Networking & SecurityMin. specs: 2 vCores, 2–4 GB RAM, 2.5 Gbit/s Network Port

WireGuard / AmneziaWG High-Speed VPN Node — Recommended Netcup server & voucher

Netcup's 2.5 Gbit/s ports in Vienna (VIX), Nuremberg, and Amsterdam deliver ultra-low latency routing across Europe with a €5 instant voucher discount.

Reference Docker stackamnezia-wg-easy + xray-reality + adguard-home + unbound-dns
Estimated workload capacity2.5 Gbps line-rate encrypted throughput for 50+ devices

Partner notice: we may receive a commission when you order through our links. The price you pay does not change.

Primary production choice

VPS 500 G12.5

VPS • G12.5
€5 Instant Discount
€8.26/ moincl. 19% VAT

2 vCores (x86) · 4 GB RAM · 64 GB SSD · 2.5 Gbit/s

GB6: 1,710/2,890 · FIO 4K: 115,000 IOPS · Steal: 1.4 %

36nc17927037630
Redeem ↗
✓ Verified Code (24/10/2026) • Universal €5 New Customer Code
Budget / starter alternative
€5 New Customer Voucher
€3.56/ moincl. 19% VAT

1–2 vCores (Low-Cost Node) · 2 GB RAM · 30 GB SSD · 1 Gbit/s

GB6: 980/1,450 · FIO 4K: 45,000 IOPS · Steal: 1.8 %

36nc17927037630
Redeem ↗
✓ Verified Code (24/10/2026) • Universal €5 New Customer Code
Production Engineering Guide

Engineering Guide: Running WireGuard / AmneziaWG High-Speed VPN Node on Netcup Infrastructure

Recommended kernel parameters, memory management, and security hardening for maximum reliability.

1

Memory Management & Swappiness

Add a 4–8 GB swapfile and set "sysctl vm.swappiness=10" to prevent the Linux OOM Killer from terminating container processes during memory allocation spikes.

2

SMTP Port 25 for Alerts

If your app sends notification emails: delete the "netcup Mail block" rule in SCP Firewall and configure a clean reverse DNS (rDNS/PTR) record matching your domain.

3

Persistent Storage & Offsite Backups

Mount application state into named Docker volumes. Automate daily offsite backups using BorgBackup or Restic — remember SCP snapshots expire automatically after 30 days.

4

Firewall & SSH Port Hardening

Keep UFW active allowing only ports 80 and 443 publicly. Shift SSH from port 22 to a custom high port to eliminate automated credential stuffing scan noise.