Skip to content

Getting started

This page takes you from the AWS Marketplace listing to a running WireGuard endpoint: subscribe, launch, connect, and check that the tunnel interface is up. It takes about ten minutes. Adding peers is covered in Configuration.

You need: an AWS account with permission to subscribe to AWS Marketplace products and launch EC2 instances.

1. Subscribe

Open the WireGuard Private Access listing, review the pricing and terms, and subscribe.

2. Launch the instance

Launch from the listing with these settings:

  • Instance type: t3.medium.
  • Storage: at least 16 GiB, encrypted gp3.
  • Security group: no inbound rules are needed yet. You open UDP 51820 to your peers later. If you want SSH, allow port 22 only from your own administrative address range.
  • IAM instance profile: to connect with AWS Systems Manager Session Manager, attach a role with the AWS managed policy AmazonSSMManagedInstanceCore. The tunnel itself needs no AWS permissions.

3. Connect

Connect with Session Manager, from the EC2 console (Connect > Session Manager), and switch to the ubuntu user:

sudo -iu ubuntu

Wait for first boot to finish:

cloud-init status --wait

4. Run the walkthrough

The walkthrough must run as ubuntu:

bash /opt/sushi/docs/demo.sh

It checks, without starting or restarting anything:

  • that sushi-wireguard-firstboot and wg-quick@wg0 are active,
  • that wg0 has the address 10.13.13.1/24,
  • that the localhost allowlist for UDP 51820 is in place,
  • that ubuntu cannot read the private key or wg0.conf, and that the public key is published,
  • that 10.13.13.1 answers a ping, and that no default route goes through wg0.

It ends with SUSHI_CUSTOMER_DEMO_PASSED. It does not add peers or send traffic to another host.

5. Look at the interface

sudo wg show wg0

You see the interface's public key and listening port, and no peers.

6. Get the public key

Peers need this instance's public key. It is safe to share:

cat /usr/local/share/sushi/wireguard/wg0.public

Never share the private key

The private key, /etc/wireguard/wg0.private, is the identity of this instance. Do not copy it to peers, or paste it into tickets, chat or screen recordings.

Next steps

Add your first peer in Configuration.