Provisioning a VPN server means more than just installing WireGuard. TunnelFleet handles the entire lifecycle: VM creation, package installation, cryptographic key generation, network configuration, and firewall setup — without any SSH access.
Create the VM
Log in to cloud provider, choose specs, wait for it to start.
SSH in and update packages
SSH in, run apt update, wait for completion.
Install WireGuard
Install WireGuard packages, verify installation.
Generate keys
wg genkey | tee privatekey | wg pubkey > publickey — set correct permissions.
Write the wg0.conf
Create /etc/wireguard/wg0.conf with address, private key, listen port.
Configure IP forwarding
Edit /etc/sysctl.conf or /etc/sysctl.d/, apply with sysctl -p.
Set up NAT/firewall rules
iptables/nftables PostUp/PreDown rules in the WireGuard config. ufw or iptables.
Start and enable the service
systemctl enable wg-quick@wg0 && systemctl start wg-quick@wg0
Verify everything works
Check interface status, test connectivity, verify firewall.
Every step above happens inside TunnelFleet's provisioning pipeline. You trigger the process via the dashboard or API. TunnelFleet calls your cloud provider, generates and passes a cloud-init script, and polls for completion.
Nothing about this process requires your involvement after clicking deploy. The result is a running WireGuard server, with keys, with firewall rules, visible in your dashboard with its public IP and public key.
TunnelFleet calls the DigitalOcean API (or future providers) to create the VM with the correct specs and user-data.
A tailored cloud-init script runs on first boot: package install, key generation, interface config, sysctl, and firewall.
WireGuard keypairs are generated on the server. The private key never leaves the VM. TunnelFleet stores only the public key.
After provisioning completes, the server calls back to TunnelFleet with its public key and status. The dashboard updates immediately.
TunnelFleet installs WireGuard, generates a keypair, writes /etc/wireguard/wg0.conf, enables IP forwarding, configures UFW firewall rules, and starts the wg-quick@wg0 systemd service. It also registers the server's public key with TunnelFleet via an HTTPS callback.
No. Once the server is provisioned via cloud-init, TunnelFleet manages it through API polling and server-side callbacks. SSH access is never required.
You can always SSH into the server using DigitalOcean's root password or your own SSH key (added to DigitalOcean separately). The WireGuard config is at /etc/wireguard/wg0.conf. Changes made directly on the server may not sync back to TunnelFleet's dashboard.
TunnelFleet currently provisions new servers from scratch. Reprovisioning an existing server is not supported; you would need to delete and recreate it.
Start your free TunnelFleet trial today and provision your first VPN server in minutes.