WireGuard VPN for a GPU Server

Tailscale is convenient but it is a SaaS – if their coordination service has an outage, peering setup can stall. Self-hosted WireGuard gives you the same VPN capability with full control on your dedicated GPU server.

Contents

• Install
• Server config
• Client config
• Routing and DNS

Install

sudo apt install wireguard
wg genkey | tee server_private.key | wg pubkey > server_public.key

Server

/etc/wireguard/wg0.conf:

[Interface]
Address = 10.10.0.1/24
ListenPort = 51820
PrivateKey = <server_private.key>

[Peer]
# laptop 1
PublicKey = <laptop1_public_key>
AllowedIPs = 10.10.0.2/32

[Peer]
# laptop 2
PublicKey = <laptop2_public_key>
AllowedIPs = 10.10.0.3/32

Start:

sudo systemctl enable --now wg-quick@wg0

Open UDP port 51820 in your firewall.

Clients

On each laptop, generate keypair, create a config:

[Interface]
Address = 10.10.0.2/32
PrivateKey = <laptop_private_key>

[Peer]
PublicKey = <server_public_key>
Endpoint = gpu-server.gigagpu.com:51820
AllowedIPs = 10.10.0.0/24
PersistentKeepalive = 25

On macOS or Windows use the WireGuard app; on iOS/Android use the official app with QR code.

Routing

Inside the VPN, the GPU server is 10.10.0.1. SSH, vLLM, Ollama – all reachable on that IP with no public exposure.

For DNS, either add entries to each laptop’s hosts file or run a small internal DNS (e.g. dnsmasq on the server).

Versus Tailscale

WireGuard is lower-level. You manage keys, routes, and peers yourself. Tailscale wraps this with identity-based auth and automatic NAT traversal. For small teams with static endpoints, WireGuard is fine. For laptops moving between networks, Tailscale is easier.

See Tailscale alternative.