One machine. One peer. One name on it.
A dedicated WireGuard server on a single EC2 instance in Stockholm, holding a fixed AWS elastic IP that nobody else shares. Not a slot in a rotating pool of exit nodes picked for you at connect time.
Operator
Peer administration. If you are here for a connection, the front door is to the left.
The machine, stated plainly.
There is one of it. You can look up its address, its region and its port, and they will still be true next month.
- Region
- eu-north-1
- City
- Stockholm, Sweden
- Coordinates
- 59.3293° N, 18.0686° E
- Host
- 13.50.192.73
- Listening port
- 51820/udp
- Address
- AWS elastic IP, reserved
- Tunnel
- WireGuard, kernel module
- Your allocation
- one keypair, one /32
- Handshake
- Noise IK, rekeys every 120 s
- Provisioning
- by hand, by a person
What WireGuard is
WireGuard® is an extremely simple yet fast and modern VPN that utilizes state-of-the-art cryptography. wireguard.com
It is a tunnel and almost nothing else. The whole implementation is a few thousand lines of code, small enough that one competent person can read all of it. That is the security argument, and it is a better one than any adjective: there is very little surface area in which to hide a mistake.
Identity is a public key. The server holds a list of public keys and the addresses each key is permitted to use, and that list is the entire access control system. No usernames, no certificate chain, no cipher suite to negotiate and therefore none to downgrade. Your key is on the list or it is not, and taking it off the list takes effect on the next packet.
It is also quiet. An unauthenticated packet gets no reply at all, so a port scan finds nothing. It runs over UDP on a single port, survives changing networks without dropping the tunnel, and comes back when your laptop wakes up. There is no client to keep running in the background asking to be updated.
The cryptography is fixed rather than configurable, which is the point.
- ChaCha20symmetric encryption
- Poly1305message authentication
- Curve25519key exchange
- BLAKE2shashing
- HKDFkey derivation
- Noise IKhandshake framework
What dedicated means here
-
A named instance
Your tunnel terminates on one EC2 instance in eu-north-1 that we operate and can point at. It is not a fleet, and you are not assigned an anonymous exit node at connect time and a different one tomorrow.
-
A fixed address
The instance holds an AWS elastic IP. It is reserved to the instance, it does not change when the machine restarts, and it is the address the internet sees while you are connected. When something needs to allowlist you, there is exactly one number to hand over.
-
Sweden, specifically
Stockholm, 59.3293° N. Your traffic leaves the tunnel in Sweden, on Swedish and EU terms, and geography-sensitive services see a Swedish address because that is genuinely where the packets emerge.
-
A key that is only yours
One keypair, one address inside the tunnel, issued to you and to no one else. It is generated on request, never reused, and revoked with a single command that takes effect immediately rather than at the end of a billing period.
Get your own dedicated connection.
Say what you need it for and which platforms it has to run on. You get the file below with your key in it, and a person who answers. Setup is done by hand, which is possible because there are not very many of you. If you would rather write directly, support@convosuite.com reaches the same desk.
Ask for one
yourname.conf, generated for you and sent once.
Import it into the WireGuard client and the tunnel is up.
[Interface] PrivateKey = issued to you, generated fresh Address = 10.66.66.n/24 DNS = 1.1.1.1 MTU = 1280 [Peer] PublicKey = the server, published Endpoint = 13.50.192.73:51820 AllowedIPs = 0.0.0.0/1, 128.0.0.0/1 PersistentKeepalive = 25