Quickstart Guide

The full route traffic takes in the example topology: Istanbul → Nuremberg → Falkenstein → Internet

The example topology built in this guide shows how your traffic reaches the internet.

The Istanbul client connects to Phantom-Frontmatter in Nuremberg over wstunnel; Phantom-Frontmatter forwards the masked traffic to the Phantom-WG server in Falkenstein, and your exit to the internet happens from there.

From the outside only an ordinary HTTPS connection is visible, while the server that actually carries your VPN connection sits in a different — and nearby — physical location.

This is what we're building. We start by provisioning the Hetzner servers.

Creating the servers with the hcloud CLI: Nuremberg (Phantom-Frontmatter) and Falkenstein (Phantom-WG)

The video uses the hcloud CLI, but the web console does the same job if you prefer easier management.

In this step we'll prepare two servers.

• Phantom-Frontmatter (Nuremberg)
• Phantom-WG (Falkenstein)

1 · Generate the SSH Key

2 · Create cloud-init.yaml

Before creating the servers, prepare a cloud-init.yaml file. When Hetzner provisions the server, this file runs automatically on first boot: it updates the system and installs Docker, which Phantom-WG requires. By the time the server is ready, the core requirements are already in place. You can customize the file to your own needs if you like.

3 · Create the Servers

4 · Verify via CLI

5 · Console + DNS

In the Hetzner Console, open your DNS zone and point a domain name at each of the two servers. These records are required so the Let's Encrypt certificates can be issued later without issues.

Install, Configure, Connect

Installation

Configuration

Open the dashboard address in your browser (vpn.phantom-wg.dev in this example) and sign in with the admin credentials you saved during setup (username admin).

To establish a connection, first create a client: from the left menu, Clients → Add Client, give it a name (here mac-vm) and create the client. Once it appears in the list, select Get Config from the three-dot menu next to it. There are three configuration types:

• IPv4 — IPv4 endpoint, and traffic inside the tunnel is IPv4 only.
• IPv6 — IPv6 endpoint, and traffic inside the tunnel is IPv6 only.
• Hybrid — IPv4 endpoint, but both IPv4 and IPv6 traffic can travel inside the tunnel; usually the most flexible option.

Select Hybrid, get the configuration with Get Config, and copy it. Open the Phantom-WG client, import the configuration, and connect. You can also view the configuration as a QR code, which is handy for setting up on mobile devices. Finally, from the WireGuard section on the dashboard, you can confirm that the handshake completed and the tunnel is active.

Ghost Mode — a lightweight wstunnel proxy layer that reaches Phantom-WG even when direct UDP access is blocked

Installation

Configuration

There are two ways to establish a connection.

The first method provides a Wstunnel configuration block designed for the Phantom-WG client apps on Mac and iOS. Add this block to the top of your existing client configuration, update the server address with your reachable Phantom-Frontmatter IP or domain, and set Endpoint to 127.0.0.1. This lets you connect with the same configuration on both desktop and mobile.

The second method generates a ready-to-use wstunnel command; it's handy if you prefer running wstunnel directly from the terminal (and have it installed on your device).

This guide uses the first method: add the Wstunnel block to your existing client configuration, set Endpoint to 127.0.0.1, and connect — the same steps apply in the Phantom-WG iOS app as well. Once connected, all traffic is routed through Phantom-Frontmatter to your Phantom-WG server.