wireguard hub-and-spoke: your topology?

I have been running a personal VPN for about two years now and the complexity has slowly grown. I will describe my current setup and I am curious how others have solved similar problems.

Current topology:
- Hub: 2 vCPU / 2GB VM at OVHcloud (KVM, not that OpenVZ nonsense—virtualization tax on OpenVZ is unacceptable for custom kernels)
- Spokes: three home routers, one laptop, one phone
- All spokes connect to hub, no spoke-to-spoke

The hub runs Debian with WireGuard in kernel module. I use iptables for forwarding, not nftables yet. Each spoke has its own /24 from 10.200.0.0/16. I static route everything through the hub because I want to filter at one point.

Problems I see:
- Hairpin latency when two home networks want to talk (traffic goes to OVHcloud and back)
- Hub is single point of failure
- I am paying for bandwidth I do not use most of the time

I considered full mesh but that is 10 tunnels to manage and my phone battery would suffer. I considered two hubs in different regions but then I need some way to sync WireGuard keys and firewall rules.

What do you run? Is anyone doing actual dynamic routing over WireGuard, or is that overkill for personal use? I am specifically interested if anyone has gotten BGP working at low-end price points without burning through the CPU quota.

Thank you for the detailed write-up, @kate3 — this is exactly the kind of technical discussion we love seeing in the community.

A few thoughts on your topology from our side at Contabo:

- Hub-and-spoke remains the most common pattern we observe among customers running personal VPN infrastructure
- For the hairpin issue, some users on our platform have had success with selective spoke-to-spoke tunnels for high-traffic pairs, keeping the hub for everything else
- On redundancy: we do see dual-hub setups, though key sync is indeed the pain point

If you would like, I am happy to check whether your current OVHcloud plan is giving you the I/O consistency you need for this workload — feel free to DM me your account details and I can review our current KVM offerings.

- 2 vCPU / 2GB starting at our usual entry tier
- WireGuard kernel module pre-installed on Debian 12 images
- Private networking between same-region instances at no charge

— Jane @ Contabo

The Virtualization Tax On The Openvz It Is Bad For The Wireguard Because You Need The Kernel Module.

I Have The Hub At The Vultr And Two Spokes At My Home And The Office.

The Full Mesh It Is Too Much Work For The Brain.

I Use The Bgp With The Bird On The Hub But It Is Only For Learning Not For The Real Traffic.

The Key Sync I Do With The Ansible And It Is Working Good.

The Cgroups On The Low End Vps They Are Tight For The Bird If You Have The Full Table.

RTFM

Yaml
- name: sync wireguard keys
Hosts: wg_hub
Tasks:
- name: generate keys
Command: wg genkey
Register: wg_private
- name: template config
Template:
Src: wg0.conf.j2
Dest: /etc/wireguard/wg0.conf

- your topology is YAML-shaped already
- just add another hub host in inventory
- `ansible-playbook site.yml` handles key distribution
- for BGP:
- bird2 config in `templates/bird.conf.j2`
- communities filter in `group_vars/all.yml`

RTFM: bird.readthedocs.io

No excuse for manual key sync in 2026 — I use https://www.wireguard.com

Which debian version on the hub

OpenVZ tax is real

What vCPU model at OVHcloud