Wolkra

WireGuard VPN server in Frankfurt

Updated

The WireGuard app gives you a Frankfurt cloud server with the WireGuard VPN installed, so you have your own private VPN with an exit address in Germany a few minutes after the server boots.

You control the server, the keys and the logs, and traffic through the tunnel is unmetered.

What is installed

  • WireGuard, the open-source VPN built into the Linux kernel, configured as a server.
  • Packet forwarding and the network settings a VPN server needs.
  • A standard Linux system with full root access.

WireGuard uses modern cryptography and a small code base. Connections are quick to set up and stay stable when a phone switches between Wi-Fi and mobile data.

Which plan to start with

WireGuard needs very little. The smallest Standard plan carries a personal VPN and a family's devices without trouble. Choose a larger plan only if many people share the server or you run other software on it.

Standard

Shared vCPU for websites, apps, VPNs and development.

PlanvCPURAMDiskTrafficHourlyMonthly cap
S011 GB15 GBUnmetered€0.0056€3.49
S112 GB30 GBUnmetered€0.0080€4.99
S224 GB40 GBUnmetered€0.0144€8.99
S328 GB50 GBUnmetered€0.0200€12.49
S448 GB80 GBUnmetered€0.0288€17.99
S5416 GB100 GBUnmetered€0.0400€24.99

A primary IPv4 address costs €0.89 a month and an IPv6 address is included. Billing is hourly from a prepaid balance, capped at the monthly price.

Signing in after boot

  1. Create a server in the console and choose WireGuard as the app.
  2. Wait until the server is running, then give the setup a minute or two.
  3. Connect with SSH as root, using your SSH key or the emailed root password. See connect with SSH.
  4. Check that the VPN interface is up:
wg show

From here you create a configuration for each client device and import it into the WireGuard app on that device.

First steps

Add a client

Each device needs its own key pair and a matching peer entry on the server. A client configuration has this shape:

[Interface]
PrivateKey = <client private key>
Address = <the client's address inside the VPN>
DNS = <a DNS resolver you trust>

[Peer]
PublicKey = <server public key>
Endpoint = <your server's address or domain>:<WireGuard port>
AllowedIPs = <the networks to send through the tunnel>
PersistentKeepalive = 25

AllowedIPs decides what goes through the VPN. Use the catch-all IPv4 and IPv6 ranges to send all traffic through Frankfurt, or list only your private network ranges to reach your servers and leave other traffic alone. WireGuard listens on a UDP port, 51820 by default. Our WireGuard VPN server guide covers key generation and adding peers step by step. On phones, you can turn a configuration into a QR code and scan it.

Open only what you need

Attach a free firewall that allows the WireGuard UDP port and SSH, and nothing else. You can limit SSH to your own address, or reach SSH only through the VPN once it works.

Set reverse DNS

Set reverse DNS (PTR) for the server's IP to a name you own so the address looks tidy in logs. See IP addresses.

Common setups

  • Personal privacy VPN. Route all traffic from your laptop and phone through Frankfurt on public Wi-Fi.
  • Access to private servers. Put WireGuard in a private network and reach databases or admin panels that have no public IP.
  • Team access. Give each colleague their own peer and remove it when they leave.
  • Site-to-site. Connect an office router or another server to your Wolkra network.

Using a floating IP as the endpoint lets you move the VPN to a new server without changing every client.

If a client does not connect

Check that the firewall allows the WireGuard UDP port, that the endpoint in the client configuration matches the server, and that the server has the client's public key. wg show lists a recent handshake for every peer that works.

Why run WireGuard on Wolkra

  • Unmetered traffic with fair use, on ports up to 10 Gbit/s, shared. Streaming and large downloads carry no per-GB fees.
  • A German exit. Your traffic leaves from Frankfurt, with low latency across Europe from the centre of Europe. See VPS Frankfurt.
  • Your own server. No shared VPN provider and no third-party logging. You decide what is logged.
  • Pay as you go. Hourly billing, prepaid by card or crypto. See crypto VPS.

Please use your VPN within our Acceptable Use Policy. For more on running a VPN, see VPN server in Germany.

Start your WireGuard server

Create an account, add balance, and choose the WireGuard app. Your own VPN in Germany is ready in minutes.

Frequently asked questions

What does the WireGuard app install?

The open-source WireGuard VPN on a standard Linux server, set up as a VPN server that you add client devices to.

Which plan do I need for WireGuard?

The smallest Standard plan is enough for personal use and a few devices. WireGuard is very light on CPU and memory.

Is traffic through my VPN metered?

No. Traffic is unmetered on every plan, with a fair-use policy. Ports go up to 10 Gbit/s, shared.

Which devices can connect?

WireGuard has official clients for Windows, macOS, Linux, iOS and Android. Each device gets its own key and configuration.

Can I use the VPN to reach private servers?

Yes. Put the WireGuard server in a private network with your other servers, and connected devices can reach them without those servers having public IPs.