Sold by: Software Sushi
Deployed on AWS
Free Trial
Stand up a WireGuard VPN endpoint on Ubuntu 24.04. Keys are generated on first boot, wg0 starts with no peers, and UDP 51820 stays closed to the outside until you add peers and deliberately open it. Includes a guide to adding peers and routing.
Overview
Stand up a WireGuard endpoint you control. This image provides wireguard-tools 1.0.20260223 with the Ubuntu kernel module, a wg0 interface with keys generated on first boot and a firewall rule that keeps the UDP port closed to remote peers until you open it.
Launch this version on t3.medium with at least 16 GiB encrypted root storage and at least 2 GiB RAM. Connect with AWS Systems Manager Session Manager. You land as ssm-user; run sudo -iu ubuntu to switch to the ubuntu account. SSH is off: no key pair is attached and no inbound rule is needed. First boot creates this instance's private key, public key and wg0.conf; nothing sensitive is baked into the image. The public key is available at /usr/local/share/sushi/wireguard/wg0.public. UDP 51820 stays localhost-only until you opt out. Keep private keys out of recordings and tickets.
The standard software fee is described in the AWS Marketplace offer terms. EC2, EBS and data-transfer charges are billed separately. See the offer terms for applicable billing promotions.
After launch, wait for cloud-init to finish, then follow the bundled README for configuration, backup and day-2 operations. IAM is not required for the tunnel itself. There is no web panel.
Reach it from other machines: To accept remote peers, create /etc/wireguard/allow-non-localhost, delete the nftables table inet sushi-wireguard and allow inbound UDP 51820 in the security group only from your peers' addresses. The Configuration guide also covers routes and using the instance as a gateway for your VPC.
Copy-paste launch kit (role, security group, run-instances and CloudFormation): https://docs.softwaresushi.com/launch-kit/ and the WireGuard Private Access guide: https://docs.softwaresushi.com/wireguard/
This is a repackaged open source software product wherein additional charges apply for independent AWS packaging, validation, maintenance and setup documentation. Jason A. Donenfeld and contributors publish wireguard-tools under GPL-2.0; Software Sushi supplies the AMI recipe, pinned tools source build, first-boot keys, localhost UDP allowlist, and setup documentation without claiming upstream endorsement.
Highlights
- Pinned wireguard-tools 1.0.20260223 with GPL corresponding source and provenance receipts.
- First-boot keys, wg-quick@wg0 overlay defaults, and localhost UDP 51820 allowlist.
- Bundled configuration, backup and day-2 operations documentation.
Details
Sold by
Categories
Delivery method
Delivery option
64-bit (x86) Amazon Machine Image (AMI)
Latest version
Operating system
Ubuntu 24.04
Deployed on AWS
New
Introducing multi-product solutions
You can now purchase comprehensive solutions tailored to use cases and industries.
Features and programs
Financing for AWS Marketplace purchases
AWS Marketplace now accepts line of credit payments through the PNC Vendor Finance program. This program is available to select AWS customers in the US, excluding NV, NC, ND, TN, & VT.
Pricing
Free trial
Try this product free for 5 days according to the free trial terms set by the vendor. Usage-based pricing is in effect for usage beyond the free trial terms. Your free trial gets automatically converted to a paid subscription when the trial ends, but may be canceled any time before that.
Pricing is based on actual usage, with charges varying according to how much you consume. Subscriptions have no end date and may be canceled any time.
Additional AWS infrastructure costs may apply. Use the AWS Pricing Calculator to estimate your infrastructure costs.
Dimension | Cost/hour |
|---|---|
t3.medium Recommended | $0.02 |
Dimensions summary
This listing has one pricing dimension. You pay an hourly software rate while your instance runs on the t3.medium instance type. Billing is usage-based, so charges stop when the instance stops. AWS charges you separately for EC2 compute, EBS storage, and data transfer. There are no tiers or instance-size choices to compare. The software packages WireGuard tooling that generates its keys on first boot.
Top-of-mind questions for buyers
The software runs on a single t3.medium EC2 instance, a general-purpose size with 2 vCPUs and 4 GiB of memory. The hourly software charge is tied to that one instance running. You do not choose other sizes for this listing.
The hourly software rate applies only while the instance runs. Stopping the instance halts software charges. However, AWS may still bill you for EBS storage attached to a stopped instance. Those AWS infrastructure fees are separate from the software charge.
