Home Guides

Guides

Practical how-to guides for common tasks, configurations, and best practices.
Onidel
By Onidel and 1 other
11 articles

IPv6 Configuration On Linux

We offer free, fully routed /64 IPv6 per cloud server. We do not support automatic (SLAAC) or dynamic (DHCPv6) IPv6 assignment for the time being. If you use our pre-built images and enable IPv6 during the initial deployment of your cloud server, it will be automatically configured via cloud-init (Linux) or cloudbase-init (Windows). If you install your OS using a custom ISO or enable IPv6 after the server has been created, you will need to configure it manually. You can find necessary details to configure your IPv6 prefix in the Public IPv6 tab under the Network section. Ubuntu 18.04, 20.04 / Debian 10, 11 1. Create a new netplan file for the IPv6 config e.g. /etc/netplan/90-ipv6.yml. Replace 2401:a4a0:2:a3::/64 with your unique IPv6. network: ethernets: eth0: addresses: - 2401:a4a0:2:a3::/64 gateway6: fe80::1 version: 2 2. Enable the new config: sudo netplan apply 3. Confirm IPv6 is configured: ip -6 a Ubuntu 22.04+ / Debian 12+ 1. Create a new netplan file for the IPv6 config e.g. /etc/netplan/90-ipv6.yml. Replace 2401:a4a0:2:a3::/64 with your unique IPv6. network: ethernets: eth0: addresses: - 2401:a4a0:2:a3::/64 routes: - to: default via: fe80::1 version: 2 2. Enable the new config: sudo netplan apply 3. Confirm IPv6 is configured: ip -6 a RHEL (CentOS, AlmaLinux) 7-8 1. Append the IPv6 configuration to the existing configuration file in /etc/sysconfig/network-scripts/ifcfg-eth0 without removing the current settings, as shown below. Replace 2401:a4a0:2:a3::/64 with your assigned unique IPv6 block. IPV6ADDR=2401:a4a0:2:a3::/64 IPV6INIT=yes IPV6_DEFAULTGW=fe80::1%eth0 2. Restart the network service: sudo systemctl restart network 3. Confirm IPv6 is configured: ip -6 a RHEL (CentOS, AlmaLinux) 9 1. Run the following command to add the IPv6 configuration to the interface. Replace 2401:a4a0:2:a3::/64 with your assigned unique IPv6 block. nmcli connection modify eth0 \ ipv6.addresses 2401:a4a0:2:a3::/64 \ ipv6.gateway fe80::1 \ ipv6.method manual \ ipv6.may-fail yes 2. Enable the new configuration: nmcli connection up eth0 3. Confirm IPv6 is configured: ip -6 a

Last updated on Aug 24, 2025

How to Configure Reverse DNS

Reverse DNS (rDNS), also known as a PTR record, links an IP address to a domain name, typically a subdomain. This process works in the opposite direction of regular (forward) DNS, where a domain name is connected to an IP address. For example, if you set the reverse DNS for IP 123.123.123.123 to mail.example.com: - When you query the IP address of mail.example.com using a command like DIG, you'll receive the IP 123.123.123.123. - Conversely, performing a reverse DNS lookup on 123.123.123.123 will return mail.example.com. Reverse DNS is often used to verify the source of an email, adding an extra layer of security. Many email servers are configured to reject or flag messages as spam if the sending IP does not have a valid reverse DNS record. How to Configure Reverse DNS To configure the reverse DNS, log in to the Onidel Cloud Control Panel, navigate to the service that has the IP you want to configure and click on Reverse DNS tab: You can view the list of IPs associated with the server that have PTR records configured in the Reverse DNS Records table. To add a new Reverse DNS record or update an existing one, input the IP address concerned and enter the domain and click Add/Update Reverse DNS. Adding a new record will also delete any invalid PTR record has the same domain. When you add or update a record, our system immediately checks if the A Record points to the specified IP address. If the A record is changed after reverse DNS has been set, our system may remove the reverse DNS for that address.

