TL;DR: Oracle Cloud’s always-free VMs make a great WireGuard VPN host — if you know the gotchas. Here’s how I set mine up in Sydney with working internet access, correct firewall rules, and a tuned MTU so it doesn’t crawl.

Note that this is more of a learning exercise, and a setup to play around with, than a serious VPN for everyday use. The problem being the lowly-spec’d free Oracle cloud server that is used. If you are lucky and manage to get a free Ampere VM from Oracle, that should be somewhat faster.

1. Create a Free Oracle Cloud VM

  1. Sign in to Oracle Cloud. Make a new account if you don’t have one. Some of the VM types (including what I used) are completely free forever, unlike nearly all other cloud VM providers. However, you need to be careful that you don’t select options which are paid/nonfree. For the free plan you can only have one region, and you can’t change it, so it’s better to pick one that isn’t that popular if you want to get the better-spec Ampere VM type (see below).
  2. Go to Compute → Instances → Create Instance.
  3. The VM ‘shape’ called VM.Standard.A1.Flex (Ampere) is the best free one. It is often out of capacity (meaning you can’t create another one until someone else terminates one). If you can’t get one, this one should work:
    V M . S t a n d a r d . E 2 . 1 . M i c r o
    Still free, just slower. This is what I used, though if I had known to pick a less in-demand region from the start, I would have done that.
  4. Choose the Canonical Ubuntu image (latest LTS).
  5. Use the default VCN/Subnet — make sure it’s public.
  6. Add your own SSH keys, or generate one but remember to save them (you won’t be able to see them again after the initial generation step), so you can log in later with ssh.

2. Open the WireGuard Port

In the Oracle Cloud console, in your VM’s Subnet Security List or Network Security Group (NSG), make sure these rules are present. The all traffic out (egress) is likely to be already there, but you will need to create the incoming (ingress) rule for port 51280 on UDP:

  • Ingress Rule

    • Protocol: UDP
    • Source CIDR: 0.0.0.0/0
    • Destination Port Range: 51820

  • Egress Rule

    • Allow all traffic (or at least UDP to anywhere).

3. Install WireGuard on the Server

1

sudo apt update && sudo apt install -y wireguard iptables-persistent

If you haven’t already done so, you can install it on the client like here: How to Build a Peer-to-Peer Mesh VPN with WireGuard and Linux. The example is for a Linux client — if you want to use a Windows client, this is also possible if you install the Windows app for Wireguard and set it up in a similar fashion.

Generate keys:

1

wg genkey | tee privatekey | wg pubkey > publickey

4. Server Config (/etc/wireguard/wg0.conf)

Paste the actual contents of the keys (the long encrypted strings) below, not their filenames. The public IP address of the Oracle server can be found from the Oracle Cloud console.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

[Interface]
PrivateKey = <server-private-key>
Address = 10.42.0.1/24
ListenPort = 51820
MTU = 1280
PostUp = iptables -t nat -A POSTROUTING -o ens3 -j MASQUERADE
PostDown = iptables -t nat -D POSTROUTING -o ens3 -j MASQUERADE

[Peer]
PublicKey = <client-public-key>
AllowedIPs = 10.42.0.2/32

5. Client Config (Linux or Windows)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

[Interface]
PrivateKey = <client-private-key>
Address = 10.42.0.2/24
ListenPort = 51820
MTU = 1280

[Peer]
PublicKey = <server-public-key>
Endpoint = <server-public-ip>:51820
AllowedIPs = 0.0.0.0/0, ::/0
PersistentKeepalive = 25

On Windows, paste the above into the WireGuard GUI as a new tunnel.

6. Enable IP Forwarding on the Server

1

sudo sysctl -w net.ipv4.ip_forward=1

Make it permanent:

1

echo "net.ipv4.ip_forward=1" | sudo tee -a /etc/sysctl.conf

7. Fix Oracle’s Default iptables Block

Oracle’s Ubuntu image ships with INPUT rules that block most inbound traffic — which will silently break WireGuard.

Check current rules:

1

sudo iptables -L -n -v

If you see REJECT rules for icmp-host-prohibited or udp, flush them:

1

sudo iptables -F

Make this persist on reboot:

1

sudo netfilter-persistent save

8. Start WireGuard

1
2

sudo systemctl enable wg-quick@wg0
sudo systemctl start wg-quick@wg0

Check status:

1

sudo wg

9. Test the VPN

From the client:

1
2

ping 10.42.0.1
curl https://ifconfig.me

If ifconfig.me shows your Oracle Cloud public IP, all traffic is routing through the VPN.

Why MTU Matters Here

OCI + WireGuard + nested NAT can cause packet fragmentation if MTU stays at the default 1500. This kills page loads but leaves Google searches feeling “fast.”
Setting MTU to 1280 on both server and client fixed this for me. You might be able to get away with a larger number (like 1380) if you don’t have any other VPNs or nested NAT networks in your route to the outside internet.

Done. You now have a free, persistent WireGuard VPN running in Oracle Cloud!