Wireguard VPN steps

The following is based on these assumptions:

• Virtual network: 10.16.0.0/16
• Target private destinations: 10.16.0.0/18, 10.16.64.0/18
• WireGuard virtual tunnel: 172.16.0.0/24 ← separate virtual subnet to avoid conflict
• WireGuard port: 51820 UDP
• Wstunnel port: 443 TCP
• You're on an Azure network and you want to resolve private endpoints

VPN server should have port 443 exposed on TCP and port 51820 exposed on UDP.

Wireguard

Install Wireguard.

sudo apt update && sudo apt install wireguard

Enable IP forwarding permanently.

echo "net.ipv4.ip_forward=1" | sudo tee -a /etc/sysctl.conf
sudo sysctl -p

Find network interface using ip -br address and add it into IFACE.

# Example:
IFACE="eth0"

Add server configuration.

sudo tee /etc/wireguard/wg0.conf <<END
[Interface]
PrivateKey = $(wg genkey)
Address = 172.16.0.1/24
ListenPort = 51820

PostUp = iptables -A FORWARD -i wg0 -o ${IFACE} -j ACCEPT
PostUp = iptables -A FORWARD -i ${IFACE} -o wg0 -m state --state RELATED,ESTABLISHED -j ACCEPT
PostUp = iptables -t nat -A POSTROUTING -s 172.16.0.0/24 -o ${IFACE} -j MASQUERADE

PostDown = iptables -D FORWARD -i wg0 -o ${IFACE} -j ACCEPT
PostDown = iptables -D FORWARD -i ${IFACE} -o wg0 -m state --state RELATED,ESTABLISHED -j ACCEPT
PostDown = iptables -t nat -D POSTROUTING -s 172.16.0.0/24 -o ${IFACE} -j MASQUERADE
END

# Change permission
sudo chmod 600 /etc/wireguard/wg0.conf