How can two VPS instances communicate privately?
Private connectivity can use a provider network or an explicitly configured encrypted overlay, depending on service support. Two VPS instances are not automatically isolated peers merely because they are in the same account or data centre.
Instructions
1. Confirm the supported topology
Ask whether the services share an eligible private network, which addresses are allocated, and whether traffic is isolated, encrypted or separately billed. Do not confuse private addressing with encryption or application authorisation.
2. Configure only the approved peers and services
Use the provider’s permitted network workflow or a reviewed VPN design. Restrict service listeners and firewall rules to the required peers. Keep database authentication and TLS where appropriate even on a private path.
3. Verify routing and existing tunnel state
Inside each Linux guest, inspect routing. If an approved WireGuard interface already exists, check its nonsecret operational state.
ip route
wg show wg0 latest-handshakesThe WireGuard check applies only to an existing interface named wg0. It shows peer handshake timing, not proof that every application route or permission is correct.
Check the result
- Traffic uses the intended private or encrypted route between the authorised peers.
- Only the required services are reachable and their normal authentication succeeds.
Troubleshooting
- Both machines have private addresses but cannot connect
- They may belong to different isolated networks or lack a route; confirm allocation and policy.
- The tunnel handshake works but the application fails
- Check allowed routes, listener binding, firewall rules and application-level access independently.
Official references
Use the documentation for your installed version when a flag, service name or platform feature differs.