Overview

A VPN lets you reach services on your Pod — databases, admin panels, internal APIs — without exposing them to the public internet. This article shows a lightweight setup using WireGuard.

Before you begin

• Root or sudo access to the Pod (the "server").
• A local machine to act as the client.
• Note your Pod's public IP address.

Steps

1. Install WireGuard on the server:

bash sudo apt install wireguard

1. Generate server keys:

bash wg genkey | sudo tee /etc/wireguard/server.key | wg pubkey | sudo tee /etc/wireguard/server.pub sudo chmod 600 /etc/wireguard/server.key

1. Create the server config /etc/wireguard/wg0.conf:

ini [Interface] Address = 10.8.0.1/24 ListenPort = 51820 PrivateKey = <contents of server.key>

1. On the client, install WireGuard and generate a key pair, then add a peer section to the server config:

ini [Peer] PublicKey = <client public key> AllowedIPs = 10.8.0.2/32

1. Client config:

```ini [Interface] Address = 10.8.0.2/24 PrivateKey =

[Peer] PublicKey = Endpoint = :51820 AllowedIPs = 10.8.0.0/24 PersistentKeepalive = 25 ```

1. Open the VPN port and start the service:

bash sudo ufw allow 51820/udp sudo systemctl enable --now wg-quick@wg0

1. Then bind internal services to the private interface (for example, listen_addresses = '10.8.0.1' for PostgreSQL, or bind-address = 10.8.0.1 for MySQL) and remove their public firewall rules.

Troubleshooting

• Problem: Handshake fails. Solution: Check the UDP port is open (wg show), keys match, and the endpoint IP is correct.
• Problem: Can connect but not reach services. Solution: Verify AllowedIPs includes the service subnet and that the service listens on the VPN address.

Related articles

• [Securing MySQL and MariaDB]
• [Security best practices for your Pod]
• [Hardening SSH]