Last updated on Aug 27, 2025

Disable or Change Windows Server Account Lockout

When attempting to connect to your Windows Server via Remote Desktop, you may encounter this security error: "As a security precaution, the user account has been locked out because there were too many logon attempts or password change attempts. Wait a while before trying again, or contact your system administrator or technical support." This occurs when Windows Server's default security policy temporarily locks accounts after multiple failed login attempts, preventing unauthorised access attempts while potentially blocking legitimate users. Understanding Account Lockout Policies Windows Server implements account lockout policies as a security measure against brute-force attacks. The system tracks failed login attempts and temporarily disables accounts that exceed the configured threshold. These policies include: - Account lockout threshold: Number of failed attempts before lockout - Account lockout duration: How long the account remains locked - Reset account lockout counter after: Time before the failed attempt counter resets Solution: Modify Account Lockout Settings Access Local Security Policy 1. Use Onidel Console feature to access to the Windows. 2. Click the Start button or press the Windows key 3. Type secpol.msc or search for Local Security Policy 4. Run the application as Administrator Navigate to Account Lockout Settings 1. In the Local Security Policy window, expand Account Policies in the left panel 2. Select Account Lockout Policy 3. You'll see three configurable settings in the right panel Configure the Settings Option 1: Disable Account Lockout (Less Secure) - Double-click Account lockout threshold - Set the value to 0 (zero) - Click OK to apply - This completely disables account lockouts, allowing unlimited login attempts Option 2: Adjust Lockout Parameters (Recommended) - Account lockout threshold: Set to a reasonable number (e.g., 5-10 attempts) - Account lockout duration: Configure in minutes (e.g., 30 minutes) - Set to 0 for manual unlock only by administrator - Set to a specific value for automatic unlock after that duration - Reset account lockout counter after: Set the time window for counting attempts (e.g., 30 minutes) Apply Changes After modifying the settings: 1. Click OK to save each setting 2. Close the Local Security Policy window 3. Changes take effect immediately - no restart required Security Considerations While disabling or reducing account lockout restrictions improves accessibility, consider these security implications: - Disabling lockouts (threshold = 0) removes protection against brute-force attacks - Short lockout durations may not sufficiently deter automated attacks - High thresholds reduce security but minimise accidental lockouts For production servers, we recommend: - Maintain a threshold of 5-10 attempts - Set lockout duration to 15-30 minutes - Use complex passwords to reduce the likelihood of successful attacks - Consider implementing additional security layers like IP whitelisting or VPN access

