> ## Documentation Index
> Fetch the complete documentation index at: https://developers.telnyx.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Connect Peers Across Clouds

> Use one WireGuard Interface as a hub so hosts in different clouds reach each other on the peer subnet while their public firewalls stay closed.

A WireGuard Interface forwards traffic between its peers. Hosts in different clouds that join the same interface reach each other on the interface subnet, even when their cloud firewalls block all inbound traffic except SSH.

The diagram shows an AWS EC2 instance (`172.27.0.2`) and a DigitalOcean
Droplet (`172.27.0.3`), each allowing only inbound SSH from the internet.
Both connect over WireGuard tunnels to one WireGuard Interface (`172.27.0.1`,
endpoint `64.16.243.3:5107`) in `ashburn-va`. HTTP between the two peers
goes via the interface at `172.27.0.1`.

## Setup

1. Create a WireGuard Interface and wait for `provisioned`, as in the [Quick Start](/docs/network/wireguard-interfaces/quick-start).
2. Create one peer for each host and load each configuration with [WireGuard on Linux](/docs/network/wireguard-peer-config/linux). Both configurations route `172.27.0.0/24` through the tunnel.
3. Leave inbound HTTP closed in both cloud firewalls. Each peer opens its tunnel to the interface endpoint, so WireGuard needs no inbound rule.

## Result

Both instances run a web server and allow only inbound SSH, so neither answers from the internet:

```bash theme={null}
user@localhost ~ % ping 34.201.0.189
PING 34.201.0.189 (34.201.0.189): 56 data bytes
Request timeout for icmp_seq 0
Request timeout for icmp_seq 1
^C
--- 34.201.0.189 ping statistics ---
3 packets transmitted, 0 packets received, 100.0% packet loss
user@localhost ~ % curl 34.201.0.189
^C
```

Over the interface subnet, each instance reaches the other. From the EC2 instance:

```bash theme={null}
ubuntu@ip-10-10-11-10:~$ curl 172.27.0.3
<!DOCTYPE html>
<html>
    <head>
        <title>I am the Droplet Peer in DigitalOcean</title>
    </head>
</html>
```

From the Droplet:

```bash theme={null}
root@ubuntu-s-1vcpu-512mb-10gb-nyc1-01:~# curl 172.27.0.2
<!DOCTYPE html>
<html>
    <head>
        <title>I am the EC2 Peer in AWS</title>
    </head>
</html>
```

Add more peers in other clouds or data centers the same way. Every peer on the interface reaches every other peer on `172.27.0.0/24`.