What is WireGuard

Where WireGuard helps a business

• Staff working from home or other cities need access to internal servers, accounting systems or shared folders that must not be exposed to the internet.
• Servers in different data centres need to be joined into one closed network.
• Remote access to Windows servers should go through a VPN rather than an RDP port open to the world.

How we use it

WireGuard is our default for a team's private network unless there is a reason to pick something else: it is fast and puts minimal load on the server. A basic setup for a team of up to 10 people takes 1–2 days; more complex setups with several sites take up to 5 working days, including guides for staff.

If a team needs access to foreign work tools that are blocked by restrictions, WireGuard alone is not enough; then we build a corporate gateway on Xray. Team VPN setup is under Infrastructure.

Common problems

• The protocol gets blocked. WireGuard traffic has a recognisable pattern, and where VPNs are being cut it stops working. Then you need Xray disguised as HTTPS.
• Manual keys. Every device needs its own key pair and an entry on the server; with many devices, Tailscale on top of WireGuard is more convenient.
• A departing employee. Their key must be removed from the server the same day, or the access remains.

When you do not need it

If all your work systems are in the cloud and open directly, a private network is unnecessary. And if you need to get around blocking rather than reach your own servers, WireGuard is the wrong tool.