Skip to content

Operations

This page covers running WireGuard Private Access day to day: how it is secured, how it is updated, what to back up, where the logs are, and how to get help.

Security model

  • Closed by default. UDP 51820 accepts packets only from the instance itself until you open it, and there are no peers until you add them.
  • Per-instance identity. The private key is generated on first boot. It and wg0.conf are readable only by root. The image contains no keys.
  • No extra routes. Table = off keeps wg-quick from changing the instance's routing.
  • SSH. Password authentication and root login are turned off.
  • No AWS access. The tunnel does not call AWS APIs and needs no IAM permissions.

Manage the service

sudo systemctl status wg-quick@wg0
sudo systemctl restart wg-quick@wg0
sudo wg show wg0

wg-quick@wg0.service waits for sushi-wireguard-firstboot.service, which runs on every boot. It creates the keys and wg0.conf if they are missing, publishes the public key, and restores the localhost allowlist unless /etc/wireguard/allow-non-localhost exists.

Logs

sudo journalctl -u wg-quick@wg0 --no-pager -n 100
sudo journalctl -u sushi-wireguard-firstboot --no-pager

Updates

  • Ubuntu packages get security updates automatically through unattended upgrades. The WireGuard kernel module is part of the Ubuntu kernel and is updated with it.
  • wireguard-tools stays at 1.0.20260223. A new release comes as a new version of the AMI. Launching it does not change running instances: launch the new version, restore /etc/wireguard/, then point peers at the new host.

Backups

Back up /etc/wireguard/ as a whole. The private key is this instance's identity: if you lose it, every peer needs the new public key.

Restore the directory as a complete, matching set. First boot refuses to continue if wg0.conf exists without its private key, if the key in wg0.conf differs from wg0.private, or if any of these files is a link. It does not create a replacement identity in those cases.

Copy the backup only over a private channel. Practice a restore on a test instance before you depend on it.

Check the installation

The image includes a self-test that runs as root:

sudo /opt/sushi/bin/smoke.sh

It creates temporary peers on the same host, checks handshakes and traffic, removes a peer, and restarts wg-quick@wg0. Run it only on a test instance, never while the tunnel carries real traffic.

Support

Software Sushi provides AMI packaging and setup guidance. Email info@softwaresushi.com with installation questions. Support coverage beyond that requires a separate agreement. This offer does not include support from the WireGuard project.