Last updated on Nov 02, 2025

Using your own domain with Onidel Object Storage

This guide walks you through configuring a custom domain to serve content from Onidel Object Storage, enabling you to host static websites or serve files using your own domain name instead of the default Onidel storage URLs. Prerequisites Before starting, ensure you have: - An active Onidel Object Storage service. - A registered domain name that you control - Access to your domain's DNS management panel - A Cloudflare account (recommended for SSL and CDN capabilities) Overview Onidel Object Storage supports static website hosting with custom domains through a straightforward configuration process. By creating a specially-named bucket and configuring DNS records, you can serve your content directly from your own domain with full SSL support through Cloudflare's proxy service. Step 1: Create a Domain-Matched Bucket The first requirement is creating a bucket with a name that exactly matches your intended domain. Creating the Bucket Navigate to your Onidel Object Storage dashboard and create a new bucket. The bucket name must precisely match the domain or subdomain you plan to use. Examples: - For example.com, create a bucket named example.com - For cdn.example.com, create a bucket named cdn.example.com - For assets.mysite.io, create a bucket named assets.mysite.io The bucket name must match the full domain including any subdomains. This naming convention is essential for the routing system to correctly map requests to your bucket. Throughout this tutorial, we use a setup based on the domain mydomain.onidel.com.au. Step 2: Configure Bucket Visibility After creating your bucket, you need to modify its access permissions to allow public access for web hosting. Changing Visibility Settings 1. Access your bucket through the Onidel Object Storage dashboard 2. Navigate to the Settings tab for your bucket 3. Locate the Bucket Visibility in Access & Versioning section 4. Change the setting from Private to Public This modification allows anonymous users to read objects in your bucket, which is necessary for serving website content to visitors. Step 3: Enable Static Website Hosting With your bucket configured for public access, the next step is enabling static website hosting functionality. Activating Website Hosting 1. Navigate to the Website tab for you bucket. 2. Enable the static website hosting option 3. Configure the following settings as needed: a. Index Document: Specify your default page (typically index.html) b. Error Document: Define your custom error page (typically 404.html or error.html) 4. Save your configuration Understanding Your Website Endpoint Once static website hosting is enabled, Onidel Object Storage generates a unique website endpoint for your bucket. This endpoint follows a specific format based on your bucket's region: http://<your-domain>.s3-website.<region>.onidel.cloud Make note of this endpoint URL as you'll need it for DNS configuration in the next step. Step 4: Configure DNS Records The final step involves pointing your domain to the Onidel Object Storage endpoint through DNS configuration. Access your domain's DNS management panel (this might be through your domain registrar, Cloudflare, or another DNS provider) and create a CNAME record pointing to the endpoint from step 3. We recommend using Cloudflare to take advantages of automatic SSL/TLS encryption, CDN caching and DDoS protection: Verifying Your Configuration After completing the setup, verify your configuration: 1. DNS Propagation: Wait 5-15 minutes for DNS changes to propagate 2. Test Access: Navigate to your domain in a web browser 3. SSL Verification: If using Cloudflare proxy, verify HTTPS access works Your custom domain is now configured to serve content from Onidel Object Storage. Visitors accessing your domain will receive files directly from your bucket (with SSL encryption through Cloudflare's proxy if using Cloudflare). If you encounter any issues during setup, please open a support ticket through your dashboard and we'll be happy to assist.

