> For the complete documentation index, see [llms.txt](https://docs.plenit.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.plenit.com/docs-en/productos/servers-2/how-to/how-to-configure-wireguard-for-multiple-vpn-connections.md). # How to Configure WireGuard for Multiple VPN Connections from a Private Network When several users connect from the same private network behind NAT, **L2TP only supports one concurrent session**. In this guide you install **WireGuard**, an encrypted-tunnel VPN, to accept multiple clients at once without exposing them to the Internet. > #### 👍 What you get > > A WireGuard server in your subscription accepting multiple simultaneous connections from a private network, with the port open in the Plenit firewall. ### Why WireGuard L2TP behind NAT collapses all connections from the same public network into a single session. WireGuard works over UDP and treats **each client as an independent peer** with its own key pair, so multiple users from the same network connect without stepping on each other. The key model is like SSH: each side has a private key (which it keeps) and a public key (which it shares with the other side). ### Before you start * Sign in to the Plenit platform with an active organization. * Have a **Servers** or **Remote Desktop** subscription with a Linux server. * Have the client device ready where you will install WireGuard. ### Step 1. Install WireGuard on the Linux server Installation varies by distribution. On CentOS, as root: ```bash yum install yum-utils epel-release yum-config-manager --setopt=centosplus.includepkgs=kernel-plus --enablerepo=centosplus --save sed -e 's/^DEFAULTKERNEL=kernel$/DEFAULTKERNEL=kernel-plus/' -i /etc/sysconfig/kernel yum install kernel-plus wireguard-tools reboot ``` On Ubuntu, the base command is: ```bash sudo apt install wireguard ``` Generate the server key pair: the private key stays on the server and the public key will be used by the clients. ```bash wg genkey | tee server_private.key | wg pubkey > server_public.key ``` ### Step 2. Install the client In this example the client is Windows. Download the installer from the WireGuard website and run it as administrator. If the main installer fails, use the Windows client MSI package. {/\* 📸 SCREENSHOT 1 · WireGuard window after installation on the client \*/} ![WireGuard installation completed on the client device](https://REEMPLAZA-URL/servidores-howto-wireguard-01.png) ### Step 3. Create the tunnel on the client With WireGuard open, click **Add Tunnel → Add empty tunnel…**. The client generates its key pair and shows an initial configuration that you complete with this structure: ```bash [Interface] PrivateKey = Address = 10.0.0.2/32 DNS = 192.168.1.1 [Peer] PublicKey = AllowedIPs = 0.0.0.0/0 Endpoint = :51820 ``` | Field | What it indicates | | ------------ | -------------------------------------------------------------------------------------------------------------------- | | `PrivateKey` | Client private key | | `Address` | Client internal IP inside the tunnel (a private range, e.g. `10.0.0.2/32`) | | `DNS` | Network DNS server | | `PublicKey` | WireGuard server public key | | `AllowedIPs` | What traffic is routed through the VPN. With `0.0.0.0/0` it passes everything; with a specific subnet, only that one | | `Endpoint` | Server public IP and port (UDP 51820) | {/\* 📸 SCREENSHOT 2 · tunnel configuration completed on the client \*/} ![Final tunnel configuration on the client](https://REEMPLAZA-URL/servidores-howto-wireguard-02.png) ### Step 4. Register the client on the server The server only lets through the clients it knows. Add the client to the `[Peer]` section of the server configuration, or live with: ```bash wg set wg0 peer allowed-ips ``` Where `` is the key generated by the client and `` the internal IP it will use in the tunnel (the same `Address` from Step 3). ### Step 5. Open the port in the Plenit firewall WireGuard listens on **UDP 51820**. Without that port open, the client won't connect even if the tunnel is configured correctly. In the Servers subscription, click **New rule** and configure it: 1. Select the network through which the service connects. 2. Define the origin of the connections. If you can, filter the allowed IPs instead of opening it to everyone. 3. Protocol **UDP**. 4. Public IP through which WireGuard connects. 5. Public port **51820**. 6. Corresponding private IP and port. {/\* 📸 SCREENSHOT 3 · firewall rule with UDP protocol and port 51820 \*/} ![Firewall rule for WireGuard UDP port 51820](https://REEMPLAZA-URL/servidores-howto-wireguard-03.png) > #### 👍 Filter the origin whenever you can > > Restricting source IPs in the rule reduces exposure compared with leaving the port open to the entire Internet. ### Step 6. Validate the connection Activate the tunnel on the client. On the server, confirm that there is a handshake with each peer: ```shell wg show ``` A `latest handshake` recent and counters of `transfer` that go up indicate that the tunnel is active. From the client, also check that you are exiting with the server's public IP. If it doesn't come up, check: * The server and client public keys are correctly exchanged. * The client is registered on the server (section `[Peer]` or `wg set`). * The Plenit firewall allows **UDP 51820**. * The `Endpoint` points to the server's correct public IP. ### Limitations and security * This guide solves the L2TP session limit when several users share a private network behind NAT. * With WireGuard, it is not enough to just install it: each client must be registered on the server and UDP port 51820 must be opened. * With `AllowedIPs = 0.0.0.0/0`, all client traffic passes through the VPN. * Filtering the source in the firewall reduces the exposure surface. ### Conclusion With WireGuard set up, a private network behind NAT is no longer limited to a single session: each user connects as its own peer. The key to the deployment is three pieces that must fit together: the keys correctly crossed between client and server, registering the peer on the server, and the UDP 51820 port open. To add more clients, repeat the tunnel setup on the client (Step 3) and its registration on the server (Step 4).
--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.plenit.com/docs-en/productos/servers-2/how-to/how-to-configure-wireguard-for-multiple-vpn-connections.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.