Proxmox WireGuard VPN in one click

• One switch per node

  Turn the VPN on from the node page (Network, WireGuard VPN). The agent installs WireGuard and creates the node key on the node; the private key never leaves it.

• Subnets that never collide

  Each node gets the next free /24 in 10.88.0.0/16, or a private range you choose. Overlaps with existing networks, IP zones, SDN or NAT are refused with a clear message.

• Named configs

  Create as many configs as you need: a master config for every node, a config for one node, or one that reaches only selected SDN project networks. Download it or scan the QR code.

• Readiness checklist

  Each node shows whether the agent, WireGuard, the interface, IP forwarding, the firewall and the public endpoint are ready, and the last handshake.

• Customer devices

  On Enterprise, customers add their own devices in the portal (5 each by default). A device reaches only the customer's own servers and follows ownership changes automatically.

• Keys shown once

  The panel keeps public keys only, plus an encrypted preshared key per device. A config is shown once; downloading it again creates new keys and revokes the old ones.

1. On a node page, open Network and switch on WireGuard VPN.

2. Open VPN in the sidebar, create a config and download it or scan its QR code with the WireGuard app.

3. Check the readiness list on the node; behind NAT, forward the UDP port it shows.

4. On Enterprise, customers add their own devices in the portal.

WireGuard VPN: step-by-step guide in the docs