Last updated on Feb 26, 2026

How to mount and use Block Storage

Block Storage is currently supported at 4 locations: - Australia (HDD and SSD NVMe) - Singapore (HDD and SSD NVMe) - Netherlands (SSD NVMe) - USA (SSD NVMe) It works as an addon to your existing VPS. You can easily move the storage between VMs in the same region since Block Storage can be attached and detached at any time. Block Storage behaves just like a regular storage device, on Linux it can be partitioned and mounted with a filesystem. In this tutorial we will buy and mount Block Storage to use as storage for Nextcloud data disk. You may have other use case, but the setup itself should be pretty similar. Creating Block Storage 1. Ensure you have an active VM in the desired location. In the Onidel Cloud Panel, go to Compute > Virtual Machine to see a list of your Virtual Machines. 2. Next, navigate to Storage > Block Storage and click on New Block Storage button. 3. Then you will be asked for storage type and location you want the storage to be created in. The storage type selection should depend on your intended workload, in our case HDD storage should work just fine for storing personal files with Nextcloud. Make sure the location is the same as your VM. It can not be changed once the storage is ordered. 4. Next, pick your desired Billing cycle, Storage name and Disk size and click Deploy Now. The name can be changed later and disk size can be increased (but not decreased) on demand. 5. After paying the generated invoice, you should see the service being active in the list of Block Storages. Attaching Block Storage to the VM 1. By clicking into the newly Block Storage, you can select which VM to mount it to. The dropdown should show all VMs you have running in the same location as your storage block. 2. After selecting the VM you want to attach the storage to, click on Save Changes button and Confirm you want to make changes to this service. 3. The VM instance should now be listed alongside your storage in Block Storages list. 4. After going to Compute > Virtual Machine > (select your VM) > Storage > Disks, you should also see the storage now being attached properly from there. Mounting Block Storage inside the VM 1. Firstly, login into your Virtual Machine using SSH. You will need root privileges to perform most of the tasks listed below. 2. Verify the storage was mounted correctly inside the guest OS. root@vm-sg:~# lsblk NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINTS sr0 11:0 1 1024M 0 rom sr1 11:1 1 4M 0 rom vda 254:0 0 20G 0 disk ├─vda1 254:1 0 19.9G 0 part / ├─vda14 254:14 0 3M 0 part └─vda15 254:15 0 124M 0 part /boot/efi vdb 254:16 0 1000G 0 disk Your 1TB block storage drive /dev/vdb should be visible at the bottom. 3. Now you can create partition table and first partition on the drive. We will use fdisk for that - to create GPT partition table, use the g command, then create one large partition with n and write changes to the drive with w. Leave defaults where asked. root@vm-sg:~# fdisk /dev/vdb Welcome to fdisk (util-linux 2.41). Changes will remain in memory only, until you decide to write them. Be careful before using the write command. Device does not contain a recognized partition table. Created a new DOS (MBR) disklabel with disk identifier 0x77eca7ed. Command (m for help): g Created a new GPT disklabel (GUID: C54D761B-AD48-4C64-93A2-FA5D78F118AD). Command (m for help): n Partition number (1-128, default 1): First sector (2048-2097151966, default 2048): Last sector, +/-sectors or +/-size{K,M,G,T,P} (2048-2097151966, default 2097149951): Created a new partition 1 of type 'Linux filesystem' and of size 1000 GiB. Command (m for help): w The partition table has been altered. Calling ioctl() to re-read partition table. Syncing disks. 4. Next, create a filesystem on the one large partition we just created. Here, we create ext4 filesystem using mkfs.ext4, but you can use other one if you want. root@vm-sg:~# mkfs.ext4 /dev/vdb1 mke2fs 1.47.2 (1-Jan-2025) Discarding device blocks: done Creating filesystem with 262143488 4k blocks and 65536000 inodes Filesystem UUID: 201c4e8d-1d35-48d0-aa8b-97dd893a4795 Superblock backups stored on blocks: 32768, 98304, 163840, 229376, 294912, 819200, 884736, 1605632, 2654208, 4096000, 7962624, 11239424, 20480000, 23887872, 71663616, 78675968, 102400000, 214990848 Allocating group tables: done Writing inode tables: done Creating journal (262144 blocks): done Writing superblocks and filesystem accounting information: done 5. Create mount point for created partition (can be arbitrary directory on your system). root@vm-sg:~# mkdir /mnt/nextcloud-data 6. Note down the PARTUUID value of your partition. root@vm-sg:~# lsblk -o PARTUUID /dev/vdb1 PARTUUID 78ddd192-302a-46b1-95a5-94bf16f99a50 7. Add this entry at the end of /etc/fstab file (replace PARTUUID value with the one you got above and mount point if different one was