WireGuard VPN Setup on Your Pulsed Media Seedbox

WireGuard is a modern, fast, and cryptographically secure VPN protocol. When combined with a seedbox, it gives you an encrypted tunnel between your local machine and your server — letting you browse, torrent, and transfer files with your seedbox's IP and jurisdiction, not your home ISP's.

This article walks you through what WireGuard is, why it pairs well with a seedbox, and how to set it up on a Pulsed Media seedbox. For the authoritative technical reference, see the PMSS WireGuard documentation.

What Is WireGuard?

WireGuard is a VPN protocol designed to be simpler, faster, and more auditable than its predecessors (OpenVPN, IPsec). It was created by Jason Donenfeld and is now included in the Linux kernel as of version 5.6.

Key properties:

Minimal codebase — roughly 4,000 lines of code vs. hundreds of thousands in OpenVPN. Fewer lines means a smaller attack surface and easier security auditing.
Modern cryptography — uses Curve25519 for key exchange, ChaCha20-Poly1305 for encryption, and BLAKE2s for hashing. No legacy cipher negotiation.
Fast handshake — connection establishment takes milliseconds. Roaming between networks (Wi-Fi to mobile) reconnects automatically without dropping the tunnel.
Kernel-level performance — runs in kernel space on Linux, giving throughput competitive with raw network performance.
Stateless design — the server responds only to packets with valid cryptographic credentials. Port scanners see nothing.

WireGuard does not try to hide that you are using a VPN (it is not obfuscated traffic), but it does encrypt everything inside the tunnel and presents the server's IP address to the outside world.

Why Use a VPN With a Seedbox?

A seedbox already handles your torrents remotely. Adding VPN changes what happens when you access the seedbox itself and how you route other traffic through it.

Encrypted Access to Your Files

When you download files from your seedbox to your local machine over HTTPS or SFTP, the connection is already encrypted. But a WireGuard tunnel lets you route all traffic through the seedbox — your browser, applications, and other tools — not just file transfers.

Finnish Jurisdiction

Pulsed Media operates from Finland. When you route your traffic through the tunnel, it exits to the internet from your seedbox's Finnish IP address rather than from your home connection.

This is not legal advice, and this article does not make claims about how Finnish data retention law compares to any other country's. What is verifiable is simply the network fact above: with the tunnel active, your traffic's exit point is the seedbox in Finland, not your home ISP.

Separating Seedbox Traffic From Home Traffic

Not all traffic needs to go through the seedbox. WireGuard supports split tunneling — you can route only specific subnets or destinations through the VPN, leaving everything else on your normal connection. This is configurable in the WireGuard client configuration file.

Use Cases

Access services as if you are in Finland (useful for privacy, not for geo-bypassing DRM — read your service agreements)
Keep your home IP out of tracker peer lists entirely
Route all traffic through the seedbox when on untrusted networks (public Wi-Fi, hotel networks)
Reach a service running on your seedbox without exposing it to the public internet, provided it is bound to all interfaces or to the tunnel's own address (10.90.90.1). A service bound only to 127.0.0.1 (localhost) is never reachable over the tunnel, since loopback traffic never leaves the machine it runs on, tunnel or not. Every account on the seedbox shares this same tunnel network, so still put authentication in front of anything you expose this way.

WireGuard on your seedbox does not forward ports from the public internet to your own device. See the Port Forwarding note under Troubleshooting below if that is what you are actually looking for.

Setting Up WireGuard

Pulsed Media Seedbox Software (PMSS) includes WireGuard support, and every account already has a ready-to-import profile for its first device. The full configuration reference is in the PMSS WireGuard documentation. The steps below give you the general flow; consult that document for exact file paths and advanced options.

WireGuard is available on all plans, including the free tier. See our free seedbox page for details on getting started without a paid subscription.

Step 1: Download Your Profile

PMSS automatically generates a ready-to-import WireGuard profile for your first device and saves it to ~/wireguard.txt in your seedbox account. Get it over SFTP, or view it directly over SSH:

cat ~/wireguard.txt

This file already contains a private key, the server's public key and endpoint, and your assigned tunnel address. Nothing needs to be edited for your first device.

