Build Your Own Secure VPN

Overview

WireGuard is a fast, modern VPN protocol with a small, auditable code base. Running it as a container on an ALPON X5 AI or ALPON X4 gives you a powerful and flexible VPN endpoint on your own network: the client generates its own keys and configuration, while the server container uses the keys you pass in as environment variables to establish the tunnel.

The steps below are identical on ALPON X4 and ALPON X5 AI. For protocol details and client apps, see the official WireGuard documentation.

1. 1

   Generate your client keys

   The client creates its own private key, public key, and pre-shared key (PSK). Follow the instructions for your operating system; whichever you use, you end up with the same three files.

   For Linux users

   Install the WireGuard tools, then generate the private and public keys and the pre-shared key:

   bash · Linux

   # Install WireGuard tools
   sudo apt-get update
   sudo apt-get install wireguard-tools
   
   # Generate private key and public key
   
   wg genkey | tee client-private.key | wg pubkey > client-public.key
   
   # Generate pre-shared key (PSK)
   
   wg genpsk > client.psk

   For macOS users

   Install the WireGuard tools with Homebrew (a macOS package manager), then run the same key commands:

   zsh · macOS

   # Install WireGuard tools
   brew install wireguard-tools
   
   # Generate private key and public key
   
   wg genkey | tee client-private.key | wg pubkey > client-public.key
   
   # Generate pre-shared key (PSK)
   
   wg genpsk > client.psk

   For Windows users

   Windows doesn't support the WireGuard tools directly in the command line, but you have two easy options.

   Option 1 — use the WireGuard app. Download and install the Windows application from the WireGuard official website, then open a command prompt and run:

   cmd · Windows

   :: Generate private key and public key
   wg genkey > client-private.key
   type client-private.key | wg pubkey > client-public.key
   
   :: Generate pre-shared key (PSK)
   
   wg genpsk > client.psk

   Option 2 — use WSL (Windows Subsystem for Linux). If you prefer, install WSL and follow the Linux steps above.

   What you'll have

   • client-private.key: the client's private key (keep it safe!).
   • client-public.key: the client's public key (share this with the server).
   • client.psk: the pre-shared key (PSK).
2. 2

   Add the WireGuard server container

   Now configure the ALPON as your VPN server using a container. The Dockerfile below sets up a WireGuard server that generates its own key pair at build time and reads the client's public key (CLIENT_PUBLIC_KEY) and pre-shared key (CLIENT_PSK) from environment variables. Save it as Dockerfile:

   Dockerfile

   FROM alpine:latest
   
   RUN apk update && apk add wireguard-tools wireguard-tools-wg-quick bash gettext
   RUN mkdir -p /etc/wireguard
   WORKDIR /etc/wireguard
   RUN umask 077
   
   # Generate server keys
   RUN wg genkey | tee server.key | wg pubkey > server.pub
   
   # Create WireGuard server configuration template
   RUN echo "[Interface]" > /etc/wireguard/wg0.conf.template && \\
       echo "Address = 10.200.0.1/24, fd09:4722::1/64" >> /etc/wireguard/wg0.conf.template && \\
       echo "ListenPort = 22222" >> /etc/wireguard/wg0.conf.template && \\
       echo "PrivateKey = $(cat server.key)" >> /etc/wireguard/wg0.conf.template && \\
       echo "[Peer]" >> /etc/wireguard/wg0.conf.template && \\
       echo "PublicKey = \\${CLIENT_PUBLIC_KEY}" >> /etc/wireguard/wg0.conf.template && \\
       echo "PresharedKey = \\${CLIENT_PSK}" >> /etc/wireguard/wg0.conf.template && \\
       echo "AllowedIPs = 10.200.0.2/32, fd09:4722::2/128" >> /etc/wireguard/wg0.conf.template
   
   # Set the command to generate the config and start WireGuard
   CMD sh -c "envsubst < /etc/wireguard/wg0.conf.template > /etc/wireguard/wg0.conf && \\
              wg-quick up /etc/wireguard/wg0.conf && \\
              sleep infinity"

   Open a terminal on your computer, navigate to the folder with your Dockerfile, and build the arm64 image:

   bash · build the image

   docker buildx build --platform linux/arm64 -t private-network:latest ./

   Then log in to Sixfab Registry, click + Add Container, and follow the prompts to push the image.

   Pushing images to the Sixfab Container Registry

   For the full walkthrough of tagging and pushing an image, see Update Containers from the Sixfab Container Registry and the Deploy Applications page.

3. 3

   Deploy the container on ALPON

   Once the image is in the Sixfab Container Registry, open your device in ALPON Cloud, go to the Applications section, and click + Deploy. In the Deploy Container window, use these settings:

   Container Name private-network

   Image The private-network image and tag you pushed to the Sixfab Container Registry.

   Environment Click + Add More and add the two variables in the table below with your client's values from step 1.

   Enable Host Network Turn this on.

   Privileged Turn this on so the container can create the wg0 interface.

   Key	Value
   CLIENT_PUBLIC_KEY	Contents of client-public.key
   CLIENT_PSK	Contents of client.psk

   Click + Deploy to start the WireGuard server on the device.

4. 4

   Get the server's public key

   After the private-network container is deployed, open its shell from ALPON Cloud using the shell button shown below.

   

   In the container shell, print the server's public key and copy the output — this is your server-public-key:

   container shell · private-network

   cat server.pub

5. 5

   Configure your client

   The client needs its own configuration file, client.conf, built from the server's public key and the pre-shared key. Here is an example configuration:

   client.conf

   [Interface]
   Address = 10.200.0.2/32, fd09:4722::2/128
   DNS = 1.1.1.1
   PrivateKey = <client-private-key>
   
   [Peer]
   PublicKey = <server-public-key>
   PresharedKey = <client-psk>
   AllowedIPs = 10.200.0.1/32, fd09:4722::1/128
   Endpoint = <your-public-ip-or-domain>:22222
   PersistentKeepalive = 25

   Replace the following placeholders:

   • <client-private-key>: the client's private key (from client-private.key).
   • <server-public-key>: the server's public key (from server.pub inside the container).
   • <client-psk>: the pre-shared key (from client.psk).
   • <your-public-ip-or-domain>: the public IP or domain of the server.
6. 6

   Connect to your VPN

   Import the config. On the client device, open the WireGuard app, click + → Import from file, and select client.conf.

   Activate the VPN. In the WireGuard app, toggle the switch to connect, then verify the connection by checking the status in the app.

7. 7

   Test your connection

   Make sure everything works by deploying a simple Nginx server on the ALPON and reaching it through the tunnel. In the Applications section, click + Deploy and use these settings:

   Container Name nginx-test

   Image Turn on “I would like to use my own container path” and enter nginx:latest.

   Ports Click + Add More and add the port mapping in the table below.

   From	To
   31080	80

   Click Deploy to start the application, then open the server's VPN address in a browser on the connected client:

   browser · Nginx over the VPN

   http://10.200.0.1:31080

   If the client is connected successfully, the Nginx welcome screen appears in your browser.

sudo ip link del wg0

The container shell button in the Applications section of ALPON Cloud.