used): PARTUUID=78ddd192-302a-46b1-95a5-94bf16f99a50 /mnt/nextcloud-data ext4 rw,noatime,errors=remount-ro,x-systemd.growfs 0 2 8. To check if everything was done properly, mount all fstab entries with mount -a and verify the filesystem was mounted: root@vm-sg:~# mount -a mount: (hint) your fstab has been modified, but systemd still uses the old version; use 'systemctl daemon-reload' to reload. root@vm-sg:~# systemctl daemon-reload root@vm-sg:~# df -h /dev/vdb1 Filesystem Size Used Avail Use% Mounted on /dev/vdb1 984G 2.1M 934G 1% /mnt/nextcloud-data After the addition to fstab, the filesystem should be remounted automatically on each boot. Nextcloud specific configuration You can skip this section if not interested. By this point, your storage should be configured properly and ready to use! 1. There are several ways of running Nextcloud but probably the easiest way is to go with Docker and docker compose. 2. You can use this docker compose file and replace the mount points so that the app uses your Storage Block as storage for data: ... image: nextcloud restart: always ports: - 8080:80 depends_on: - redis - db volumes: - /mnt/nextcloud-data:/var/www/html/data - config:/var/www/html/config - apps:/var/www/html/apps ... Remember this setup is only for demonstration purposes. In reality, you need to secure your Nextcloud instance - setup strong passwords and use a reverse proxy to communicate over HTTPS. 3. You may need to change permissions on the storage directory to align with the user Nextcloud is running as (id 33), like mentioned here: root@vm-sg:~# chown -Rv 33:33 /mnt/nextcloud-data/ changed ownership of '/mnt/nextcloud-data/lost+found' from user:user to 33:33 changed ownership of '/mnt/nextcloud-data/' from user:user to 33:33 4. After the initial setup, you Nextcloud should be using your Block Storage drive. Upgrading the Block Storage If you ever run out of capacity on your block storage, you can easily upgrade it from Onidel Cloud panel. 1. Go to Storage > Block Storage > (select your Block Storage) > Upgrade. 2. Then increase the size of your drive using the slider and click the Upgrade button. 3. Confirm the change and pay the generated invoice. 4. Now, going back to the SSH console, you will see the drive changed size to 2TB, however the partition is still only 1TB. root@vm-sg:~# lsblk /dev/vdb vdb 254:16 0 2T 0 disk └─vdb1 254:17 0 1000G 0 part /mnt/nextcloud-data 5. The easiest way to resize partition is to use the growpart command as such: root@vm-sg:~# growpart /dev/vdb 1 CHANGED: partition=1 start=2048 old: size=2097149951 end=2097151966 new: size=4194301919 end=4194303966 6. After this, reboot your VM and the x-systemd.growfs hook we specified in fstab earlier should automatically resize the filesystem as well. Then you will see the new size being available. FAQ Can my Storage Block be moved to another location? No, the Storage Blocks are limited only to one location and can only be used in location they were created in. Can a Storage Block be moved to different VM? Yes. You just need to unmount and detach a Storage Block from your VM and attach, then mount it to another one. This is possible as long as all VMs are in the same location. Is it possible to shrink a Storage Block? No, we do not support shrinking a Storage Block due to high risk of data loss. If you need to shrink a storage block, you will need to create a new, smaller one and migrate your data manually there. Can storage type be changed? No, storage type (HDD vs SSD NVMe) can not be changed after the Storage Block is created. You will need to migrate your data manually. What kind of IO performance to expect? Some quick benchmarks I ran in Singapore using ext4 as a filesystem on mounted storage with yabs.sh (fio) to measure the IO performance: NVMe SSD fio Disk Speed Tests (Mixed R/W 50/50) (Partition /dev/vdb1): --------------------------------- Block Size | 4k (IOPS) | 64k (IOPS) ------ | --- ---- | ---- ---- Read | 136.29 MB/s (34.0k) | 1.09 GB/s (17.1k) Write | 136.65 MB/s (34.1k) | 1.10 GB/s (17.2k) Total | 272.94 MB/s (68.2k) | 2.20 GB/s (34.4k) | | Block Size | 512k (IOPS) | 1m (IOPS) ------ | --- ---- | ---- ---- Read | 1.04 GB/s (2.0k) | 1.03 GB/s (1.0k) Write | 1.10 GB/s (2.1k) | 1.10 GB/s (1.0k) Total | 2.14 GB/s (4.1k) | 2.13 GB/s (2.0k) HDD fio Disk Speed Tests (Mixed R/W 50/50) (Partition /dev/vdb1): --------------------------------- Block Size | 4k (IOPS) | 64k (IOPS) ------ | --- ---- | ---- ---- Read | 40.03 MB/s (10.0k) | 629.06 MB/s (9.8k) Write | 40.13 MB/s (10.0k) | 632.37 MB/s (9.8k) Total | 80.16 MB/s (20.0k) | 1.26 GB/s (19.7k) | | Block Size | 512k (IOPS) | 1m (IOPS) ------ | --- ---- | ---- ---- Read | 922.29 MB/s (1.8k) | 902.43 MB/s (881) Write | 971.29 MB/s (1.8k) | 962.53 MB/s (939) Total | 1.89 GB/s (3.6k) | 1.86 GB/s (1.8k) Do not take those as a guarantees, the actual results may differ based on storage utilization and other factors in a shared environment.