AWS bills EC2 compute, EBS storage, and data transfer separately from the software charge. The hourly rate covers only the packaged WireGuard software on the t3.medium instance. Review the AWS Marketplace listing for current infrastructure pricing before launching.
docs.softwaresushi.com
Helpful?
Vendor refund policy
We offer a full refund of software charges for the first 48 hours billing starts if the product does not perform as described. To request a refund, email info@softwaresushi.com with your EC2 instance ID and a description of the issue. AWS infrastructure costs (EC2, EBS, data transfer) are not eligible for refund by us.
Legal
Vendor terms and conditions
Upon subscribing to this product, you must acknowledge and agree to the terms and conditions outlined in the vendor's End User License Agreement (EULA) .
Content disclaimer
Vendors are responsible for their product descriptions and other product content. AWS does not warrant that vendors' product descriptions or other product content are accurate, complete, reliable, current, or error-free.
Delivery details
64-bit (x86) Amazon Machine Image (AMI)
Amazon Machine Image (AMI)
An AMI is a virtual image that provides the information required to launch an instance. Amazon EC2 (Elastic Compute Cloud) instances are virtual servers on which you can run your applications and workloads, offering varying combinations of CPU, memory, storage, and networking resources. You can launch as many instances from as many different AMIs as you need.
Version release notes
WireGuard 1.0.20260223 on Ubuntu 24.04 LTS, packaged by Software Sushi. The guided demo is repeatable. The documentation under /opt/sushi/docs is root-owned and a first-login guide appears after sudo -iu ubuntu. Connect with Session Manager, run sudo -iu ubuntu, then bash /opt/sushi/docs/demo.sh. Configure your own provider keys and models privately after launch.
Additional details
Usage instructions
- Launch t3.medium (16 GiB or larger encrypted gp3, IMDSv2) with an instance profile that has AmazonSSMManagedInstanceCore and outbound HTTPS. No inbound rules are needed. Copy-paste launch kit (role, security group, run-instances, CloudFormation): https://docs.softwaresushi.com/launch-kit/
- Connect: aws ssm start-session --target <instance-id>. You land as ssm-user; sudo -iu ubuntu switches to the ubuntu account and shows the first-login guide. After cloud-init finishes, run: sudo -iu ubuntu bash /opt/sushi/docs/demo.sh (expect a final line ending in DEMO_PASSED).
- Use it: On the instance: sudo wg show wg0. Peers need the public key from cat /usr/local/share/sushi/wireguard/wg0.public. Add your first peer by following the Configuration guide.
- Secrets and access: The instance's private key is /etc/wireguard/wg0.private (root only). Never copy it to a peer or paste it into tickets. Only the public key is shared. UDP cannot be forwarded through Session Manager.
- Reach it from another host: to accept remote peers, create /etc/wireguard/allow-non-localhost, run sudo nft delete table inet sushi-wireguard and allow inbound UDP 51820 in the security group only from your peers' addresses. Close it again by removing the marker file and loading /opt/sushi/etc/wireguard/localhost-udp.nft. Guide: https://docs.softwaresushi.com/wireguard/ . Support: info@softwaresushi.com
Support
Vendor support
Software Sushi provides AMI packaging and setup guidance. Contact info@softwaresushi.com for installation questions. Support coverage requires a separate agreement. This offer does not include WireGuard project support.
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Similar products
Gitea is a lightweight, self-hosted Git service with repositories, issues and pull requests. This Ubuntu 24.04 AMI runs single-instance Gitea with SQLite storage behind private HTTPS with a per-instance TLS certificate and a generated administrator, so small teams can host private code in their own AWS account.
Docling converts PDF and DOCX files into clean Markdown and structured JSON for search, RAG pipelines and data extraction. This Ubuntu 24.04 AMI runs Docling on CPU behind a private HTTPS API with per-instance TLS. Processing stays on the instance, with no model API key and no remote services.
OpenHands Core with local Agent Canvas, Python terminal/Git and a private Telegram adapter. Customer cloud-model credentials are required after launch.
Open WebUI is a self-hosted, ChatGPT-style chat interface for any OpenAI-compatible model endpoint. Give your team one private place to chat with the models you choose. This Ubuntu 24.04 AMI runs Open WebUI v0.11.4 on localhost with a session secret generated per instance, reachable through Session Manager port forwarding.
Customer reviews
No customer reviews yet
Be the first to review this product . We've partnered with PeerSpot to gather customer feedback. You can share your experience by writing or recording a review, or scheduling a call with a PeerSpot analyst.