Skip to content

WireGuard Private Access

WireGuard Private Access is a WireGuard endpoint on Ubuntu 24.04, ready for you to add peers. On first boot it creates its own keys and brings up the wg0 tunnel interface, while keeping the WireGuard port closed to everything except the instance itself until you decide to open it. There is no web panel: you manage it from the command line.

Launch on AWS Marketplace Getting started

What is pre-installed

  • wireguard-tools 1.0.20260223, built from the official source: wg and wg-quick in /usr/bin, with the upstream wg-quick@.service unit.
  • The WireGuard kernel module that ships with the Ubuntu 24.04 kernel.
  • systemd units: sushi-wireguard-firstboot.service creates the keys and the configuration, and wg-quick@wg0.service brings up the tunnel.
  • A localhost allowlist: an nftables table, inet sushi-wireguard, that drops WireGuard packets from any address other than 127.0.0.1 or ::1.
  • A walkthrough script at /opt/sushi/docs/demo.sh.

Nothing secret is baked into the image. The private key and wg0.conf are created on your instance on first boot.

Defaults

Setting Value
Interface wg0
Tunnel address 10.13.13.1/24
Listen port UDP 51820, accepted from localhost only until you open it
Routes Table = off: wg-quick adds no routes
Peers None
Public key /usr/local/share/sushi/wireguard/wg0.public

How billing works

The software is billed by the hour while an instance is running, on the t3.medium instance type. AWS bills EC2, EBS and data transfer separately. The current price and any free trial are shown on the AWS Marketplace listing and in the offer terms.

Where to go next

Upstream project

WireGuard is written by Jason A. Donenfeld and contributors. wireguard-tools is published under GPL-2.0, and the exact source used for this build is on the instance at /usr/share/doc/wireguard-tools/wireguard-tools-1.0.20260223.tar.xz. Software Sushi packages it independently and does not claim upstream endorsement. For concepts and guides, see wireguard.com.