VPN gateway server: WireGuard VPN with IPv64.net

A VPN gateway is a WireGuard server in your Cloud Router that IPv64.net manages entirely through the website. This page explains where the servers are located, how to create WireGuard access (peers), how to connect clients and what the install script wg-install.sh does.

What is a VPN gateway?

The VPN gateway is a virtual router in the IPv64.net environment. It runs inside a Cloud Router and has its own WireGuard port on a VPN server. You create client and site-to-site configurations in a few seconds; IPv64.net applies them to the server automatically.

• Every WireGuard access is called a peer: a smartphone, a laptop, a Linux server or a router such as FRITZ!Box, OPNsense or UniFi.
• A Cloud Router can contain several gateways, a gateway several peers. How many depends on your account class (Pricing).
• The gateway speaks IPv4 and IPv6 and also connects lines with CGNAT or DS-Lite cleanly to the internet.

How to create the Cloud Router and gateway and how to forward ports is described under Cloud Router.

VPN gateway servers and locations

All VPN gateway traffic runs via the IPv64.net servers. All of them are located in German data centres. The current list with location, provider, status, addresses and traffic is at ipv64.net/vpn-server.

The crown marks premium servers. In the free account, IPv64.net assigns the server automatically; from Home / Supporter upwards you choose it yourself under Choose a favorite Server when creating the router, Business and Company also hardware servers. A server's status is Online, Offline, Maintenance mode or Testserver.

Create WireGuard access (peer)

1. Create a peer
   On Cloud Router, choose Gateway Options → Quick new WG Peer at the gateway.
2. Check the settings
   In the peer list (Show WG Peers), adjust the fields under Peer options → Edit Peer (table below) and save with Save settings.
3. Get the configuration
   Peer options → Show WG Config opens the ready-made client configuration.

Keys: Keypair Section

• Generate new Keypair creates a new key pair, Generate new PSK a new preshared key. Your devices then need the new configuration.
• Save manual Keypair stores your own keys. You can also enter only the public key and leave the private key field empty. The private key then stays on your device only, and you add it to the configuration there yourself.

The WireGuard configuration

The Show WG Config view shows the client file wg0.conf. It is structured like this (values are placeholders):

[Interface]
Address = 10.7.0.2/32,fd64::2/128
PrivateKey = YOUR_PRIVATE_KEY
DNS = 192.0.2.53

[Peer]
PublicKey = GATEWAY_PUBLIC_KEY
PresharedKey = YOUR_PRESHARED_KEY
AllowedIPs = 10.7.0.0/24
Endpoint = SERVERNAME:PORT
PersistentKeepalive = 25

• Address, DNS and PersistentKeepalive come from the peer settings; DNS, PresharedKey and PersistentKeepalive are only included if they are set.
• AllowedIPs are the entries of the Client Site list under Edit Peer – the networks your device sends into the tunnel.
• Endpoint is the VPN server with your gateway's port, as shown in the Server column.

How to get the file onto your device:

• QR code for the WireGuard app on your smartphone.
• Copy to Clipboard or Download as file (wg0.conf).
• Direct-Download URL of the form https://ipv64.net?wgconfig=YOUR_PEER_TOKEN – works without logging in, e.g. with curl.
• Fast One-Step Installer for Linux, see below.

Set up clients

Windows and macOS

Install the official WireGuard app, download the file wg0.conf and import it in the app as a tunnel from a file. Then activate the tunnel.

Android and iOS

Install the WireGuard app, tap + and scan the QR code from Show WG Config. Switch the tunnel on – done.

Linux

The easiest way is the install script. By hand it works like this:

sudo apt install wireguard
sudo curl -fsSL "https://ipv64.net?wgconfig=YOUR_PEER_TOKEN" -o /etc/wireguard/wg0.conf
sudo chmod 600 /etc/wireguard/wg0.conf
sudo wg-quick up wg0
sudo systemctl enable wg-quick@wg0

Routers and firewalls

FRITZ!Box, OPNsense, UniFi and other routers with WireGuard connect the same way: import the file or copy the values from the configuration. If the router should bring a whole network into the VPN, mark the peer as site-to-site and set up the routes (see routing).

Install script wg-install.sh

The Fast One-Step Installer sets up exactly one peer's configuration on an x86 Linux system. Copy the ready-made command with your token from Show WG Config. It has this form and must run as root:

bash <(curl -fsSL https://ipv64.net/wg-install.sh) YOUR_PEER_TOKEN

If you want to read the script first, download it:

curl -fsSL https://ipv64.net/wg-install.sh -o wg-install.sh
less wg-install.sh
sudo bash wg-install.sh YOUR_PEER_TOKEN

The script does the following, in order:

1. checks that it runs as root and that a token was given;
2. detects the package manager: apt-get (Debian/Ubuntu), yum (CentOS/RHEL) or dnf (Fedora/RHEL) – on other systems it aborts;
3. installs the wireguard package if wg and wg-quick are missing (with yum, epel-release first);
4. downloads the configuration from https://ipv64.net?wgconfig=YOUR_PEER_TOKEN to /etc/wireguard/wg0.conf and sets the permissions to 600;
5. shows the downloaded configuration;
6. warns if AllowedIPs contains 0.0.0.0/0 or ::/0 – then all traffic goes through the tunnel;
7. prints the commands to start it. It does not start the tunnel itself.

Then start WireGuard and enable autostart:

wg-quick up wg0
systemctl enable wg-quick@wg0
systemctl start wg-quick@wg0

Use cases

Like a normal VPN provider

A client connects to the gateway and goes out to the internet through it. For this, the Client Site list contains 0.0.0.0/0 and ::/0. In the free account, internet access via the gateway is limited.

Reach your homelab behind DS-Lite and CGNAT

Your server or router opens the tunnel from the inside, IPv64.net forwards requests via port mapping. The traffic is additionally encrypted. Guide: Port forwarding with the port mapper.

Site-to-site VPN

Several homelabs or locations connect to the same Cloud Router. With the routing table (and OSPF if you like) all networks reach each other. Details under Routing, site-to-site, firewall and OSPF.

WireGuard Config Generator

If you run your own WireGuard server, the WireGuard Config Generator helps. For a setup with one server and several clients it creates the server file wg0.conf and client files (wg1.conf, wg2.conf …) with QR codes. It has nothing to do with the IPv64.net Cloud Router.

On your Linux server you then use the server file like this:

sudo apt install wireguard
sudo nano /etc/wireguard/wg0.conf
sudo wg-quick up wg0
sudo systemctl enable wg-quick@wg0

The clients scan the QR code of their configuration with a smartphone. ipv64.net generates the keys when the page is loaded; according to the page nothing is stored. For production servers you can generate your own keys locally with wg genkey and enter them.

Security and logging

• Treat configuration files, download URL and token like passwords. If in doubt, generate new keys or delete the peer.
• Use Disable peer to switch off individual peers without deleting them.
• Show Connections shows a peer's last 30 connections with IP address, port and time.
• IPv64.net has no “no-log policy”: connection-relevant data is stored in an immutable form in accordance with the law. Illegal services are forbidden.

Found a mistake or missing something? Tell us in the v64.tech forum. · Updated: 2026-10-26