Last updated on Mar 02, 2026

Custom ISOs

Custom ISO images are fully supported on Onidel Cloud. It enables you to perform installation from your own installation media which can be handy for Uniform deployments, Encrypted Drive installations or just deploying an OS that is not available from our templates. Onidel supports Custom ISOs of size up to 10 GB. Installation from Custom ISO Upload ISO image 1. First, obtain a direct HTTP or HTTPS link to your ISO image. Our panel does not support uploading ISO images directly from your PC, so you will need to prepare a link to the ISO image you want to use. Please note services like Google Drive or Dropbox usually do not support sharing direct links. 2. Login into your Onidel Cloud Account, then go to Orchestration > Custom ISOs. 3. Now paste the direct ISO link into the Remote URL field and click the Upload button. 4. After this, the download of your custom ISO image should start. 5. Once it's finished you will see the custom ISO in the list of available ones below. Deploying a new VM with your Custom ISO 1. If you want to provision a new Virtual Machine using the image you just uploaded, go to Compute > Virtual Machine > Deploy New Server, then in the Software part, select the image from the ISO tab. 2. Next, select your desired specifications and adjust all necessary deployment settings and create the VM as usual by clicking the Deploy Now button. 3. After the VM is created, you can click on the View Console button and install your custom ISO manually. Reinstalling an existing VM into your Custom ISO 1. To reinstall an already provisioned Virtual Machine with your Custom image, you need to mount the custom ISO in the Compute > Virtual Machine > (select your VM) > Storage > ISO images. 2. Now, you should see the custom ISO you have uploaded before. Click Attach on the ISO you want to reinstall from. 3. You will now be asked to confirm whether the Virtual Machine can be reboot (to adjust the boot order and make it boot from your ISO automatically). Click check the checkbox and click the Attach ISO button. 4. After this, the VM will reboot into the ISO your just mounted and you can proceed with manual installation using the VM Console. Troubleshooting If your Virtual Machine did not boot into your Custom ISO despite it being mounted properly, check the Boot Mode selection inside Settings tab of your VM and try changing it to match the boot mode that is supported by your custom ISO.

Last updated on Mar 02, 2026

VM Snapshots

Onidel Cloud supports taking, restoring and downloading snapshots of Virtual Machines. Creating Snapshot of a VM 1. Navigate to Compute > Virtual Machine > (select your VM) > Storage > Snapshots. 2. Click on Create Snapshot button, choose a Name and optional Description of the snapshot. 3. Creating a snapshot usually takes a few minutes depending on the size of the drive. You should see Snapshot In Progress status on the VM. During all this time your VM will stay online but you can't perform any actions on it. 4. After this is finished, you should see the snapshot in the list under Storage > Snapshots. From there, you can Restore, Download or Delete the snapshot. Restoring from a Snapshot 1. Navigate to Compute > Virtual Machine > (VM to restore snapshot on) > Storage > Snapshots. 2. Then, click the Restore button of a selected snapshot. 3. Next you will be asked to confirm whether it's okay for a snapshot to be restored there. Keep in mind, restoring a snapshot will overwrite all existing data of the target VM. 4. After confirming, the VM will start being restored. 5. The process should take a few minutes and after this, the VM will boot from disk restored from snapshot. Deploying new VM from a Snapshot You can also use it as base image when creating a new Virtual Machine. Just go to Compute > Virtual Machine > Deploy New Server, then in the Software part, select your snapshot from the Snapshot tab. In most cases, the new VM will get a different IP address and hostname (as set during deployment). Those are automatically managed by cloud-init on all major Linux distributions. All other configuration and data will be recreated from the snapshot. FAQ Price 2 snapshots per account are free. If you need more, please contact us via ticket. Location Snapshots are tied to a specific location, so a snapshot of a VM in one location can only be restored within the same location, either on the same or different Virtual Machine. Target drive size Snapshots can only be restored to a target with equal or larger drive. Restoring snapshot to a Virtual Machine with a smaller disk is not supported. Retention Snapshots are not removed when destroying a VM they were taken from. If you no longer need a snapshot, you need to delete it separately.

