How to connect two servers over a private network

When you have an app on one server and the database on another, you do not want the traffic between them to cross the public internet. An encrypted private network solves this. The simplest method is a WireGuard tunnel.

1. Install WireGuard on both servers

apt-get install -y wireguard

2. Configure the tunnel

Each server gets a private address, for example 10.10.0.1 and 10.10.0.2. See the configuration steps in the WireGuard guide, applied on both ends.

3. Communicate over the private addresses

The app connects to the database using the private address:

DB_HOST=10.10.0.2

4. Do not expose the service publicly

The database listens only on the private address, and the firewall blocks the port from the internet:

ufw allow from 10.10.0.1 to any port 5432

Why it matters

• Traffic between servers is encrypted and isolated.
• The database is never publicly exposed, see Connect to a remote database.
• You can add any number of servers to the same private network.