VPS for Teltonika Routers: WireGuard Hub Setup for RUTX and RUT Series

Why Teltonika routers and a VPS work so well together

Teltonika is the dominant cellular router brand for UK industrial, utility and commercial IoT deployments. The RUTX12, RUTX09, RUT360, RUT241 and TRB140 between them cover most remote-site cellular connectivity use cases.

All current Teltonika firmware (RutOS 7.x and above) includes WireGuard as a built-in WebUI feature. This means configuring the WireGuard tunnel from a Teltonika router requires no command-line access, no OpenWRT customisation and no third-party software – it is all in the standard configuration interface.

The result: a VPS running as the WireGuard hub gives you remote access to every Teltonika-connected site, replacing the need for expensive fixed-IP SIM cards across a fleet.

WireGuard vs OpenVPN on Teltonika routers

For new deployments, WireGuard is the recommended choice. OpenVPN remains available for legacy compatibility.

Setting up the VPS as a WireGuard hub

# Install WireGuard on the VPS (Ubuntu 22.04+)
sudo apt install wireguard

# Generate the VPS key pair
wg genkey | tee /etc/wireguard/private.key | wg pubkey > /etc/wireguard/public.key
chmod 600 /etc/wireguard/private.key

cat /etc/wireguard/public.key  # Copy this - you need it for each router

# VPS WireGuard config (/etc/wireguard/wg0.conf)
[Interface]
PrivateKey = YOUR_VPS_PRIVATE_KEY
Address = 10.0.0.1/24
ListenPort = 51820
PostUp   = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

# Teltonika router - Site 1
[Peer]
PublicKey = SITE1_ROUTER_PUBLIC_KEY
AllowedIPs = 10.0.0.2/32, 192.168.1.0/24

# Teltonika router - Site 2
[Peer]
PublicKey = SITE2_ROUTER_PUBLIC_KEY
AllowedIPs = 10.0.0.3/32, 192.168.2.0/24

sudo systemctl enable wg-quick@wg0 --now
# Open the WireGuard port
sudo ufw allow 51820/udp

Configuring WireGuard on a Teltonika router

In the Teltonika WebUI (Services > VPN > WireGuard):

1. Enable WireGuard and create a new interface
2. The router generates its own key pair automatically – copy the public key for your VPS config
3. Add a peer: enter the VPS public key, the VPS endpoint (your VPS IP:51820), and the allowed IP (10.0.0.1/32)
4. Set the router’s tunnel IP (e.g. 10.0.0.2/24)
5. Enable PersistentKeepalive (25 seconds) to maintain the tunnel through cellular NAT
6. Add a static route: the VPS management network (10.0.0.0/24) via the WireGuard interface

Replacing fixed-IP SIM cards with a VPS hub

A fixed-IP SIM card typically costs £5-15/month per router. If you have 10 remote sites, that is £50-150/month just for the IP addressing. A VPS hub at £5-8/month serves all 10 sites.

The VPS approach also removes the constraint that fixed-IP SIMs impose: you are not tied to a single network operator. Each router can use whichever SIM network has the best signal at that site, including dual-SIM setups that switch automatically on failure.

Milesight UR series as an alternative to Teltonika

For UK industrial deployments, Milesight UR32, UR35 and UR75 routers are the main alternative to Teltonika. The Milesight Development Platform provides additional device management capabilities beyond raw WireGuard connectivity. The WireGuard configuration approach on a VPS is identical to Teltonika – the same VPS hub serves both brands simultaneously. This is the standard pattern for integrators who source routers from multiple manufacturers depending on availability or customer preference.

RMS (Remote Management System) vs self-hosted VPS

Teltonika’s RMS is a cloud-based management platform for Teltonika routers (firmware updates, configuration templates, remote console). It is separate from the VPN connectivity question. Many deployments use both: RMS for router management (via Teltonika’s cloud), and a self-hosted VPS for accessing the equipment connected to each router. They are not in competition – they solve different problems.

Fleet management at scale

For fleets of more than 20 routers, the Zero-Touch Fleet Provisioning guide covers a script-based approach to generating and distributing WireGuard configuration to new routers automatically, without manually configuring each one through the WebUI.

Teltonika’s own RMS (Remote Management System) platform can co-exist with a VPS WireGuard hub. Use RMS for router configuration and firmware updates; use the WireGuard hub for accessing devices connected to each router’s LAN.

Compatible Teltonika models

Dual-SIM resilience for critical Teltonika sites

The Teltonika RUTX12 carries two independent LTE modems (not dual-SIM on one modem), each on a separate SIM from different operators. MWAN3 (the multi-WAN load balancer) switches to the backup modem in under 30 seconds if the primary modem loses connectivity. The WireGuard tunnel re-establishes automatically on the backup connection. For critical remote monitoring sites – substations, water treatment works, unmanned plant rooms – this pattern eliminates single-SIM failure as a connectivity risk without requiring fixed-line backup.

Monitoring Teltonika router uptime from the VPS

Set up a Ping monitor in Uptime Kuma on the VPS for each router’s WireGuard tunnel IP (10.0.0.2, 10.0.0.3 etc.). If a router’s tunnel drops, the ping fails and Uptime Kuma sends an alert. This gives active monitoring of fleet-wide connectivity from the central VPS without needing RMS or any cloud dependency.

Frequently asked questions

Which firmware version does Teltonika need for WireGuard?

WireGuard is available in RutOS 7.x and above. All current Teltonika routers shipped after 2021 support it. Older routers can be upgraded to RutOS 7.x via the WebUI or RMS.

Can I use the VPS hub alongside Teltonika RMS?

Yes. RMS is Teltonika’s cloud-based router management system for configuration, monitoring and firmware updates. The VPS WireGuard hub is for accessing the devices connected to each router. They serve different purposes and work in parallel.

What happens to the WireGuard tunnel if the cellular connection drops?

WireGuard is designed to reconnect automatically. When the cellular connection restores, the router re-establishes the tunnel to the VPS hub within seconds. No manual intervention is needed.

Can two Teltonika routers at different sites reach each other through the VPS hub?

Yes, with IP forwarding enabled on the VPS and routing rules in place. Traffic from Site 1’s subnet passes through the hub to Site 2’s subnet. This is the hub-and-spoke model described in the WireGuard Hub guide.

Is there a limit to how many Teltonika routers can connect to one VPS?

In practice, hundreds. The VPS handles each connection as a WireGuard peer. The constraints are bandwidth and the OS routing table. A 4 vCPU / 4GB RAM VPS handles several hundred simultaneously connected routers with typical IoT traffic patterns.