Docs

Requirements

• A Linux server with a public IPv4 address: Debian, Ubuntu, or Rocky Linux, on x86_64 or ARM64. Any current release ships the WireGuard kernel module.
• Root access to run the installer.
• A DNS name for the console. The installer can issue one for you, vpn-a-b-c-d.warpspeedvpn.com for the server's address, or you can point your own name at the server first.
• Inbound TCP 80 and 443 and the WireGuard UDP port open to the internet (see Firewall).

The smallest instance most providers sell is enough for a handful of users. WireGuard is light; bandwidth is usually the limit, so pick a plan and region with the network you need.

Install

Sign in as root and run:

The installer asks three questions:

1. The data directory, /warpspeed by default. Everything the server keeps lives there.
2. The DNS name. Press Enter to accept the automatic name, or answer no and type your own, such as vpn.example.com. Your own name must already resolve to this server.
3. The administrator email. License and server mail goes there, and it is the administrator's sign-in name.

It then installs the warpspeed systemd service, starts it, and prints a summary. The first administrator password is in /root/.secrets:

Running the installer again on a server that already has WarpSpeed upgrades it in place and keeps your settings.

Firewall

Open these inbound ports in the cloud provider's firewall and in any host firewall such as ufw or firewalld:

WireGuard is UDP only. A rule for TCP 51820 does nothing, and it is the most common reason a device shows as connected but passes no traffic. Port 80 has to stay open for certificate renewals, not just the first issue.

Initial setup

Open https://your-server-name and sign in as the administrator. The setup wizard asks for:

• IPv4 network. The client pool, a private range such as 10.8.0.0/24 that devices get addresses from, the routes devices send through the VPN, and the DNS server they use.
• IPv6 network. Optional, for servers with a public IPv6 address. A unique local pool, routes, and a DNS server.
• Security. Client to client, whether devices on the VPN can reach each other, and DNS protection.
• Ports. The WireGuard UDP port, 51820 by default.

Changing the client pool later gives every device a new address, and changing routes or DNS changes every device's configuration, so settle these before you add many devices.

Routes and tunnels

Routes are the networks a device sends through the tunnel. They go into each device's configuration as AllowedIPs.

• Full tunnel. Use 0.0.0.0/0 (and ::/0 with IPv6). All traffic leaves through the server and appears to come from its public address. This is the setting for travel, untrusted networks, a shared egress IP for allowlists, and choosing the region you browse from.
• Split tunnel. List only the networks you need, such as 10.0.0.0/16, 172.31.0.0/16. Everything else uses the device's normal connection. This is the setting for reaching private servers without routing a user's whole connection.

Traffic from devices is translated to the server's own address on its way out, so a private network behind the server needs no route back to the VPN pool. The server only has to be able to reach that network itself, for example by being in the same VPC or having a peering connection to it.

DNS

The DNS server you set is written into every device's configuration. It can be a public resolver, the provider's resolver, or one you run such as Unbound, Pi-hole, or AdGuard Home.

With DNS protection on, every DNS query a device sends through the tunnel is redirected to your DNS server, even if an app or the network asks for another one.

In a split tunnel, the DNS server's address must be inside one of the routes. Otherwise devices try to reach it outside the tunnel and name lookups fail or bypass your resolver. This is the most common cause of "connected, but websites do not load".

Users and devices

Administrators add users by email from the console. Each user signs in to add their own devices and download configurations, or scan a QR code with the WireGuard app on a phone. Administrators can add devices for any user.

• Give every device its own configuration. Two devices sharing one take turns knocking each other off the tunnel.
• A configuration contains the device's private key. Treat it like a password and never send it by email or chat, support included.
• After you change routes, DNS, or the client pool, download each device's configuration again.
• Deleting a device or a user removes it from WireGuard right away, which drops any live tunnel.

Connect with the official WireGuard apps for Windows, macOS, Linux, iOS, and Android. There is no separate WarpSpeed client to install.

Single sign-on

On the Business plan, users can sign in through a SAML identity provider such as Google Workspace, Microsoft Entra ID, Okta, OneLogin, or JumpCloud.

1. In your identity provider, create a SAML app with the ACS URL https://your-server-name/saml/acs and the entity ID https://your-server-name/, with the trailing slash. If your provider can import service provider metadata, give it https://your-server-name/saml/metadata instead.
2. Set the Name ID format to email address and send the user's primary email. Users the identity provider signs in are created on the server automatically.
3. Paste the identity provider's metadata XML into Settings, Single sign-on, and save.

If sign-in fails with an error from the identity provider, try a private browser window. The browser is often signed in to a different account than the one assigned to the app.

Licenses

Every server has an id, shown on the console's License page. Register it with your WarpSpeed account from that page to receive a license for the plan you choose. Servers check in with warpspeedvpn.net once an hour, and the License page has a button to check right away after a purchase.

A lapsed license keeps the VPN running, but blocks new users and devices until it is renewed. Each server is licensed on its own; see Pricing for the plans.

Updates

Under Settings, Updates, choose how the server updates:

• Automatic. Installs new releases inside the window you set, by start hour, end hour, and time zone.
• Notify only. Shows that an update is available and waits for you to install it from the same page.
• Manual. Never checks on its own.

Every download is verified before it is installed, and if the new version does not start the server rolls back to the previous one. Updates do not reset tunnels that are already up.

Backups and moving

Write a consistent copy of the database while the server runs:

For a full restore, keep the whole data directory, including tls so the certificate does not need to be issued again, and /root/.secrets.

To move to a new server, install WarpSpeed there, then email support with the old and the new server id and we move the license across. If you keep the same DNS name, point it at the new server's address before devices reconnect.

Command line

The warpspeed binary has commands for the jobs that are easier from a shell. Run any of them with --help for the flags.

The service itself is warpspeed.service. Follow its log with:

Troubleshooting

• The console does not load, or the browser shows a TLS error. Port 80 is closed, the DNS name does not point at the server, or a proxy such as Cloudflare sits in front of it. The certificate is issued over port 80 directly to the server.
• The device connects but nothing loads. Check that UDP, not TCP, is open on the WireGuard port, then check that the DNS server is inside your routes.
• Private servers are unreachable. Confirm the server itself can reach them, for example with ping from the server, and that their network is listed in the routes.
• Two devices keep disconnecting each other. They share one configuration. Add a separate device for each.
• Slow speeds. Test the server's own bandwidth first. On some networks a lower MTU helps; set MTU = 1380 in the device's WireGuard configuration and reconnect.
• A license shows as Personal after a purchase. Press the check button on the License page, or run warpspeed admin license refresh.

Support

Email support@warpspeedvpn.com with your server id and a description of the problem. Include log lines from journalctl if you have them, and never include configuration files or passwords.