Connect Peers Across Clouds - Telnyx

A WireGuard Interface forwards traffic between its peers. Hosts in different clouds that join the same interface reach each other on the interface subnet, even when their cloud firewalls block all inbound traffic except SSH.

Setup

Create a WireGuard Interface and wait for provisioned, as in the Quick Start.
Create one peer for each host and load each configuration with WireGuard on Linux. Both configurations route 172.27.0.0/24 through the tunnel.
Leave inbound HTTP closed in both cloud firewalls. Each peer opens its tunnel to the interface endpoint, so WireGuard needs no inbound rule.

Result

Both instances run a web server and allow only inbound SSH, so neither answers from the internet:

user@localhost ~ % ping 34.201.0.189
PING 34.201.0.189 (34.201.0.189): 56 data bytes
Request timeout for icmp_seq 0
Request timeout for icmp_seq 1
^C
--- 34.201.0.189 ping statistics ---
3 packets transmitted, 0 packets received, 100.0% packet loss
user@localhost ~ % curl 34.201.0.189
^C

Over the interface subnet, each instance reaches the other. From the EC2 instance:

ubuntu@ip-10-10-11-10:~$ curl 172.27.0.3
<!DOCTYPE html>
<html>
    <head>
        <title>I am the Droplet Peer in DigitalOcean</title>
    </head>
</html>

From the Droplet:

root@ubuntu-s-1vcpu-512mb-10gb-nyc1-01:~# curl 172.27.0.2
<!DOCTYPE html>
<html>
    <head>
        <title>I am the EC2 Peer in AWS</title>
    </head>
</html>

Add more peers in other clouds or data centers the same way. Every peer on the interface reaches every other peer on 172.27.0.0/24.