> For the complete documentation index, see [llms.txt](https://docs.ititanhosting.ro/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.ititanhosting.ro/docs/english/vps/linux/how-to-set-up-wireguard-vpn-on-ubuntu.md).

# How to set up WireGuard VPN on Ubuntu

WireGuard is a modern VPN protocol. It is faster, simpler, and more secure than older solutions like OpenVPN. A single configuration file is all you need to get started.

Setting up your own VPN on a VPS gives you a private tunnel to the internet. You can secure your connection on public Wi-Fi, access your home network remotely, or give team members secure access to your server.

### Step 1: Install WireGuard

```bash
sudo apt update
sudo apt install wireguard -y
```

### Step 2: Generate server keys

WireGuard uses public and private keys, similar to SSH:

```bash
cd /etc/wireguard
umask 077
wg genkey | tee server-private.key | wg pubkey > server-public.key
```

This creates two files. `server-private.key` stays secret on your server. `server-public.key` can be shared with clients.

### Step 3: Create the server configuration

```bash
sudo nano /etc/wireguard/wg0.conf
```

Paste the following, replacing the private key with your server's private key:

```ini
[Interface]
PrivateKey = <paste-server-private-key-here>
Address = 10.0.0.1/24
ListenPort = 51820
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

[Peer]
PublicKey = <client-public-key>
AllowedIPs = 10.0.0.2/32
```

Get your server's private key:

```bash
sudo cat /etc/wireguard/server-private.key
```

Replace `eth0` with your actual network interface if it is different. Check with `ip route | grep default`.

### Step 4: Enable IP forwarding

For the VPN to route traffic, enable IP forwarding:

```bash
sudo nano /etc/sysctl.conf
```

Uncomment or add this line:

```
net.ipv4.ip_forward=1
```

Apply it:

```bash
sudo sysctl -p
```

### Step 5: Configure the firewall

Allow the WireGuard port through UFW:

```bash
sudo ufw allow 51820/udp
```

### Step 6: Start WireGuard

```bash
sudo systemctl start wg-quick@wg0
sudo systemctl enable wg-quick@wg0
```

Check the status:

```bash
sudo wg show
```

You should see your interface with the configured peer.

### Step 7: Set up a client (Linux desktop or laptop)

On the client machine, install WireGuard:

```bash
sudo apt install wireguard -y   # Debian/Ubuntu
# or
sudo dnf install wireguard-tools -y   # Fedora
```

Generate client keys:

```bash
wg genkey | tee client-private.key | wg pubkey > client-public.key
```

Create the client configuration:

```bash
sudo nano /etc/wireguard/wg0.conf
```

```ini
[Interface]
PrivateKey = <client-private-key>
Address = 10.0.0.2/24
DNS = 1.1.1.1

[Peer]
PublicKey = <server-public-key>
Endpoint = your-server-ip:51820
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25
```

Setting `AllowedIPs = 0.0.0.0/0` routes all traffic through the VPN. If you only want to access the server network, use `AllowedIPs = 10.0.0.0/24` instead.

### Step 8: Add the client's public key to the server

On the server, add another peer to `wg0.conf`:

```ini
[Peer]
PublicKey = <client-public-key>
AllowedIPs = 10.0.0.2/32
```

Then restart WireGuard:

```bash
sudo systemctl restart wg-quick@wg0
```

### Step 9: Connect the client

```bash
sudo wg-quick up wg0
```

Test the connection by pinging the server from the client:

```bash
ping 10.0.0.1
```

If you set up full tunnel, check your public IP. It should now show your server's IP.

### Step 10: Set up a mobile client (iOS/Android)

1. Install the WireGuard app from the App Store or Google Play
2. Tap the plus icon, then "Create from file or archive"
3. Transfer the client config file to your phone
4. Import the file and tap Connect

### Managing WireGuard

Add a new client:

1. Generate keys on the client machine
2. Add a new `[Peer]` section on the server
3. Restart WireGuard
4. Give the client config to the user

Remove a client:

Delete its `[Peer]` section from the server config and restart.

Check active connections:

```bash
sudo wg show
```

Each connected client shows its latest handshake time.

### Common issues

**"Destination address required"** The client AllowedIPs might be wrong. For full tunnel, use `0.0.0.0/0`. For split tunnel, use only the VPN subnet.

**No internet after connecting** IP forwarding might be disabled, or the NAT rule may reference the wrong interface. Check `sudo sysctl net.ipv4.ip_forward` and `ip route | grep default`.

**Handshake fails** Make sure UDP port 51820 is open in the firewall. Check that the endpoint IP and port are correct on the client.

### Performance notes

WireGuard adds very little overhead. You will barely notice the difference from a direct connection. It uses modern cryptography and runs in the Linux kernel, making it extremely fast.

### Conclusion

WireGuard is the best VPN for most use cases. Simple to configure, fast, and secure. You now have your own private VPN server running on your VPS.