A VPS or remote server can join a home network without deploying a separate VPN stack. If the FritzBox supports WireGuard, the server connects as a client to the built-in WireGuard server. This avoids running additional containers, managing firewall port ranges for internal services, or subscribing to a third-party VPN provider.
This configuration differs from hosting a WireGuard server on the remote box and connecting clients to it. Here, the FritzBox acts as the server, and the Debian machine becomes a peer on the home network, just like a phone or laptop.
Prerequisites
The following items are required:
- A FritzBox model and FRITZ!OS version that supports WireGuard (see the compatibility table below)
- The FritzBox must be reachable via a public IPv4 or IPv6 address, MyFRITZ! address, or third-party DynDNS
- A Debian-based server with root or sudo access
Generate the Connection in the FritzBox UI
In the FritzBox web interface, navigate to Internet → Freigaben (Permit Access) → VPN (WireGuard) tab → Add Connection. Select the option for connecting a single computer, not the site-to-site or router-to-router option. The FritzBox generates a keypair for the peer and produces a configuration file for download.
Get the Config File onto the Server
Download the .conf file and modify it to allow only relevant traffic through the VPN. By default, all traffic is forced through the VPN, this is not ideal, as the reply traffic to web requests will come from another IP, from the client perspective.
By default, the configuration file looks like this:
[Interface]
PrivateKey = qOuQj66cdw9tZBblahblahblahJNZas1E=
Address = 172.16.29.131/24,fd00::131/64
DNS = 172.16.29.1,fd00::62b5:8dff:fea6:ac65
DNS = fritz.box
[Peer]
PublicKey = Scpblahblahblah+I8JyAVlFb8lLA6mfh4YnLkMk8=
PresharedKey = inacvl/+v0lDblahblahblahU12n3lxgH5RU7IvTfk=
AllowedIPs = 172.16.29.0/24,0.0.0.0/0,fd00::/64,::/0
Endpoint = mm11tispaddr.myfritz.net
PersistentKeepalive = 25The key lines are these:
AllowedIPs = 172.16.29.0/24,0.0.0.0/0,fd00::/64,::/0The 0.0.0.0/0 and ::/0 means _all_ traffic must go through the VPN. If this is not desired, and it probably is not, update the file to remove these IP ranges:
[Interface]
PrivateKey = qOuQj66cdw9tZBblahblahblahJNZas1E=
Address = 172.16.29.131/24,fd00::131/64
DNS = 172.16.29.1,fd00::62b5:8dff:1234:ac65
DNS = fritz.box
[Peer]
PublicKey = Scpblahblahblah+I8JyAVlFb8lLA6mfh4YnLkMk8=
PresharedKey = inacvl/+v0lDblahblahblahU12n3lxgH5RU7IvTfk=
AllowedIPs = 172.16.29.0/24,fd00::/64
Endpoint = mm11tispaddr.myfritz.net
PersistentKeepalive = 25In this configuration, traffic entering the server from the web, gets a response from the server, directly. Traffic entering from the VPN, gets a response directly from the VPN adapter.
Notice above, the endpoint is in the myfritz.net domain. This is because this Fritzbox is configured via Myfritz and gets a Dynamic DNS experience from there. If the Fritzbox already has another DNS name, that resolves to it’s public IP address, then use that, instead.
Save and copy the configuration file to the server using SCP or similar (notice, I have renamed the file to wg0, for aesthetic reasons, in the copy):
ssh root@server "mkdir -p /etc/wireguard"
scp ~/Downloads/wg_config.conf root@server:/etc/wireguard/wg0.confInstall WireGuard Tools
The configuration is in place, the tools need to be installed. At the server:
sudo apt update
sudo apt install wireguard -yThis installs wireguard-tools, which provides wg and wg-quick. The wg-quick helper script manages interfaces from configuration files, including integration with systemd.
Place the Config as an Interface Definition
The wg-quick utility expects configuration files in /etc/wireguard/, named after the desired interface. This is already copied there, in the previous steps. The file was renamed to wg0, the interface will be called wg0. This file needs to be protected:
sudo chmod 600 /etc/wireguard/wg0.confThe chmod 600 is necessary. The file contains a private key, and wg-quick and systemd will refuse to operate on world-readable key material on most modern Linux distributions.
