WZ-IT designs, configures and operates WireGuard for site connectivity and remote access. We handle routing, key lifecycle, segmentation, monitoring and integration with your existing network infrastructure.
About the technology
WireGuard is an extremely simple, fast, modern, and self-hosted VPN that uses state-of-the-art cryptography.
Thanks to direct integration into the Linux kernel and a compact codebase, WireGuard is faster than solutions like IPSec and OpenVPN. WireGuard is ideal for use as an isolated corporate network on servers, routers, desktops, and mobile devices.
Honest assessment
WireGuard follows the model of SSH: both parties exchange public keys, and cryptokey routing maps each key to its allowed tunnel IPs. The project explicitly declares key distribution and pushed configurations "out of scope" - these tasks are left to other layers so the protocol stays lean instead of inheriting the complexity of IKE or OpenVPN.
WireGuard
NetBird · Headscale
This is exactly the gap that management layers built on WireGuard close: NetBird adds user management, SSO, access policies and automatic key distribution as a standalone product. If you want to use the official Tailscale clients with a self-hosted control server, Headscale is the matching alternative.
Infrastructure, integration and operations
We do more than provide an application. WZ-IT designs the technical architecture, integrates network and identity, operates the agreed scope and develops integrations when the standard product is not enough.
Sizing, target environment, data transfer, cutover and recovery are resolved before production operations.
In your data center: Installation on bare-metal, VM or Docker · Integration with existing Active Directory/LDAP
AWS, Azure, Hetzner & more: Terraform/IaC setup (optional) · Kubernetes or Docker Compose · Capacity and scaling design
Advanced architecture after technical and licence assessment: HA and recovery design where supported by the application and edition · Logging according to feature set and edition · Custom security policies
SSO, secure access, internal systems and existing security components are integrated appropriately.
WireGuard, NetBird, Tailscale, Headscale, OpenVPN, Cloudflare Tunnel
Directly or through an upstream identity layer
Depends on application, edition and identity provider
Fail2Ban, Rate Limiting, IP Whitelisting
Updates, backups, technical monitoring and response paths follow a transparent operational scope.
Regular updates, CVE monitoring and prioritised patches for critical vulnerabilities
Full-service installation with no hidden costs
The exact scope depends on the application, edition, infrastructure and criticality. Vendor licences and non-standard components are quoted separately.
Benchmarks
Since March 2020, WireGuard has been part of the Linux kernel (from version 5.6) - with clients for Windows, macOS, BSD, iOS and Android. In the project's official benchmarks, WireGuard reached gigabit line rate without maxing out the CPU:
In fairness: the WireGuard project itself points out that these benchmarks are old. The tendency still holds, however - WireGuard edges out IPsec, while OpenVPN remains far behind.
Managed Hosting & Operations
Compute, applications, storage and response are shown separately. You can see what ongoing operations include and which requirements need a technical assessment.
All prices are net and exclude statutory VAT. The offers are addressed to businesses. All on-premises options
Other options
Try it free for 7 daysWe set up a test instance for you, usually on the next business day. No payment details required. After seven days it is deleted unless you continue.
Request a test instance →Bring Your Own InfrastructureInstallation on your own infrastructure · On-premise or in your cloud · Control over data location and access · Custom configuration · Complete documentation · Initial setup & configuration · Optional support and maintenance contract
Request a proposal →On-premises optionAs an alternative to managed hosting in the data centre, WZ-IT provides the hardware, configures WireGuard, and handles hardening, monitoring, updates, backup and technical support. Access can be limited to the internal network or enabled through VPN and existing identities.
View WZ-IT App Node →WireGuard-basedManaged VPN at a fixed price - based on WireGuard & NetBird. Unlimited users & devices, hosted in Germany. No per-user fees · SSO & Zero Trust included · 7-day free trial
View Offer →Role in the overall system
This page covers installation and the agreed platform operations for WireGuard. Custom code, the access layer and special confidentiality requirements remain clearly separated responsibilities that can be added when needed.
Keep custom extensions, interfaces and dependencies controlled, updated and supportable.
View service Secure accessAdd identity-based access and private network paths as a separate operational layer.
View service Operate confidentiallyFor professional secrecy holders, define contractual, access and infrastructure requirements in a dedicated operating model.
View serviceThree relevant adjacent paths instead of a long list of further products.
View the overall systemAnswers to the most important questions
Knowledge
In-depth knowledge from our remote access knowledge base.
Reviews & projects
WZ-IT moved our studio infrastructure from decentralised individual devices to a central platform: every site is securely connected via VPN, new devices are onboarded automatically and an entire site is provisioned from a template, without manual steps on location. What impressed me most is the breadth and depth of their knowledge: Timo and Robin are not a typical IT provider who sets up a server and leaves. The two of them think their way into highly complex infrastructure and software topics, work through every requirement we put in front of them, and build networking, provisioning and operations so that everything fits together in the end. WZ-IT is an excellent partner for complex software, network and architecture projects.
Steve KirchnerManaging Director, nextGYM GmbH
International
WZ-IT designs, develops and operates infrastructure and software for clients in Germany and internationally. We deliver projects remotely and continue supporting them in ongoing operations after go-live.
Managed Hosting & Operations
Briefly describe the current state and objective for WireGuard. We assess infrastructure, integration, and ongoing operations.
No risk: worst case, you leave with a clearer understanding of your project than before.
WZ-IT's advice on our Azure migration was technically sound and completely non-binding right from the intro call - we took away a great deal.
Jakob ÖschlbergerInno7 GmbH
WZ-IT's advice on our Azure migration was technically sound and completely non-binding right from the intro call - we took away a great deal.
