Client VPN

Client VPN is a managed WireGuard gateway on your Hetzner account. Users download a configuration file and connect from their devices.

How it works

  1. Create a client VPN instance and wait until Status is Ready.
  2. Add VPN users on the instance detail page.
  3. Download each user’s .conf file and import it into a WireGuard client.
  4. Connect; traffic follows full-tunnel or split-tunnel routing you chose at create time.

Concepts

Concept Description
Endpoint Public host:port clients dial (UDP listen port, default 51820)
Address pool Tunnel CIDR for VPN users (for example, 10.8.0.0/24; must be /30 or larger)
Full tunnel All client traffic goes through the VPN (0.0.0.0/0, ::/0)
Split tunnel Only the destination CIDRs you list are routed through the VPN

In the console

Choose Networking, Client VPN.

Topics