Last updated on Mar 02, 2026

How to set up a WireGuard VPN Server

WireGuard is a modern, fast, and secure VPN protocol. In this tutorial, we will set up a private WireGuard VPN Server running on a Virtual Machine in Onidel Cloud. We will configure the server, enable network routing so your clients can access the internet through the VPN, and configure a client device to connect to it. Prerequisites You will need a running VM with your Linux distribution of choice installed. The specs can be very modest as WireGuard will run well on basically any modern hardware. Hardware Our smallest plan with 1 vCPU, 1 GB RAM and 20 GB SSD should be more than enough to follow this tutorial. Network and Traffic More important factor for VPN server may be the traffic allocation - for a personal VPN however you will most likely not use more than a few hundred gigabytes per month. If you plan to share the VPN with your family and friends, you may consider purchasing additional bandwidth or polling with another VM in the same region. Additionally remember that if you want to host a public VPN, you must follow and enforce Onidel's Terms of Service and Acceptable Usage Policy onto the users. Thus, providing public VPN services is generally discouraged. Connectivity The tutorial assumes your server has both IPv4 and IPv6 connectivity. It's recommended to enable IPv6 on the VM either at purchase time or later by going to (Your VM) > Network > Public Network > Enable IPv6. Install Dependencies To run WireGuard, you need to install the WireGuard kernel module and the userspace tools that allow you to generate keys and manage the VPN interface. You will also need iptables to configure traffic routing. Both of those can be installed in different ways depending on your Linux distribution of choice: Debian/Ubuntu $ apt update && apt upgrade $ apt install wireguard iptables CentOS/RHEL/Alma/Rocky $ dnf install -y epel-release elrepo-release $ dnf update $ dnf install kmod-wireguard wireguard-tools iptables-services Set up IP Forwarding Routing internet traffic via your VPS server requires IPv4 and IPv6 to be forwarded by your OS. You can enable it by setting net.ipv4.ip_forward and net.ipv6.conf.all.forwarding parameters in sysctl. $ nano /etc/sysctl.d/99-wireguard.conf net.ipv4.ip_forward=1 net.ipv6.conf.all.forwarding=1 Those rules will now apply after a reboot, but you can also apply them it immediately with sysctl -p command: $ sysctl -p /etc/sysctl.d/99-wireguard.conf Generate server keys WireGuard utilizes a public and private key pair for cryptography. Let's generate the keys for your server. Navigate to the WireGuard directory and set your umask to 077 so that the generated key files are only readable by the root user: $ cd /etc/wireguard $ umask 077 $ wg genkey | tee server_private_key | wg pubkey > server_public_key You can view the contents of these files using cat server_private_key and cat server_public_key. You will need them in the next step. Create the Wireguard Interface Configuration - Note: While this guide assumes your primary network interface is eth0 (the default on Onidel Cloud VMs), yours might be named differently (e.g. ens3 or enp6s18). Verify your interface name using the ip a command: $ ip a 2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000 link/ether 0c:1d:e1:cd:56:32 brd ff:ff:ff:ff:ff:ff inet 104.250.118.103/24 brd 104.250.118.255 scope global eth0 valid_lft forever preferred_lft forever ... If your interface is not eth0, make sure to replace eth0 with your actual interface name in the PostUp and PostDown lines below. Next, create the configuration file for the WireGuard interface (wg0): $ nano /etc/wireguard/wg0.conf