WireGuard VPN Server - AMI by cloudimg

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

WireGuard is a modern VPN that aims to be faster, simpler and leaner than IPsec and OpenVPN. It runs inside the Linux kernel, uses state-of-the-art cryptography (Curve25519 key exchange, ChaCha20-Poly1305 encryption), and presents a single UDP listener with a small, stateless configuration file - no PKI, no certificate authority and no IKE daemon to operate. This image eliminates the usual work of compiling software, managing certificates and hardening a base OS: WireGuard is preinstalled, configured under systemd, and listening on UDP 51820 within minutes of launch, with no compilation and no third-party repositories.

Designed for AWS. The image runs on Amazon EC2 inside your Amazon VPC, and its default security group opens UDP 51820 for tunnel traffic. Assign an Elastic IP for a stable endpoint that your client devices can point at, and place the instance in the subnet that reaches the private resources you want to protect.

Secure by default - no shared secrets. Unlike images that bake a shared private key into the image, this appliance generates a fresh Curve25519 server keypair on first boot. The private key is written only into the root-only server configuration and never captured into the image, so every instance you launch mints its own unique cryptographic identity. The appliance ships with zero peers configured, making it a private server-only endpoint rather than an open relay - you explicitly authorise each client device by adding one peer block per device. The server public key and connection details are written to a root-only file on first boot for you to hand to your clients. IP forwarding is enabled so the instance can route between connected peers, and the operating system ships fully patched with unattended security updates enabled.

Use cases. Give a distributed team encrypted, low-latency access to internal services in a private subnet without exposing them to the public internet; build encrypted site-to-site tunnels linking VPCs across regions; or give a small fleet of devices a fast private overlay network. By default the tunnel is a private peer-to-peer overlay; to make the instance act as an internet gateway for your clients you uncomment the provided NAT rules in the configuration, as described in the deployment guide.

Quick start. Launch the AMI in your VPC with UDP 51820 open in the security group; SSH in and read the server public key and connection details from /stage/scripts/wireguard-credentials.log; on each client device create a WireGuard configuration using that server public key and the instance public IP; add each client's public key as a peer in /etc/wireguard/wg0.conf and reload; then activate the tunnel on the client and verify connectivity.

What is included: WireGuard running under systemd with automatic start on boot; Curve25519 key exchange and ChaCha20-Poly1305 encryption; a per-instance server keypair generated on first boot and never baked into the image; IP forwarding enabled for routing between peers; an optional NAT gateway mode documented in the configuration; a fully patched operating system with unattended security updates; and 24/7 cloudimg support.

This is a repackaged open source software product with additional charges for cloudimg support services. WireGuard is distributed under the GPL-2.0 license. WireGuard is a registered trademark of Jason A. Donenfeld. cloudimg is not affiliated with or endorsed by the WireGuard project or Jason A. Donenfeld. All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.