hermes-skills/skills/devops/infrastructure-automation/references/wireguard-port-migration.md

WireGuard Port Migration (Jul 9, 2026)

During the Jul 9 WG tunnel rebuild, the server port was changed from 51820 to 51821.

Why

The port was originally 51820. During troubleshooting, the router's WG public key was found to be stale (mismatched with what the server had configured). After fixing the key, the port was also changed because the original 51820 config on the server was a leftover from the Hetzner era that had never been cleanly migrated. Moving to 51821 served two purposes:

1. A clean break from any stale state
2. The router peer config had endpoint-port=51821 already from app1-bu's old config, so aligning the server to match meant both peers used the same port

The change

In /etc/wireguard/wg0.conf:

ListenPort = 51821  # was 51820
Endpoint = 76.195.7.60:13231  # added (router endpoint)
PersistentKeepalive = 25  # added

UFW rule updated:

ufw delete allow 51820/udp
ufw allow 51821/udp comment "WireGuard VPN"

Service restart:

systemctl restart wg-quick@wg0

The router's peer config endpoint-port was already 51821 (set during earlier troubleshooting).

Lesson

Don't be afraid to change the WireGuard listen-port during tunnel debugging if there's any chance of stale state. The server's listen-port and the router's peer endpoint-port must match. Verify with wg show on server, /interface/wireguard/peers/print detail on router.