Knowledgebase

WireGuard is a modern, fast, and simple VPN protocol — significantly easier to configure than OpenVPN while offering better performance. This guide covers setting up your own WireGuard VPN server on a VPS.

Why Run Your Own VPN Server

• Full control over logging (or lack thereof), unlike third-party VPN providers
• Secure access to your VPS's internal network/services from anywhere
• Route your personal traffic through a server you control when on untrusted networks

Prerequisites

• Ubuntu 22.04/24.04 or Debian 11/12 VPS
• Root or sudo access

Step 1 — Install WireGuard

sudo apt update
sudo apt install wireguard -y

Step 2 — Generate Server Keys

cd /etc/wireguard
umask 077
wg genkey | sudo tee server_private.key | wg pubkey | sudo tee server_public.key

Step 3 — Create the Server Configuration

sudo nano /etc/wireguard/wg0.conf

[Interface]
PrivateKey = SERVER_PRIVATE_KEY_HERE
Address = 10.8.0.1/24
ListenPort = 51820
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

Replace eth0 with your VPS's actual primary network interface name (check with ip a).

Step 4 — Enable IP Forwarding

echo "net.ipv4.ip_forward=1" | sudo tee -a /etc/sysctl.conf
sudo sysctl -p

Step 5 — Allow the WireGuard Port Through the Firewall

sudo ufw allow 51820/udp

Step 6 — Start WireGuard

sudo systemctl enable --now wg-quick@wg0

Step 7 — Generate a Client Key Pair

On the client machine (or the server, then transfer securely):

wg genkey | tee client_private.key | wg pubkey > client_public.key

Step 8 — Add the Client to the Server Config

sudo nano /etc/wireguard/wg0.conf

[Peer]
PublicKey = CLIENT_PUBLIC_KEY_HERE
AllowedIPs = 10.8.0.2/32

sudo systemctl restart wg-quick@wg0

Step 9 — Create the Client Configuration

[Interface]
PrivateKey = CLIENT_PRIVATE_KEY_HERE
Address = 10.8.0.2/24
DNS = 1.1.1.1

[Peer]
PublicKey = SERVER_PUBLIC_KEY_HERE
Endpoint = YOUR_SERVER_IP:51820
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25

AllowedIPs = 0.0.0.0/0 routes all client traffic through the VPN; use a more specific range (e.g. just your VPS's internal subnet) if you only need access to specific internal resources rather than full traffic tunneling.

Step 10 — Connect from the Client

Import the client config into the official WireGuard app (desktop or mobile) and activate the connection.

Verifying the Connection

sudo wg show

Shows connected peers and their last handshake time — a recent handshake confirms the connection is active.

Adding Additional Clients

Repeat Steps 7-9 with a new key pair and a new AllowedIPs address (e.g. 10.8.0.3/32) for each additional device.

Common Errors

Client connects but has no internet access through the tunnel — verify IP forwarding is enabled and the PostUp/PostDown iptables rules reference the correct network interface name.

Handshake never completes — verify the firewall allows UDP port 51820, and that the client's Endpoint matches the server's actual public IP and port.

Best Practices

• Use a unique key pair and IP address per client/device
• Keep private keys secure — never share or commit them to version control
• Restrict AllowedIPs to only what's needed if full traffic tunneling isn't the goal

Related Articles

• How to Set Up an OpenVPN Server on a VPS
• How to Set Up a Site-to-Site VPN Between Two VPS Servers
• How to Harden a Fresh Linux VPS in 15 Minutes