> For the complete documentation index, see [llms.txt](https://docs.plenit.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.plenit.com/docs-en/productos/servers/how-to/how-to-configure-wireguard-for-multiple-vpn-connections.md). # How to Configure WireGuard for Multiple VPN Connections from a Private Network When several users connect from the same private network behind NAT, **L2TP only supports one concurrent session**. In this guide you install **WireGuard**, an encrypted tunnel VPN, to allow several clients at once without exposing them to the Internet. > #### 👍 What you get > > A WireGuard server in your subscription accepting multiple simultaneous connections from a private network, with the port open in the Plenit firewall. ### Why WireGuard L2TP behind NAT collapses all connections from the same public network into a single session. WireGuard works over UDP and treats **each client as an independent peer** with its own key pair, so several users on the same network connect without interfering with each other. The key model is like SSH: each end has a private key (which it keeps) and a public key (which it shares with the other side). ### Before you start * Log in to the Plenit platform with an active organization. * Have a **Servers** or **Remote Desktop** with a Linux server. * Have the client machine ready where you will install WireGuard. ### Step 1. Install WireGuard on the Linux server The installation varies depending on the distribution. On CentOS, as root: ```bash yum install yum-utils epel-release yum-config-manager --setopt=centosplus.includepkgs=kernel-plus --enablerepo=centosplus --save sed -e 's/^DEFAULTKERNEL=kernel$/DEFAULTKERNEL=kernel-plus/' -i /etc/sysconfig/kernel yum install kernel-plus wireguard-tools reboot ``` On Ubuntu, the base command is: ```bash sudo apt install wireguard ``` Generate the server key pair: the private key stays on the server and the public key will be used by the clients. ```bash wg genkey | tee server_private.key | wg pubkey > server_public.key ``` ### Step 2. Install the client In this example the client is Windows. Download the installer from the WireGuard website and run it as administrator. If the main installer fails, use the Windows client MSI package. {/\* 📸 SCREENSHOT 1 · WireGuard window after installation on the client \*/} ![WireGuard installation completed on the client machine](https://REEMPLAZA-URL/servidores-howto-wireguard-01.png) ### Step 3. Create the tunnel on the client With WireGuard open, click **Add Tunnel → Add empty tunnel…**. The client generates its key pair and shows an initial configuration that you complete with this structure: ```bash [Interface] PrivateKey = Address = 10.0.0.2/32 DNS = 192.168.1.1 [Peer] PublicKey = AllowedIPs = 0.0.0.0/0 Endpoint = :51820 ``` | Field | What it indicates | | ------------ | ---------------------------------------------------------------------------------------------------------------- | | `PrivateKey` | Client private key | | `Address` | Client's internal IP inside the tunnel (a private range, e.g. `10.0.0.2/32`) | | `DNS` | Network DNS server | | `PublicKey` | WireGuard server public key | | `AllowedIPs` | Which traffic is routed through the VPN. With `0.0.0.0/0` it sends everything; with a specific subnet, only that | | `Endpoint` | Server's public IP and port (UDP 51820) | {/\* 📸 SCREENSHOT 2 · tunnel configuration completed on the client \*/} ![Final tunnel configuration on the client](https://REEMPLAZA-URL/servidores-howto-wireguard-02.png) ### Step 4. Register the client on the server The server only lets through clients it knows. Add the client to the `[Peer]` section of the server configuration, or on the fly with: ```bash wg set wg0 peer allowed-ips ``` Where `` is the key generated by the client and `` the internal IP it will use in the tunnel (the same `Address` from Step 3). ### Step 5. Open the port in the Plenit firewall WireGuard listens on **UDP 51820**. Without that port open, the client won't connect even if the tunnel is configured correctly. In the Servers subscription, click **New rule** and configure it: 1. Select the network through which the service connects. 2. Define the origin of the connections. If you can, filter the allowed IPs instead of opening it to all. 3. Protocol **UDP**. 4. WireGuard's public IP address. 5. Public port **51820**. 6. Corresponding private IP and port. {/\* 📸 SCREENSHOT 3 · firewall rule with UDP protocol and port 51820 \*/} ![Firewall rule for WireGuard UDP port 51820](https://REEMPLAZA-URL/servidores-howto-wireguard-03.png) > #### 👍 Filter the source whenever you can > > Restricting source IPs in the rule reduces exposure compared with leaving the port open to the whole Internet. ### Step 6. Validate the connection Activate the tunnel on the client. On the server, confirm there is a handshake with each peer: ```shell wg show ``` A `latest handshake` recent and transfer counters `transfer` that increase indicate the tunnel is active. From the client, also check that you are exiting with the server's public IP. If it doesn't come up, check: * The server and client public keys are correctly exchanged. * The client is registered on the server (section `[Peer]` or `wg set`). * The Plenit firewall allows **UDP 51820**. * The `Endpoint` points to the correct server public IP. ### Limitations and security * This guide solves the L2TP session limit when several users share a private network behind NAT. * Installing WireGuard is not enough: each client must be registered on the server and UDP port 51820 opened. * With `AllowedIPs = 0.0.0.0/0`, all client traffic goes through the VPN. * Filtering the source in the firewall reduces the exposure surface. ### Conclusion With WireGuard set up, a private network behind NAT is no longer limited to a single session: each user enters as their own peer. The key to the deployment is three pieces that must fit together: the keys correctly crossed between client and server, the peer registration on the server, and UDP port 51820 open. To add more clients, repeat the tunnel setup on the client (Step 3) and its registration on the server (Step 4).
--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.plenit.com/docs-en/productos/servers/how-to/how-to-configure-wireguard-for-multiple-vpn-connections.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.