Your own private network, laptop to container
Every Pro and Agency customer gets a private WireGuard network: a dedicated /24 subnet connecting your devices to your containers and databases through an encrypted tunnel. Download a peer config, import it, and your laptop is on the same private network as your infrastructure.
Three steps
From dashboard to connected in minutes
WireGuard keeps the moving parts to a minimum: one config file per device, one app to import it into.
Add a peer
In the dashboard, add a peer for each device: your laptop, a teammate's machine, or the office router. Each peer gets its own key and its own address on your /24.
Download the config
Grab the generated config file and import it into the free WireGuard app on macOS, Windows, Linux, iOS or Android. No proprietary client to license or learn.
Connect, then change it live
Toggle the tunnel on and you're on your private network. Peers can be added or revoked at any time, and updates apply live without restarting anything.
What you'd actually use it for
Query production databases from local tools
Point TablePlus, DBeaver or psql at your database's private address and work directly, without ever opening a database port to the public internet.
Private admin and internal services
Keep internal dashboards and work-in-progress services reachable only over the tunnel. If it's not meant for the public, it never has a public address.
Connect the whole office
Put a WireGuard peer on the office router and everyone on the office network can reach your G7Cloud workloads privately, with no per-machine setup.
Scripts and integrations
Backup scripts, ETL jobs and internal tooling can talk to your containers over the private network instead of authenticating across the open internet.
Per-customer, like everything else here
One network per customer. Not one network for everyone.
Your /24 subnet is provisioned for you alone, and only peers you create can join it. That's the same isolation philosophy as the rest of the platform: one dedicated container per site, one database per site, one private network per customer, all running on UK infrastructure we operate ourselves. It also pairs naturally with the developer tooling . Deploy over git, then reach the running container privately.
Private networking FAQ
WireGuard, peers and plans, plainly answered.
What is WireGuard?
WireGuard is a modern, open-source VPN protocol built into the Linux kernel and available as free apps for macOS, Windows, iOS and Android. It creates an encrypted tunnel between your device and your G7Cloud network using a small config file. No proprietary client, no vendor lock-in.
Which plans include private networking?
WireGuard private networking is included on Pro (£59/month) and Agency (£179/month). Every customer on those plans gets their own private network: a dedicated /24 subnet that only their peers can join.
How do I connect a device?
Add a peer in the dashboard, download the generated config file, and import it into the WireGuard app on your laptop, phone or office router. From that moment the device has a private address on your /24 and can reach your containers directly.
Can I add and remove devices without downtime?
Yes. Peer updates are applied live. Adding a new teammate's laptop or revoking a departed contractor's access takes effect without restarting the network or your sites.
Why would I want this instead of exposing a database port?
Opening database ports to the internet means relying on passwords and IP allow-lists to keep the world out. With WireGuard, your database is simply not reachable from the public internet at all. Only devices holding a valid peer key on your private network can see it.
Is each customer's network separate?
Yes. Networks are per-customer: your /24 subnet is yours alone, and peers on your network can only reach your workloads. It matches the rest of the platform: one dedicated container per site, one database per site, one private network per customer.