Treat this file as a secret. It contains a private key and is stored with permissions 0600 on your account. Anyone who can read it can connect as you.

Step 2: Install a WireGuard Client

On Windows, macOS, Android, and iOS, install the official "WireGuard" app from wireguard.com/install. On Linux, install the wireguard-tools package from your distribution, or use your distribution's WireGuard app.

Step 3: Import the Profile

Import wireguard.txt directly into the app. No manual editing is required:

Desktop (Linux/macOS/Windows): use the app's "Import tunnel(s) from file" option and point it at your downloaded wireguard.txt.
Mobile (Android/iOS): transfer the file to the device, or generate a QR code from it on a machine you trust and scan it with the app:

qrencode -t ansiutf8 < wireguard.txt

Step 4: Connect

Activate the tunnel in the app (desktop: toggle the tunnel on; mobile: tap it). On Linux without an app, copy the file into place under a .conf name (the file name becomes the interface name) and bring it up:

sudo cp wireguard.txt /etc/wireguard/pm.conf
sudo wg-quick up pm

To bring it down again:

sudo wg-quick down pm

Step 5: Verify the Tunnel

With the tunnel active, check your public IP address from the same device. It should show your seedbox's IP, not your home IP:

curl https://ifconfig.me

You will not be able to run sudo wg show on the seedbox itself to check this from the server side, since regular seedbox accounts do not have sudo. Verify from your own device instead: your WireGuard app shows a "latest handshake" time for the tunnel. A recent handshake together with a changed public IP confirms the tunnel is working.

Adding Extra Devices (Advanced)

PMSS only auto-generates a profile for your first device. For additional devices, use the manual key workflow and keep your original wireguard.txt intact as your working baseline:

1. On the new device, or any machine you control (never on the seedbox itself), generate your own key pair:

umask 077
wg genkey | tee private.key | wg pubkey > public.key

2. Over SSH, add the contents of public.key (one line of text ending in =) as a new line in ~/.wireguard-public-key on your seedbox account, replacing the placeholder below with your key:

echo 'YOUR_PUBLIC_KEY' >> ~/.wireguard-public-key

One key per line; invalid lines are ignored and do not affect your other devices. Within about six minutes the server detects the new key and rebuilds its WireGuard configuration.

3. Build a client configuration for the new device, using your new private key together with the server's public key and endpoint (already in your original wireguard.txt):

[Interface]
PrivateKey = <your new device's private key>
Address = <assigned tunnel address>/32
MTU = 1420
DNS = 1.1.1.1

[Peer]
PublicKey = <server public key, from your original wireguard.txt>
Endpoint = <server endpoint, from your original wireguard.txt>
AllowedIPs = 0.0.0.0/0, ::/0
PersistentKeepalive = 25

PMSS does not display the tunnel address it assigns to a newly added key anywhere in your account. If you need to confirm it before testing, open a support ticket.

4. To revoke a device, remove its line from ~/.wireguard-public-key.

Troubleshooting

No Handshake / Tunnel Not Connecting

Server-side port: PMSS already opens the WireGuard port (UDP 51820) on every seedbox, so there is nothing to open on our side. If a profile that used to work has stopped handshaking, the more likely causes are a profile that was hand-edited and is now out of sync, or a profile that was imported before your account moved to a different server. Each server has its own WireGuard key, so a profile imported from the old server cannot be fixed by just pointing it at a new address: download and import wireguard.txt again from the server your account is on now.
Check your client config: Verify the server's public key and endpoint IP/port match what is in your current wireguard.txt exactly. A single wrong character breaks the cryptographic handshake silently.
Check NAT on client side: Some ISPs or routers block outbound UDP on non-standard ports. Try from a different network (mobile hotspot) to isolate whether the issue is on the client side.
PersistentKeepalive: If the tunnel connects initially but drops after idle periods, add or verify PersistentKeepalive = 25 in the [Peer] section.

Port Forwarding

WireGuard on your seedbox does not support inbound port forwarding. The tunnel only does outbound network address translation for your own traffic leaving through the seedbox; there is no way to expose a port on your own device to the public internet through it.

