Ctrlk
For the complete documentation index, see llms.txt. This page is also available as Markdown.

How to set up WireGuard VPN on Ubuntu

WireGuard is a modern VPN protocol. It is faster, simpler, and more secure than older solutions like OpenVPN. A single configuration file is all you need to get started.

Setting up your own VPN on a VPS gives you a private tunnel to the internet. You can secure your connection on public Wi-Fi, access your home network remotely, or give team members secure access to your server.

Step 1: Install WireGuard

sudo apt update
sudo apt install wireguard -y

Step 2: Generate server keys

WireGuard uses public and private keys, similar to SSH:

cd /etc/wireguard
umask 077
wg genkey | tee server-private.key | wg pubkey > server-public.key

This creates two files. server-private.key stays secret on your server. server-public.key can be shared with clients.

Step 3: Create the server configuration

sudo nano /etc/wireguard/wg0.conf

Paste the following, replacing the private key with your server's private key:

[Interface]
PrivateKey = <paste-server-private-key-here>
Address = 10.0.0.1/24
ListenPort = 51820
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

[Peer]
PublicKey = <client-public-key>
AllowedIPs = 10.0.0.2/32

Get your server's private key:

Replace eth0 with your actual network interface if it is different. Check with ip route | grep default.

Step 4: Enable IP forwarding

For the VPN to route traffic, enable IP forwarding:

Uncomment or add this line:

Apply it:

Step 5: Configure the firewall

Allow the WireGuard port through UFW:

Step 6: Start WireGuard

Check the status:

You should see your interface with the configured peer.

Step 7: Set up a client (Linux desktop or laptop)

On the client machine, install WireGuard:

Generate client keys:

Create the client configuration:

Setting AllowedIPs = 0.0.0.0/0 routes all traffic through the VPN. If you only want to access the server network, use AllowedIPs = 10.0.0.0/24 instead.

Step 8: Add the client's public key to the server

On the server, add another peer to wg0.conf:

Then restart WireGuard:

Step 9: Connect the client

Test the connection by pinging the server from the client:

If you set up full tunnel, check your public IP. It should now show your server's IP.

Step 10: Set up a mobile client (iOS/Android)

  1. Install the WireGuard app from the App Store or Google Play

  2. Tap the plus icon, then "Create from file or archive"

  3. Transfer the client config file to your phone

  4. Import the file and tap Connect

Managing WireGuard

Add a new client:

  1. Generate keys on the client machine

  2. Add a new [Peer] section on the server

  3. Restart WireGuard

  4. Give the client config to the user

Remove a client:

Delete its [Peer] section from the server config and restart.

Check active connections:

Each connected client shows its latest handshake time.

Common issues

"Destination address required" The client AllowedIPs might be wrong. For full tunnel, use 0.0.0.0/0. For split tunnel, use only the VPN subnet.

No internet after connecting IP forwarding might be disabled, or the NAT rule may reference the wrong interface. Check sudo sysctl net.ipv4.ip_forward and ip route | grep default.

Handshake fails Make sure UDP port 51820 is open in the firewall. Check that the endpoint IP and port are correct on the client.

Performance notes

WireGuard adds very little overhead. You will barely notice the difference from a direct connection. It uses modern cryptography and runs in the Linux kernel, making it extremely fast.

Conclusion

WireGuard is the best VPN for most use cases. Simple to configure, fast, and secure. You now have your own private VPN server running on your VPS.

Last updated