Create a WireGuard Peer between a VDC and an on-premises Gateway

Introduction

A VPN Gateway enables secure, encrypted communications between roaming users, on-premises networks, and cloud resources. This tutorial demonstrates configuring the VPN Gateway in IONOS Cloud to create a site-to-site setup between an IONOS Cloud VDC and a simulated on-premises installation. It uses a managed WireGuard instance to provide secure, encrypted connectivity between an IONOS Cloud VDC and a simulated on-premises setup.

Overview

This tutorial demonstrates the use of the following:

Before you begin

The following information is necessary to set up a connection between a WireGuard VDC and an on-premises VDC:

Reserve IP addresses

Before proceeding, ensure you have an IP block with at least one free IP address to assign to each gateway. For more information, see Reserve an IPv4 Address.

Configure LAN

This tutorial uses 192.10.1.0/24 and 192.10.2.0/24 for private LANs in IONOS Cloud (Left) and User On-Premises (Right), respectively. Remember to assign an IP address from the subnet to each gateway. We will use 192.10.1.5 as the VPN Gateway is not DHCP-aware. Remember to assign an IP address from the subnet to each gateway. The chosen IP address must be outside the DHCP pool and range from .2 to .9.

WireGuard interface IP address and subnet information

Each participant in a WireGuard VPN setup requires its own WireGuard interface address and subnet, which are unrelated to the networks you use in the cloud. It should be a subnet that does not conflict with anything already in the cloud or on the client side.

Generate Keypairs

WireGuard requires a key pair for the gateway and each connected peer. You can generate them using the WireGuard utilities or the OpenSSL command-line tools. Although we describe both approaches below, we recommend the former because it is a more straightforward procedure.

demo: wg genkey |tee gateway_private_key | wg pubkey > gateway_public_key
demo: cat gateway_private_key
abcdefABC12345=
demo: cat gateway_public_key
defDEFhiH/98765=

demo: openssl genpkey -algorithm X25519 -outform der -out user_private.der
demo: openssl pkey -inform der -in user_private.der -pubout -outform der -out user_public.der
demo: cat user_private.der |tail -c 32 | base64 > user_private_key
demo: cat user_public.der |tail -c 32 | base64 > user_public_key
demo: rm *.der
demo: cat user_private_key
kHKHABcC+67891=
demo: cat user_public_key
lmnoLMNO/89762=

demo: wg pubkey < user_private_key
lmnoLMNO/89762=

Execution

The execution process is divided into the following steps:

1. Set up IONOS Cloud

2. Simulate on-premises setup

3. Provision the VPN Gateway

4. Configure the VPN peer

5. Deploy on-premises WireGuard instance

6. Configure routing on LAN hosts

1. Set up IONOS Cloud

Below are some screenshots from the DCD that contains the required VDCs.

To begin with, two virtual servers on the IONOS Cloud are provisioned and connected to each other via a private LAN. In this instance, LAN1 uses a custom subnet of 192.10.1.0/24. We designate these two servers as 192.10.1.10 and 192.10.1.11, respectively.

2. Simulate on-premises setup

Imagine the gb/ldn VDC as a user-managed site where you provision two virtual servers. Here, we will use the subnet 192.10.2.0/24. Host 1 has been configured with internet access (IP address: 203.0.113.20) and will function as the on-premises host acting as a user-managed gateway. We address these two servers as 192.10.2.2 and 192.10.2.3, respectively.

3. Provision the VPN Gateway

1. In the DCD, go to Menu > Network > VPN Gateway under Connectivity.

2. Click Create VPN Gateway from the VPN Gateways window.

3. Enter the following details:

PropertiesVPN TierProtocolLAN Connections

Components

Description

Example

Name

Enter a descriptive name for the gateway instance. It is not required to be globally unique but must be limited to 255 characters.

wg-txl

Description

Enter a descriptive text for the gateway. It is limited to 1024 characters.

VPN Gateway for creating a WireGuard Peer between a VDC and on-premises gateway.

Location

Select a location from the drop-down list of available locations for VPN Gateway.

de/txl

IP Address

Select an IP address from the drop-down list of available public IPv4 addresses.

203.0.113.10

The Enhanced VPN tier is selected by default. The number of LANs and peers differ for each tier. You can also enable High Availability for a chosen tier, allowing VMs to operate in an active-passive mode. It minimizes downtime during a failover and ensures an uninterrupted connection.

Note: You can only upgrade the tier or switch between High Availability (HA) and non-HA variants during editing.

Select WireGuard protocol and specify the following:

Components

Description

Example

Private Key

The gateway_private_key value generated earlier in this document.

abcdefABC12345=

Interface IPv4

The IPv4 address of the WireGuard interface.

172.16.1.1/30

Interface IPv6

The IPv6 address of the WireGuard interface. This demonstration does not contain IPv6 addresses.

Not applicable

ListenPort

The UDP port on which WireGuard will listen for encrypted VPN packets. The tutorial uses the default value 51280.

The default value is 51280.

Attach a VPN Gateway to LANs in IONOS Cloud. You can only connect to LANs in the exact location where the VPN Gateway was provisioned. Take a look at the following mandatory parameters:

Components

Description

Example

Datacenter

Select a data center from the drop-down that lists VDCs in the same location as the gateway.

Berlin VPN

Connections

After selecting a data center, click Add LAN Connection to launch an additional pop-up window to set the properties.

See Below

Enter the following in the Edit LAN Connection pop-up window:

Components

Description

Example

LAN

The ID of the LAN to connect to.