If what you actually want is for other people, or torrent peers, to reach something listening on your device, the seedbox itself is already the reachable peer: it has its own public IP and an incoming port for your torrent client, so for torrent reachability you do not need a forwarded port on your own machine at all.

DNS Leaks

If you are routing all traffic through the tunnel but DNS queries are still going to your ISP's resolver, you have a DNS leak. Fix options:

Set DNS = in the [Interface] section of your client config to a resolver of your choice (e.g., 1.1.1.1 or a self-hosted resolver).
Use wg-quick which handles DNS configuration automatically via resolvconf or systemd-resolved.
Verify with dnsleaktest.com.

Traffic Not Routing Through Tunnel

Verify AllowedIPs = 0.0.0.0/0 if you intend full tunnel routing.
On Linux, check that your routing table has the WireGuard interface as the default route after bringing up the tunnel: ip route show.
On macOS/Windows, the WireGuard app handles routing automatically when the config uses 0.0.0.0/0.

IPv6 Leaks

AllowedIPs = 0.0.0.0/0 only covers IPv4. If your client has IPv6, traffic may bypass the tunnel. The profile PMSS generates for you already covers both:

AllowedIPs = 0.0.0.0/0, ::/0

If you built your own client config by hand for an extra device and left this out, add ::/0 back in, or disable IPv6 on the client's WireGuard interface instead:

PreUp = ip6tables -I OUTPUT ! -o %i -m mark ! --mark $(wg show %i fwmark) -m addrtype ! --dst-type LOCAL -j REJECT
PostDown = ip6tables -D OUTPUT ! -o %i -m mark ! --mark $(wg show %i fwmark) -m addrtype ! --dst-type LOCAL -j REJECT

Slow Speeds Inside the Tunnel

WireGuard overhead is low, but some factors affect throughput:

MTU mismatch: WireGuard adds approximately 60 bytes of overhead per packet. If the path MTU is already at 1500, packets will be fragmented. The profile PMSS generates for you already sets MTU = 1420 in the [Interface] section; keep this value if you build your own config for an extra device.
CPU on client: ChaCha20-Poly1305 is fast, but older mobile devices may be the bottleneck. Test with iperf3 to isolate whether the limit is encryption or network.
Server capacity: Seedbox servers handle many concurrent users. WireGuard VPN traffic competes with seedbox traffic. During peak hours, the bottleneck may be server-side bandwidth, not the VPN protocol itself.

Security Considerations

Key Rotation

WireGuard does not implement automatic key rotation, and PMSS does not expose a configuration interface for it. If you believe a device's private key has been compromised:

For an extra-device profile you built yourself: generate a new key pair on that device, add the new public key to ~/.wireguard-public-key, remove the old key's line to revoke it, and update the device's client config with the new private key.
For your original, auto-generated wireguard.txt: open a support ticket to have it reissued.

For high-security use cases, rotate keys periodically (monthly or quarterly). This limits the exposure window if a key is captured through means other than breaking the cryptography.

Pre-Shared Keys

WireGuard supports an optional pre-shared key (PSK) in addition to the asymmetric key exchange. This adds a layer of symmetric encryption that would resist a future quantum computer capable of breaking elliptic curve cryptography. The profile PMSS generates for you does not include one, and there is currently no way to add one on the server side.

Logging

WireGuard does not log connection metadata at the kernel level. Pulsed Media's privacy policy governs what, if anything, is logged at the application or network layer.

WireGuard Is Not Anonymity

WireGuard encrypts your traffic and replaces your IP with the server's IP. It does not anonymize you against the server operator (Pulsed Media can see that you connected, from what IP, and when), and it does not protect against browser fingerprinting, tracking cookies, or application-level identifiers. For strong anonymity requirements, WireGuard is a transport layer — it is not Tor.

Summary

WireGuard on a Pulsed Media seedbox gives you:

Encrypted tunnel from your device to a Finnish server
Your seedbox's IP presenting to the outside world instead of your home IP
A Finnish IP address for traffic that exits through the seedbox
Fast, low-overhead VPN that reconnects automatically when roaming
Free on all plans — no extra subscription required

The full setup reference is in the PMSS WireGuard documentation. If you do not have a seedbox yet, WireGuard VPN is available on all plans, including the free seedbox tier — no credit card required.