguard-ubuntu-24-04:default:latest" SSH_KEY="$(cat ~/.ssh/id_rsa.pub)"
# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn "$IMAGE_URN"
az group create --name "$RG" --location "$LOCATION"
az network vnet create \
  --resource-group "$RG" \
  --name wg-vnet --address-prefix 10.96.0.0/16 \
  --subnet-name wg-subnet --subnet-prefix 10.96.1.0/24
az network nsg create --resource-group "$RG" --name wg-nsg
az network nsg rule create \
  --resource-group "$RG" --nsg-name wg-nsg \
  --name allow-ssh --priority 100 \
  --source-address-prefixes "<your-mgmt-cidr>" \
  --destination-port-ranges 22 --access Allow --protocol Tcp
az network nsg rule create \
  --resource-group "$RG" --nsg-name wg-nsg \
  --name allow-wireguard --priority 110 \
  --source-address-prefixes "<your-client-cidr-or-internet>" \
  --destination-port-ranges 51820 --access Allow --protocol Udp
az vm create \
  --resource-group "$RG" --name "$VM_NAME" \
  --image "$IMAGE_URN" \
  --size Standard_B2s --storage-sku StandardSSD_LRS \
  --admin-username "$ADMIN_USER" --ssh-key-values "$SSH_KEY" \
  --vnet-name wg-vnet --subnet wg-subnet --nsg wg-nsg \
  --public-ip-sku Standard

Connect to the VM as the administrator user:

ssh azureuser@<vm-ip>

wg-quick@wg0.service is already running. wireguard-firstboot.service has already generated the per-VM server keypair and written the public key to the credentials file.

Check the service status:

sudo systemctl status wg-quick@wg0.service --no-pager

The expected state is active (exited). wg-quick is a oneshot that brings the interface up and exits. Confirm the first-boot sentinel:

sudo test -f /var/lib/sac/data/wireguard-firstboot.done && echo FIRSTBOOT_DONE

Confirm the interface and listener:

ip -brief addr show wg0
sudo wg show

The wg show output reports the server public key (which you share with peers), the listening port (51820) and any peers. A fresh deployment has no peers.

First boot writes the server public key to a root-only file with mode 0600. Read the file with:

sudo cat /stage/scripts/wireguard-credentials.log

To print only the key, run:

sudo grep '^SERVER_PUBLIC_KEY=' /stage/scripts/wireguard-credentials.log | cut -d= -f2-

Share this public key, together with the VM's public Azure IP and UDP port 51820, with each peer device. The matching private key lives only in /etc/wireguard/wg0.conf and never leaves the VM.

On each client device that should connect, generate a fresh keypair locally. Generate keys on the client, not on the server. The client's private key must never leave the client device.

On a Linux client:

wg genkey | tee client-priv.key | wg pubkey > client-pub.key chmod 600 client-priv.key cat client-pub.key

On macOS or Windows, install the official WireGuard app from https://www.wireguard.com/install/. Choose Add Tunnel, then Add Empty Tunnel, and the app generates the keypair for you. Copy the displayed public key.

Send the client public key (and only the public key) to the server administrator.

Edit /etc/wireguard/wg0.conf on the WireGuard VM and append a [Peer] block per client. Pick a unique address for each peer in the 10.50.0.0/24 overlay. Skip 10.50.0.1, which is the server:

sudo tee -a /etc/wireguard/wg0.conf > /dev/null << 'PEER' [Peer]
# Alice's laptop PublicKey = <paste-client-public-key-here> AllowedIPs = 10.50.0.2/32 PEER

Reload the interface to pick up the new peer without dropping existing tunnels:

sudo wg-quick strip wg0 | sudo wg syncconf wg0 /dev/stdin

Or restart the service, which briefly drops other peers:

sudo systemctl restart wg-quick@wg0

Confirm that the new peer appears:

sudo wg show

Build the client config from the server's public key, the VM's public Azure IP and the address you assigned the client in Step 7. On a Linux client, save it at /etc/wireguard/wg0.conf:

[Interface] PrivateKey = <client-private-key> Address = 10.50.0.2/24 [Peer] PublicKey = <server-public-key-from-step-5> Endpoint = <vm-public-ip>:51820 AllowedIPs = 10.50.0.0/24 PersistentKeepalive = 25

To route all client internet traffic through the VPN (full-tunnel mode), set AllowedIPs = 0.0.0.0/0 instead of 10.50.0.0/24. Enable NAT on the server first (Step 11).

Bring the client tunnel up:

sudo wg-quick up wg0
sudo wg show

The client and the server should now show a latest handshake of 1 second ago and increasing transfer: byte counts.