Enable and Start the Service as a Systemd Service
sudo systemctl enable --now wg-quick@wg0The @wg0 matches the filename (wg0.conf). The wg-quick@.service is a systemd template unit, and the portion after the @ specifies which configuration in /etc/wireguard/ to use. The enable –now starts the interface immediately and persists it across reboots.
Verify the interface is active:
sudo wg show
systemctl status wg-quick@wg0No port-forwarding rules are required on the server side. No NAT configuration is necessary. No firewall exceptions are needed for individual internal services. The server is now a device on the Fritzbox LAN with an IP address assigned by the FritzBox. It is reachable from the LAN:
Which FritzBox Models Support WireGuard
WireGuard support in FRITZ!OS is not universal. AVM added it starting with FRITZ!OS 7.50, and feature parity varies across models. The table below reflects direct confirmation from AVM documentation and release notes. It is not exhaustive. If a model is not listed, check AVM knowledge base articles for that specific device.
| Model | WireGuard Support | Notes |
|---|---|---|
| FRITZ!Box 7590 | Yes | Official AVM setup guide exists for single-device and multi-network WireGuard connections |
| FRITZ!Box 7490 | Yes, with limits | Requires FRITZ!OS 7.50+. Does not support “send all IPv4 traffic via VPN” or “only certain devices reachable via this connection” options present on newer models |
| FRITZ!Box 4060 | Yes | Official AVM setup guide exists for WireGuard-to-computer connections |
| FRITZ!Box 6850 5G | Yes | Official AVM setup guide exists, including router-to-router WireGuard |
| FRITZ!Box 7682 | Yes | Official AVM setup guide exists, including router-to-router WireGuard |
| FRITZ!Box 6490 | No | Explicitly excluded in AVM FRITZ!OS 7.50 release notes |
| FRITZ!Box 6590 | No | Explicitly excluded in AVM FRITZ!OS 7.50 release notes |
General rule: WireGuard requires FRITZ!OS 7.50 or later. If the device firmware does not show a “VPN (WireGuard)” tab under Internet → Freigaben, either the firmware is out of date or the hardware model is not supported.
Additional Notes
UDP 51820 is opened automatically. The FritzBox handles port exposure as part of its WireGuard server role. No manual port forwarding configuration is required.
Reachability depends on MyFRITZ! or DynDNS, not a manually configured static IP. AVM’s implementation uses these services to locate the FritzBox from outside the local network, even when a static public IP is available.
References
- AVM – WireGuard-VPN zur FRITZ!Box am Computer einrichten (FRITZ!Box 4060). https://avm.de/service/wissensdatenbank/dok/FRITZ-Box-4060/3685_WireGuard-VPN-zur-FRITZ-Box-am-Computer-einrichten/
- AVM – WireGuard-VPN zwischen drei oder mehr FRITZ!Box-Netzwerken einrichten (FRITZ!Box 7590). https://avm.de/service/wissensdatenbank/dok/FRITZ-Box-7590/3719_WireGuard-VPN-zwischen-drei-oder-mehr-FRITZ-Box-Netzwerken-einrichten/
- AVM – WireGuard-VPN zwischen zwei FRITZ!Box-Netzwerken einrichten (FRITZ!Box 7490). https://avm.de/service/wissensdatenbank/dok/FRITZ-Box-7490/3686_WireGuard-VPN-zwischen-zwei-FRITZ-Box-Netzwerken-einrichten/
- AVM International – Setting up a WireGuard VPN between the FRITZ!Box and another router (FRITZ!Box 6850 5G / 7682). https://en.avm.de/service/knowledge-base/dok/FRITZ-Box-6850-5G/3687_Setting-up-a-WireGuard-VPN-between-the-FRITZ-Box-and-another-router/
- AVM FRITZ!OS 7.50 release notes, as reproduced at katzeausdemsack.de: “NEU – VPN mit WireGuard für den einfachen Aufbau von schnellen und sicheren VPN-Verbindungen (nicht für FRITZ!Box 6490, 6590)”. https://www.katzeausdemsack.de/2022/12/01/avm-fritzos-7-50-finale-version-startet-grosses-update-mit-ueber-150-neuerungen-und-verbesserungen/
AI assistance is used on this site for language, formatting, and turning research into a consistent template. It is not used to perform the underlying research or verify technical claims. Every command, configuration, and step in this post is tested by hand before publication.