Which cloud providers support private WireGuard networking?

AWS, Microsoft Azure and Google Cloud have guided private connectivity paths. IntelliconOps creates an ordered plan for a lightweight router, cloud network rules and WireGuard peers, then verifies reachability and handshake freshness.

Does the tunnel survive a Docker restart?

Yes. WireGuard configs are stored in a persistent Docker volume and the worker automatically brings all tunnels up on container start using wg-quick.

Can I SSH to a private VM through the tunnel?

Yes, where the browser terminal and guest identity are configured. SSH and Ansible traffic can use the active WireGuard route to reach workload private IPs without assigning a public IP to every workload.

Does OpenTofu need the WireGuard tunnel to provision cloud resources?

No. OpenTofu and Python provider operations call cloud APIs using the selected account credentials. WireGuard provides a separate private data path for guest access, browser SSH and Ansible after a workload is reachable.

Is private-network setup fully automatic?

Not completely. IntelliconOps produces and tracks ordered provider and host steps, but an authorised operator still completes host-level installation, peer key exchange and forwarding steps.

Private automation path

Reach private AWS, Azure and Google Cloud workloads without exposing every VM.

IntelliconOps guides a WireGuard router and network path inside the selected VPC or VNet, stores the worker-side tunnel configuration persistently and verifies that private workload routes remain reachable.

Discuss private connectivity

Private traffic path

Docker worker

Starts SSH and Ansible traffic. Auto-starts WireGuard tunnels on boot.

WireGuard tunnel

Encrypts traffic between authenticated worker and cloud router.

Cloud router VM

A lightweight AWS, Azure or Google Cloud VM forwards traffic into the private subnet.

Private VM

Receives SSH and automation traffic on its private IP. No public IP needed.

How the bridge works

Keep cloud workloads private while the automation path remains reachable.

Docker bridge

The Python worker originates automation traffic from the IntelliconOps container network.

Host forwarding

The Docker host routes and, where required, translates container traffic onto wg0.

Encrypted tunnel

WireGuard carries authenticated traffic to the selected cloud router over its UDP endpoint.

VPC or VNet router

The router forwards tunnel traffic to workload private IPs and handles the return path.

WireGuard architecture connecting an IntelliconOps WSL or Linux Docker host to private AWS, Microsoft Azure and Google Cloud networks

Provider-specific network paths

The tunnel pattern is shared. The cloud resources are not.

Each guided plan uses the selected provider’s network, firewall, addressing and router primitives while producing a consistent worker-side WireGuard outcome.

AWS VPC

Network: VPC and workload subnets
Router: EC2 WireGuard router
Boundary: Security and routing rules
Scope: AWS account and region

Azure VNet

Network: VNet and workload subnet
Router: Azure VM WireGuard router
Boundary: NSG, address and routing controls
Scope: Subscription and Azure region

Google Cloud VPC

Network: Custom VPC and regional subnet
Router: Compute Engine WireGuard router
Boundary: Firewall rule and regional static IP
Scope: Project, region and zone

Azure walkthrough example

Configure, provision, connect and verify the tunnel.

These screenshots show the Azure path. AWS and Google Cloud follow the same controlled stages with provider-specific VPC, router, firewall and addressing steps.

Select any screenshot to inspect it at full size.

IntelliconOps private networking configure the network screen — 1
Configure the network
Choose WireGuard, identify the Azure VNet and workload subnet, then define the tunnel range, UDP port and router.

IntelliconOps private networking review the provisioned foundation screen — 2
Review the provisioned foundation
Confirm automation SSH readiness, router and NAT settings, expected costs and the generated provisioning plan.

IntelliconOps private networking build the bridge screen — 3
Build the bridge
Run the ordered Azure steps, configure both peers and enable Docker-to-WireGuard forwarding where WSL requires it.

IntelliconOps private networking verify and operate screen — 4
Verify and operate
Test router reachability, the workload route and a recent WireGuard handshake, then retain an explicit teardown path.

Where the tunnel fits

Cloud control calls and private guest traffic use different paths.

The WireGuard route does not replace AWS, Azure or Google Cloud authentication. It gives IntelliconOps a controlled network path to private workload addresses after provider operations have created or discovered the infrastructure.

OpenTofuCalls provider APIs using scoped cloud credentials

PythonRuns discovery, preflight and lifecycle operations through provider APIs

SSH / AnsibleUses WireGuard to reach private guest IP addresses

VerificationChecks router reachability, workload route and recent handshake

Supported host patterns

Put the peer on the host that owns Docker networking.

WSL development

Install WireGuard in the WSL distribution that owns wg0 and persist the Docker bridge forwarding rules across restarts.

DigitalOcean deployment

Use the customer droplet as the initiating peer and route its IntelliconOps container traffic through the tunnel.

Other Linux Docker hosts

Apply the same host-level pattern where the server supports WireGuard, forwarding, firewall rules and persistent services.

Network safeguards

Make private reachability observable and reversible.

Reject overlapping tunnel, Docker and workload address ranges
Keep WireGuard private keys on their respective hosts
Allow workload SSH from the tunnel boundary rather than the public internet
Verify router reachability, workload routing and handshake freshness
Expose ordered teardown steps for provisioned networking resources

Current operating boundary: the guided setup still includes host-level installation, peer key exchange and forwarding steps that an authorised operator must complete.

Private infrastructure automation

Connect the worker to private workloads across all three clouds.

Use a guided WireGuard route from the Docker host into an AWS VPC, Azure VNet or Google Cloud VPC, then let governed SSH and Ansible workflows operate over private addresses.

Explore OpenTofu, Python and Ansible

See IntelliconOps in action

Give every cloud request a clear, controlled path.

Tell us how your teams manage infrastructure today. We will show you how IntelliconOps can simplify the work.

Book a demonstration