How to use VPC (private) network with public IPs in SolusVM 2?

Kaloyan Dobrev

Updated September 30, 2026 18:17

Applicable to:

SolusVM 2

Question

How to use a VPC (private) network with public IPs?

Answer

PRODUCT_WARN: There is no built-in solution. The VPC feature is supported only for private IP ranges.

As a workaround, WireGuard can be used to encrypt VPC traffic ("VPC over WireGuard").

Background

VPC is restricted by design to work only on the internal private interface of a Compute Resource (CR).
Tunnel protocols do not provide authorization or encryption. Allowing VPC on a public interface therefore creates a security vulnerability (example:GHSA-vwm3-crmr-xfxw)
The built-in Open vSwitch IPsec feature was evaluated and did not perform reliably, so WireGuard is used instead of IPsec.

Implementation options

"VPC over WireGuard" can be implemented in two ways. The option must be selected before implementation.

Options	Pros	Cons
1. One WireGuard tunnel per VPC	More development flexibility, because everything is configured per VPC.	Lower performance and more overhead.
2. One common WireGuard tunnel for all VPCs	Easy to understand, diagnose and fix manually. Potentially higher performance because of lower overhead.	Potentially less flexible for future development, because a created VPC depends on other settings.

Example: option 2 (one common WireGuard tunnel for all VPCs)

The example uses three servers, each with only a public network interface. Commands are for Debian/Ubuntu.

Install WireGuard on each server
```
# apt install wireguard
```

Create the private and public keys on each server

# touch /etc/wireguard/privatekey 
# chmod 0640 /etc/wireguard/privatekey 
# wg genkey /etc/wireguard/privatekey 
# wg pubkey /etc/wireguard/publickey

Create /etc/wireguard/wg0.conf on each server. Addresses such as 10.1.1.2/32 are used inside the tunnel. The /32 mask is mandatory.

Example for SERVER-2:

[Interface]
# SERVER-2
Address = 10.1.1.2/32
PrivateKey = 0IDc5pWQ....tS2nk8=
MTU = 1420
ListenPort = 51820
[Peer]
# SERVER-1
PublicKey = 6YfbPyn6Y....ZR3pLAQ=
Endpoint = 135.181.114.95:51820
AllowedIPs = 10.1.1.1/32
PersistentKeepalive = 10
[Peer]
# SERVER-3
PublicKey = 4umRzDxzT....fUW7ZFs=
Endpoint = 135.181.114.71:51820
AllowedIPs = 10.1.1.3/32
PersistentKeepalive = 10

The other servers use the same structure, with their own Address and PrivateKey and the other two servers as peers.

Enable autostart and start the tunnel

# systemctl enable wg-quick@wg0.service
# systemctl daemon-reload
# systemctl start wg-quick@wg0.service
# systemctl status wg-quick@wg0.service

Expected output:

● wg-quick@wg0.service - WireGuard via wg-quick(8) for wg0
     Loaded: loaded (/lib/systemd/system/wg-quick@.service; enabled; vendor preset: enabled)
     Active: active (exited) since Mon 2024-04-01 07:49:53 UTC; 4s ago
    Process: 2425757 ExecStart=/usr/bin/wg-quick up wg0 (code=exited, status=0/SUCCESS)

Apr 01 07:49:53 server-2 wg-quick[2425757]: [#] wg setconf wg0 /dev/fd/63
Apr 01 07:49:53 server-2 wg-quick[2425757]: [#] ip -4 address add 10.1.1.2/32 dev wg0
Apr 01 07:49:53 server-2 wg-quick[2425757]: [#] ip link set mtu 1420 up dev wg0
Apr 01 07:49:53 server-2 wg-quick[2425757]: [#] ip -4 route add 10.1.1.3/32 dev wg0
Apr 01 07:49:53 server-2 wg-quick[2425757]: [#] ip -4 route add 10.1.1.1/32 dev wg0
Apr 01 07:49:53 server-2 systemd[1]: Finished WireGuard via wg-quick(8) for wg0.