Set up a WireGuard VPN server on a Linux VPS

WireGuard is a fast, modern VPN built into the Linux kernel. Running it on your own VPS gives you a private tunnel for admin access, a fixed IP to whitelist, or safe browsing on public Wi-Fi. This guide builds a server with one client; adding more is a copy of the peer block.

Before you start

• An Ubuntu 22.04+/Debian 12 VPS with root access (connect with SSH).
• The interface name of your public network (ip -br addr, often eth0).
• The WireGuard app on your device (Windows, macOS, Android, iOS or Linux).

Install WireGuard and create keys

sudo apt update && sudo apt install -y wireguard
cd /etc/wireguard
umask 077
wg genkey | tee server.key | wg pubkey > server.pub
wg genkey | tee client1.key | wg pubkey > client1.pub

Create the server config

Create /etc/wireguard/wg0.conf, pasting the contents of server.key and client1.pub:

[Interface]
Address = 10.8.0.1/24
ListenPort = 51820
PrivateKey = SERVER_PRIVATE_KEY
PostUp = iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
PostDown = iptables -t nat -D POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

[Peer]
PublicKey = CLIENT1_PUBLIC_KEY
AllowedIPs = 10.8.0.2/32

Enable forwarding and open the port

echo "net.ipv4.ip_forward=1" | sudo tee /etc/sysctl.d/99-wireguard.conf
sudo sysctl --system
sudo ufw allow 51820/udp

If UFW is active, also set DEFAULT_FORWARD_POLICY="ACCEPT" in /etc/default/ufw and reload. WireGuard uses UDP, not TCP (why it matters).

Start the tunnel

sudo systemctl enable --now wg-quick@wg0
sudo wg show

Create the client config

On your device create a tunnel with this content (private key from client1.key, public key from server.pub):

[Interface]
PrivateKey = CLIENT1_PRIVATE_KEY
Address = 10.8.0.2/24
DNS = 1.1.1.1

[Peer]
PublicKey = SERVER_PUBLIC_KEY
Endpoint = 203.0.113.25:51820
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25

AllowedIPs = 0.0.0.0/0 sends all traffic through the VPN. Use 10.8.0.0/24 instead to reach only the server privately (split tunnel). For phones, sudo apt install qrencode and qrencode -t ansiutf8 < client1.conf shows a QR code to scan.

Check it works

Activate the tunnel, then open /tools/ip-checker: it should show the VPS IP. On the server, sudo wg show lists a recent handshake for the peer.

Troubleshooting

• No handshake: UDP 51820 is blocked (server firewall, provider firewall or your network), or keys are swapped.
• Handshake but no internet: forwarding or the MASQUERADE rule is missing, or the wrong interface name is used.
• Some sites hang: lower the MTU (MTU troubleshooting).

Next steps

• Put Remote Desktop behind WireGuard
• Proxy vs VPN: which do you need?
• SSH tunnels and port forwarding