WireGuard between Ubuntu 24.04 and a QNAP NAS: set up a VPN tunnel

Connect an Ubuntu 24.04 server to a QNAP NAS as a WireGuard client with separate keys, limited routes and tunnel checks.

Scenario and prerequisites

Ubuntu 24.04 is reachable on UDP 51820; the QNAP NAS initiates the connection as a QVPN Service client. Check model and QTS/QuTS support for the WireGuard client, DNS resolution, router forwarding and firewall rules. 10.77.20.1 and 10.77.20.2 are examples: choose an address range that does not overlap other LANs or VPNs. This setup links the two peers, not the entire NAS LAN.

Install WireGuard and generate keys

Install the package and generate the key pair in the private /etc/wireguard directory. The command prints only the public key, which belongs in the QNAP profile; keep server.key secret. Before changing a remote firewall, preserve SSH access and a recovery console.

sudo apt update
sudo apt install wireguard
sudo install -d -m 700 /etc/wireguard
sudo sh -c 'umask 077; wg genkey | tee /etc/wireguard/server.key | wg pubkey > /etc/wireguard/server.pub'
sudo cat /etc/wireguard/server.pub

Configure the server interface

Create /etc/wireguard/wg0.conf using the example and replace both Base64 placeholders with Ubuntu’s private key and QNAP’s public key, without angle brackets. Server AllowedIPs 10.77.20.2/32 accepts and routes only the NAS tunnel address. Protect the file because it contains a secret. Reaching a network behind the NAS also needs explicit routes, firewall rules and IP forwarding.

[Interface]
Address = 10.77.20.1/24
ListenPort = 51820
PrivateKey = SERVER_PRIVATE_KEY_BASE64

[Peer]
PublicKey = QNAP_PUBLIC_KEY_BASE64
AllowedIPs = 10.77.20.2/32

Set up QNAP as a client

Open QVPN Service > VPN Client > VPN Connection Profiles > Add > WireGuard. Generate a key pair on the NAS and put its public key on the server. Set tunnel address 10.77.20.2, Ubuntu public key, endpoint server.example.com:51820 and Allowed IPs 10.77.20.1/32, so only server traffic traverses the tunnel. Labels can differ by version. Avoid 0.0.0.0/0 unless you intend to route all NAS traffic through the VPN.

Open the port and test

After confirming SSH access, allow UDP 51820 in UFW and any external firewall. Forward the router port only when Ubuntu is behind NAT. Start wg-quick@wg0 and connect the QNAP profile. wg show reports handshake and traffic counters. Ping helps when firewalls permit it, but a blocked ping alone does not prove tunnel failure. Compare keys, endpoint, addresses and AllowedIPs on both sides.

sudo chmod 600 /etc/wireguard/wg0.conf
sudo ufw allow 51820/udp
sudo systemctl enable --now wg-quick@wg0
sudo wg show
ping -c 3 10.77.20.2

NAT and security

If QNAP is behind NAT and idle mappings expire, set PersistentKeepalive = 25 on the QNAP peer if QVPN offers it. Setting it only on the server does not keep the client’s NAT mapping open. Keep private keys secret, update both devices, restrict NAS services and monitor the tunnel. WireGuard encrypts traffic in transit; backups still need independent copies and restore testing.

Sources

QNAP QVPN: https://www.qnap.com/en/how-to/tutorial/article/how-to-set-up-and-use-qvpn-service-and-qvpn-device-client ; WireGuard: https://www.wireguard.com/quickstart/ .