The image installs these components:

• WireGuard kernel module: in-tree on Linux 5.6+
• wg userspace tool: /usr/bin/wg
• wg-quick wrapper: /usr/bin/wg-quick
• Server config: /etc/wireguard/wg0.conf
• Systemd unit: /etc/systemd/system/multi-user.target.wants/wg-quick@wg0.service
• First-boot script: /usr/local/sbin/wireguard-firstboot.sh
• First-boot service: /etc/systemd/system/wireguard-firstboot.service
• Credentials file: /stage/scripts/wireguard-credentials.log
• First-boot sentinel: /var/lib/sac/data/wireguard-firstboot.done
• IP forwarding sysctl: /etc/sysctl.d/99-wireguard.conf

Inspect the installed version:

wg --version

Check status:

sudo systemctl status wg-quick@wg0.service --no-pager sudo wg show

Stop, start or restart the service:

sudo systemctl stop wg-quick@wg0
sudo systemctl start wg-quick@wg0
sudo systemctl restart wg-quick@wg0

Reload config (no tunnel drop for unchanged peers):

sudo wg-quick strip wg0 | sudo wg syncconf wg0 /dev/stdin

View kernel-side log entries:

sudo journalctl -k --no-pager -n 50 | grep -i wireguard

Check IP forwarding (required for peer-to-peer routing):

cat /proc/sys/net/ipv4/ip_forward

The expected value is 1. If it ever resets, sudo sysctl -p /etc/sysctl.d/99-wireguard.conf re-applies it.

By default the SecureAnyCloud image runs as a private peer-to-peer overlay only. Peers reach each other, but not the wider internet through the VM. To make the VM an internet gateway, so that a client with AllowedIPs = 0.0.0.0/0 routes all its traffic through it, uncomment the PostUp and PostDown lines in /etc/wireguard/wg0.conf:

sudo sed -i 's|^#PostUp = iptables|PostUp = iptables|' /etc/wireguard/wg0.conf
sudo sed -i 's|^#PostDown = iptables|PostDown = iptables|' /etc/wireguard/wg0.conf

Confirm that eth0 is the real WAN interface by running ip route show default. Replace it if your VM uses a different NIC name. Then restart the service:

sudo systemctl restart wg-quick@wg0
sudo iptables -t nat -L POSTROUTING -n

The output should show a MASQUERADE rule on the WAN interface. Clients with AllowedIPs = 0.0.0.0/0 now egress through the VM's public Azure IP.

Peer never gets a handshake

• Confirm that the client PublicKey in wg0.conf exactly matches cat client-pub.key on the client, with no trailing newline and no whitespace.
• Confirm that the client Endpoint is the VM's public Azure IP, not the private VNet IP.
• Confirm that the NSG allows inbound UDP 51820 from the client's source IP.
• Confirm that UDP is not blocked at the client's network egress. Some captive portals block all UDP except 53 and 443.
• Run sudo tcpdump -ni eth0 udp port 51820 on the server while the client tries to connect. You should see inbound packets.

Handshake succeeds but no traffic flows

• Confirm IP forwarding. cat /proc/sys/net/ipv4/ip_forward should print 1.
• Confirm that the client's AllowedIPs covers the destination: 10.50.0.0/24 for the overlay, or 0.0.0.0/0 for full-tunnel.
• For full-tunnel, confirm that the Step 11 NAT rules are active with sudo iptables -t nat -L POSTROUTING -n.

wg-quick up wg0 fails with "RTNETLINK: File exists"

• The interface is already up. Run sudo wg show wg0 to confirm, and sudo wg-quick down wg0 && sudo wg-quick up wg0 to reset it.

Lost the server private key

• You cannot recover the private key. Generate a new server keypair (wg genkey | tee /etc/wireguard/server-priv.key | wg pubkey), update the PrivateKey in /etc/wireguard/wg0.conf and restart wg-quick@wg0. Then distribute the new server public key to every peer. Each peer must update its [Peer] PublicKey = line.

• Treat the VM like a bastion. The WireGuard server's private key in /etc/wireguard/wg0.conf (mode 0600 root) is the master credential. If an attacker gains root on the VM, they can impersonate the entire VPN.
• Generate client keys on the client, never on the server. The server should only ever see client public keys.
• Restrict each peer's AllowedIPs to the smallest CIDR you need on the server side. 10.50.0.2/32 for a single peer is far safer than 10.50.0.0/24, which would let one compromised peer impersonate any other.
• Use PersistentKeepalive = 25 on clients behind NAT to keep the UDP NAT mapping alive.
• Rotate keys if a peer device is lost or compromised. Remove the [Peer] block from the server wg0.conf and reload.
• Monitor wg show for stale peers. Peers with no recent handshake are inactive and should be removed.
• Pair with Azure NSG flow logs if you need an audit trail of UDP 51820 source IPs.

WireGuard is licensed under the GPLv2 (kernel module) and the MIT/GPLv2 dual license (userspace wg/wg-quick tools). There is no per-peer, per-tunnel or per-server fee for any WireGuard component or for the upstream protocol.

