How do I connect my home network to a VPS with WireGuard (behind CGNAT)?

Why does CGNAT block a normal WireGuard setup?

Behind CGNAT your router shares one public IPv4 address with other customers, so nothing outside can open a connection to your home. WireGuard needs one side to be reachable by address, and the VPS is that side: it has One IPv4 address and an IPv6 /64 per VPS, on a 1 Gbit/s port. The traffic of a plan counts outgoing data only, and passing it never creates a bill by itself.

The home machine opens the tunnel outward. The WireGuard quickstart describes PersistentKeepalive for exactly this case: set it on a peer behind a firewall or NAT, and 25 seconds is "a sensible interval that works with a wide variety of firewalls". The NAT mapping then stays open and the VPS can send packets back through it.

Which Gloamport plan suits the hub?

Dusk suits a hub that carries traffic between a few machines. Gloamport lists it for "A VPN plus a Tor relay or an onion site", with 1 vCPU, 2 GB of RAM and 2 TB of monthly traffic.

According to Gloamport's survey of 10 November 2026, the median price of a 1 vCPU, 2 GB VPS across 32 hosts was $18.91 a month. If you only need a tunnel for one small service, Ember is enough; the base setup is in How do I set up WireGuard on a VPS?.

How do I write the hub configuration?

The hub file lists each peer with its public key and the addresses the VPS may send to it. Declaring the home LAN on the home peer lets the VPS route 192.168.1.0/24 into the tunnel.

[Interface]
Address = 10.8.0.1/24
ListenPort = 51820
PrivateKey = <VPS private key>
PostUp = sysctl -w net.ipv4.ip_forward=1

[Peer]
# home machine
PublicKey = <home public key>
AllowedIPs = 10.8.0.3/32, 192.168.1.0/24

[Peer]
# laptop
PublicKey = <laptop public key>
AllowedIPs = 10.8.0.2/32

How do I configure the home machine and the laptop?

The home machine needs PersistentKeepalive and a route to the tunnel subnet; the laptop needs routes to both subnets. Bring each up with wg-quick up wg0.

If you want the laptop to reach other devices on the home LAN, and not only the home machine, the home machine must itself forward packets: set net.ipv4.ip_forward to 1 there too, for instance with a PostUp = sysctl -w net.ipv4.ip_forward=1 line.

[Interface]
Address = 10.8.0.3/24
PrivateKey = <home private key>
PostUp = sysctl -w net.ipv4.ip_forward=1

[Peer]
PublicKey = <VPS public key>
Endpoint = <VPS IPv4 address>:51820
AllowedIPs = 10.8.0.0/24
PersistentKeepalive = 25

[Interface]
Address = 10.8.0.2/24
PrivateKey = <laptop private key>

[Peer]
PublicKey = <VPS public key>
Endpoint = <VPS IPv4 address>:51820
AllowedIPs = 10.8.0.0/24, 192.168.1.0/24
PersistentKeepalive = 25

wg-quick up wg0
systemctl enable --now wg-quick@wg0
wg show
ping -c 3 10.8.0.3

What can I do with the tunnel once it is up?

You can reach a home NAS, camera or self-hosted service from anywhere without opening a port at home. The laptop talks to 10.8.0.3 as if it were next door, and nothing is exposed on your home router.

Keep the VPS reachable and tidy: How do I harden SSH on a new VPS? covers the login side, and Is a self-hosted VPN on a VPS better than a VPN service? weighs the whole approach. For the hub, Dusk on a 12-month term is $5.25 a month; the plans are listed on the pricing page.