Add the following configuration. Be sure to replace <SERVER_PRIVATE_KEY> with the contents of your server_private_key file. [Interface] Address = 10.8.8.1/24, fd88::1/64 ListenPort = 51820 PrivateKey = <SERVER_PRIVATE_KEY> PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE; ip6tables -A FORWARD -i %i -j ACCEPT; ip6tables -t nat -A POSTROUTING -o eth0 -j MASQUERADE PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE; ip6tables -D FORWARD -i %i -j ACCEPT; ip6tables -t nat -D POSTROUTING -o eth0 -j MASQUERADE The PostUp and PostDown commands ensure that traffic from the VPN interface (wg0) is masqueraded as it leaves the server's public interface (eth0), granting internet access to connected clients. Start the WireGuard Server Enable the WireGuard service to start automatically on system boot, and then start it: $ systemctl enable wg-quick@wg0 $ systemctl start wg-quick@wg0 Verify that the interface is up and running: $ wg show interface: wg0 public key: SNYVqnhP7qXO7idORIxBg+gtKcEHtExWOkXGYjDmim0= private key: (hidden) listening port: 51820 Configure the Firewall If you want to configure Firewall for your server, remember to add a traffic rule in the Firewall Group to allow UDP connections on WireGuard ListenPort. In this example, we will add two rules - for both IPv4 and IPv6 traffic. Add a Client To connect a client device (like a phone or laptop), you must generate a separate key pair for it and register its public key on the server. This should ideally be done on a trusted/client device so the server does now have the private key of a client. $ wg genkey | tee clientA_private_key | wg pubkey > clientA_public_key You may need to install WireGuard Userspace tools on the trusted device. Some WireGuard clients also let you generate client keys right from the app. Now, edit your server's WireGuard configuration to recognize this client: $ nano /etc/wireguard/wg0.conf Append the client's peer information at the bottom of the file. Replace <CLIENT_PUBLIC_KEY> with the contents of clientA_public_key (or public key generated by the app). [Peer] PublicKey = <CLIENT_PUBLIC_KEY> AllowedIPs = 10.8.8.2/32, fd88::2/128 Restart the WireGuard interface to apply the changes: $ systemctl restart wg-quick@wg0 Create the Client Configuration File Now, construct the configuration file (client.conf) that you will import into the WireGuard app on your client device. Replace the placeholders with your actual generated keys and your VPS's public IP address (or a domain pointing to it). [Interface] PrivateKey = <CLIENT_PRIVATE_KEY> Address = 10.8.8.2/24, fd88::2/64 DNS = 9.9.9.9, 2620:fe::fe, 1.1.1.1, 2606:4700:4700::1111 [Peer] PublicKey = <SERVER_PUBLIC_KEY> Endpoint = <YOUR_VPS_PUBLIC_ADDRESS>:51820 AllowedIPs = 0.0.0.0/0, ::/0 Setting AllowedIPs = 0.0.0.0/0, ::/0 tells the client to route all of its internet traffic (IPv4 and IPv6) through the VPN. Verify the Connection Once you import client.conf into your device's WireGuard application and connect, go back to your server and run: $ wg show interface: wg0 public key: SNYVqnhP7qXO7idORIxBg+gtKcEHtExWOkXGYjDmim0= private key: (hidden) listening port: 51820 peer: zH3EfBN2E+mXZHd8D4vb9pxihVWRHe+7IRtZDBaBuSs= endpoint: [redacted]:38445 allowed ips: 10.8.8.2/32, fd88::2/128 latest handshake: 6 seconds ago transfer: 11.95 KiB received, 27.34 KiB sent On the client you should be able to access websites with both IPv4 and IPv6: Next Steps Congratulations! You have successfully set up a private WireGuard VPN server on Onidel Cloud VM and connected a client securely. Now, you can add more clients to your server assigning each of them a different internal IP address.

Last updated on Mar 11, 2026