1

IPv4 CIDR

The LAN IPv4 address assigned to the subnet's gateway in CIDR notation.

192.10.1.5

IPv6 CIDR

The LAN IPv6 address assigned to the subnet's gateway in CIDR notation.

Not applicable

1. Click Save and wait for the gateway to complete provisioning. The process typically takes about 8-10 minutes, but further operations on the gateway will be instantaneous.

4. Configure the VPN peer

Now that the VPN Gateway instance is provisioned, next step is to configure a peer to permit the two sides to talk with each other. We will need to configure a peer on both gateways but the on-premises will be configured using WireGuard configuration files.

1. Click Create Peers to begin configuring a new peer.

PropertiesEndpoint configurationPeers configuration

Enter the following details to configure a peer:

Components

Description

Example

Peer Name

Specify a name for the peer. It does not need to be globally unique and can be up to 255 characters long.

customer_site

Description

Enter more descriptive text for the peer, not exceeding 1024 characters.

Not applicable

Remote Host

The gateway public IPv4 address of the remote VPN Gateway.

194.10.2.2

Configure the endpoint so the gateway knows with which remote address the connection must be established. We will configure this as the public IPv4 address of the gateway to be created in gb/ldn.

The peers section specifies which networks are permitted across the peer. Here we will specify the WireGuard subnet in CIDR notation as described earlier.

Components

Description

Example

Allowed IPs

Enter a comma separated list of subnets in CIDR notation that are permitted to send traffic to the given peer. It is the subnet used on the peer side.

10.10.2.0/24

Public Key

The public key of the peer as we generated earlier in this tutorial.

lmnoLMNO/89762=

1. Click Save to save the peer configuration. This operation should typically be completed within a minute or two.

5. Deploy on-premises WireGuard instance

In this tutorial, host 1 in gb/ldn acts as a user-managed gateway. The host has internet access, so SSH can be used instead of the web console. Start by establishing an SSH connection to host 1's public IPv4 address in London.

apt-get update
apt-get install wireguard wireguard-tools -y

sysctl -w net.ipv4.ip_forward=1

[Interface]
PrivateKey =
Address =
ListenPort =
[Peer]
PublicKey =
AllowedIPs =
Endpoint =

[Interface]
PrivateKey = kHKHABcC+67891=
Address = 172.16.1.2/30
ListenPort = 51820
 
[Peer]
PublicKey = defDEFhiH/98765=
AllowedIPs = 192.10.1.0/24
Endpoint = 192.10.1.5:51820

root@london-lan-host-1:~# wg-quick up wg0
[#] ip link add wg0 type wireguard
[#] wg setconf wg0 /dev/fd/63
[#] ip -4 address add 172.16.1.2/30 dev wg0
[#] ip link set mtu 1420 up dev wg0
[#] ip -4 route add 192.10.1.0/24 dev wg0

root@london-lan-host-1:~# wg show
interface: wg0
  public key: lmnoLMNO/89762=
  private key: (hidden)
  listening port: 51820
peer: defDEFhiH/98765=
  endpoint: 192.10.1.5:51820
  allowed ips: 192.10.1.0/24

6. Configure routing on LAN hosts

Currently, it is impossible to automate the addition of routes to LAN hosts to route the required subnets over the VPN Gateway. In this section, we will manually add the required routes. Remember to add them to the LAN hosts in both the VDCs.

1

Configure de/txl Route

1. Establish a console session to the LAN host(s)

Because we did not provide internet access for the LAN hosts, our only route is via the web console. Open up a console session and test connectivity to the LAN Address assigned to the VPN gateway; in our case, it is 192.10.1.5. Hence, let us first test if we can ping this IP address:

2. Configure the VPN route

The LAN host(s) must know where to route the return traffic. To accomplish this, we will add a route for the gb/ldn LAN subnet (192.10.2.0/24) via the de/txl gateway's LAN address (192.10.1.5):

Copy

ip route add 192.10.2.0/24 via 192.10.1.5

Currently, we cannot ping hosts in the gb/ldn region because those servers do not yet know how to route the return traffic. Continue adding routes for LAN hosts in gb/ldn to resolve this issue.

2

Configure on-premises route

1. Establish a console session to the LAN hosts

Note: Perform the configuration on the host acting as the user-managed gateway, as it already knows how to route based on the WireGuard configuration. This section relates only to the other on-premises hosts connected to the same LAN.

Currently, the only way to access the system is through the web console, as we did not provide internet access for the second LAN host in our on-premises setup. First, open a console session and test the connectivity to the LAN address assigned to the VPN Gateway. In this case, the address is 192.10.2.2 (which corresponds to LAN Host 1, the user-managed gateway). Let us begin by attempting to ping this IP address.

2. Configure the VPN route

The LAN host(s) must know where to route return traffic. To accomplish this, we will add a route for the de/txl LAN subnet (192.10.1.0/24) via the gb/ldn gateway's LAN address (192.10.2.2):

Copy

ip route add 192.10.1.0/24 via 192.10.2.2

Repeat this process for all on-premises LAN hosts that need to send or receive traffic over the peer. At this point, we should have full connectivity between the two sites via the VPN Gateway.

Verify Connectivity

You should now be able to ping hosts in the simulated on-premises setup in gb/ldn from cloud hosts in de/txl and vice-versa.

Summary

You have successfully configured a site-to-site VPN connection between IONOS Cloud and your on-premises setup by utilising a Managed VPN Gateway in the cloud and a user-managed on-premises gateway.