If you manage remote infrastructure, secure access is not optional—it is the foundation of your network. WireGuard offers a modern, lightweight VPN protocol with strong cryptography and excellent performance, but generating keys, writing peer configurations, and managing routes by hand can become tedious.

NetSmart brings WireGuard peer and server management into the same self-hosted web panel used for DNS, DHCP, Directory, mail, logs, and other network services. This guide takes you from a Docker deployment to a connected client in about five minutes once your host, DNS, and firewall are ready.

Before you begin

You will need:

  • A Linux host with Docker Engine and Docker Compose
  • A public IP address or DNS name that reaches the host
  • UDP port 51820 forwarded to and allowed through the host firewall
  • TCP access to the NetSmart dashboard from a trusted administrator network

Important: the five-minute setup assumes Docker and network routing are already working. NAT, cloud security groups, carrier-grade NAT, or upstream firewalls may require additional configuration.

Step 1: Deploy NetSmart with Docker Compose

Create a new directory, add the following compose.yaml, and replace every example password before starting the services:

services:
  mysql:
    image: mysql:8.4
    container_name: netsmart_mysql
    restart: unless-stopped
    environment:
      MYSQL_DATABASE: netsmart_db
      MYSQL_USER: netsmart
      MYSQL_PASSWORD: replace-with-a-strong-db-password
      MYSQL_ROOT_PASSWORD: replace-with-a-different-root-password
    volumes:
      - netsmart_mysql:/var/lib/mysql
    healthcheck:
      test:
        - CMD-SHELL
        - mysqladmin ping -h localhost -uroot -p$${MYSQL_ROOT_PASSWORD} --silent
      interval: 5s
      timeout: 5s
      retries: 20

  netsmart:
    image: ssiroos/netsmartapp:latest
    container_name: netsmart
    restart: unless-stopped
    depends_on:
      mysql:
        condition: service_healthy
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
    sysctls:
      net.ipv4.ip_forward: "1"
      net.ipv4.conf.all.src_valid_mark: "1"
    ports:
      - "8080:8080/tcp"
      - "51820:51820/udp"
    environment:
      TZ: Etc/UTC
      ConnectionStrings__DefaultConnection: "Server=mysql;Port=3306;Database=netsmart_db;User ID=netsmart;Password=replace-with-a-strong-db-password;AllowUserVariables=true"
    volumes:
      - netsmart_wireguard:/etc/wireguard
      - /lib/modules:/lib/modules:ro

volumes:
  netsmart_mysql:
  netsmart_wireguard:

The important WireGuard settings are:

  • NET_ADMIN lets NetSmart create and manage network interfaces and routing rules.
  • net.ipv4.ip_forward=1 allows traffic to pass between the VPN tunnel and another network.
  • 51820:51820/udp exposes the default WireGuard listener.
  • The named volumes preserve database and WireGuard data when containers are recreated.

Start the stack:

docker compose up -d
docker compose ps

On hosts where WireGuard support is built directly into the kernel, the /lib/modules mount may not be needed. Keep it for the initial setup unless your platform documentation says otherwise.

Step 2: Open and secure the NetSmart dashboard

From a trusted machine, open:

http://<server-ip>:8080

Sign in and immediately replace all default or temporary credentials. Do not expose the dashboard directly to the public internet. Restrict it with a host firewall, private administrator network, or authenticated HTTPS reverse proxy.

Step 3: Configure the WireGuard server

Open the WireGuard section in the NetSmart dashboard. The exact button labels may vary by release, but the server needs these values:

  • Interface: normally wg0
  • Server address: for example 10.8.0.1/24
  • Listen port: 51820
  • Endpoint host: your public IP address or DNS name
  • Client DNS: your preferred resolver, such as NetSmart DNS or a trusted external resolver
  • Allowed IPs: the networks clients should reach through the tunnel

Generate the server keys in the dashboard, save the settings, and start the WireGuard service. Never share the server private key.

Step 4: Add your first peer

Create a separate peer for every person or device. Give it a descriptive name such as admin-laptop or mina-phone. NetSmart generates the peer details and a client configuration that you can download.

Using a unique peer per device makes access easier to audit and revoke. If a laptop or phone is lost, remove only that peer instead of rotating every client.

Connect a phone

Install the official WireGuard app, add a tunnel, and scan the peer QR code displayed by NetSmart. Treat the QR code like a password because it contains private configuration. Do not email it, post it in chat, or leave it visible after enrollment.

Connect a desktop

Import the downloaded .conf file into the WireGuard desktop application. On a Linux client, you can also install it as an interface configuration:

sudo install -m 600 ~/Downloads/admin-laptop.conf /etc/wireguard/wg0.conf
sudo wg-quick up wg0
sudo wg show

The wg show output should report a recent handshake after the client sends traffic.

Step 5: Verify routing and access

Test the path your VPN is intended to provide:

  • Confirm the peer shows a recent handshake and transferred bytes.
  • Ping or open an approved internal service by its VPN or private address.
  • If this is a full-tunnel VPN, verify the client’s public IP changes.
  • Disconnect the tunnel and confirm private services are no longer reachable.

If there is no handshake, check the public endpoint, UDP port forwarding, host firewall, cloud security group, and container logs. If the handshake succeeds but traffic does not pass, review IP forwarding, NAT, AllowedIPs, return routes, and overlapping client networks.

Security checklist

  • Change all default passwords before using NetSmart on a real network.
  • Keep the dashboard private and protect web access with HTTPS.
  • Create one WireGuard peer per device and revoke unused peers promptly.
  • Limit AllowedIPs to the networks each peer actually needs when full-tunnel access is unnecessary.
  • Back up the MySQL and WireGuard volumes securely.
  • Update the NetSmart and database images regularly after reviewing release notes and backups.
  • Never publish private keys, downloaded peer configurations, or QR codes.

Self-hosted VPN access without configuration-file sprawl

NetSmart turns the repetitive parts of WireGuard administration—server settings, keys, peer records, and client configuration—into a visual workflow. You still control the Linux host, firewall, routing policy, and stored data, while administrators gain one place to manage remote access alongside other network services.

Explore NetSmart features and deployment information or open the official NetSmartApp image on Docker Hub.