SecureAnyCloud provides commercial support for this image, separate from the upstream project.

• Email: sales@secureanycloud.com
• Website: secureanycloud.com
• Support hours: 24/7 with guaranteed 24 hour response SLA

Deploy on Azure

Launch WireGuard on Ubuntu 24.04 with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure

Launch WireGuard VPN on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Find WireGuard on AWS Marketplace, published by SecureAnyCloud. Choose Continue to Subscribe, then Continue to Configuration and Continue to Launch.

Select the Ubuntu 24.04 delivery option, your instance type (m5.large) and your key pair. Choose a security group that allows TCP 22 for administration plus UDP 51820 from the client networks you want to serve.

Connect over SSH with your EC2 key pair. For Ubuntu 24.04, the login user is ubuntu:

ssh -i your-key.pem ubuntu@<public-ip>

On first boot, the image generates a per-instance Curve25519 server keypair and writes /etc/wireguard/wg0.conf (mode 0600, root only). It resolves the instance public IP through EC2 instance metadata for the connection note, and starts wg-quick@wg0. This completes within a minute.

Confirm that the tunnel is active and listening:

sudo systemctl start wg-quick@wg0 2>/dev/null || true sleep 1
sudo systemctl is-active wg-quick@wg0
sudo wg show wg0 ip -brief addr show wg0

The service reports active. wg show reports the listening port 51820 and this instance's server public key, and the wg0 interface carries 10.50.0.1/24.

The per-instance server public key and connection details live in a root-only file. The server private key never leaves /etc/wireguard/wg0.conf, and this file does not show it.

sudo cat /stage/scripts/wireguard-credentials.log

The file holds SERVER_PUBLIC_KEY, the SERVER_ENDPOINT (this instance's public IP and UDP 51820), the server VPN address (10.50.0.1) and the overlay subnet (10.50.0.0/24). These values are unique to this instance. First boot generates them, and they are never baked into the image.

On the client device (your laptop, phone or another server), generate a keypair. On Linux, run:

wg genkey | tee client-privkey | wg pubkey > client-pubkey

Send the client public key to the server. On the server, add a [Peer] block to /etc/wireguard/wg0.conf, one per device, with a unique AllowedIPs address in the overlay:

[Peer] PublicKey = <client-public-key> AllowedIPs = 10.50.0.2/32

Apply the change:

sudo systemctl reload wg-quick@wg0

Then, on the client, write a WireGuard configuration that points at this server. Use the SERVER_PUBLIC_KEY and SERVER_ENDPOINT from Step 4:

[Interface] PrivateKey = <client-private-key> Address = 10.50.0.2/24 [Peer] PublicKey = <server-public-key> Endpoint = <server-public-ip>:51820 AllowedIPs = 10.50.0.0/24 PersistentKeepalive = 25

Bring the client tunnel up. On Linux, run wg-quick up <config>. On macOS, Windows, iOS or Android, import the file into the WireGuard app. To route all of the client's traffic through the VPN, set AllowedIPs = 0.0.0.0/0 on the client instead.

Once a client connects, wg show lists the peer with a recent handshake and transfer counters. This proves a real encrypted tunnel, not just a bound listener:

sudo wg show wg0

A connected peer appears under the interface with its public key, latest handshake a few seconds ago, and non-zero transfer figures.

By default WireGuard runs as a private peer-to-peer overlay. Peers can reach each other and the server, but not the wider internet through the server. To make the instance an internet gateway for your clients, uncomment the two NAT lines in /etc/wireguard/wg0.conf. Replace eth0 with the real WAN interface from ip route show default:

PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

Restart the tunnel with sudo systemctl restart wg-quick@wg0, then set AllowedIPs = 0.0.0.0/0 on the client. The client's traffic now egresses through the instance. IP forwarding is already enabled in the image.

Per-instance server key. The Curve25519 server private key is generated on first boot and lives only in /etc/wireguard/wg0.conf (0600 root:root). It is never baked into the image, so no two customer instances share a server identity.

Server-only by default. The image ships with no peers. It is not an open endpoint, because a device can connect only once you add its public key as a [Peer].

The overlay is 10.50.0.0/24 with the server at 10.50.0.1. Give each client device a unique /32 address (10.50.0.2, 10.50.0.3, ...).

Firewall. In the instance security group, open UDP 51820 to the client networks you want to serve. Keep the rules as tight as your use case allows.

Managing the tunnel. After you edit the config, reload with sudo systemctl reload wg-quick@wg0, or restart with sudo systemctl restart wg-quick@wg0. The service is enabled at boot.

Check the service status:

sudo systemctl status wg-quick@wg0 --no-pager

You manage the tunnel entirely through systemd and the wg CLI. There is no web interface. You configure WireGuard through the wg0.conf file and the wg/wg-quick tools.