Tweet
Complete Guide: How to Setup Your Own WireGuard VPN Server on Linux
WireGuard is a modern, extremely fast, and secure VPN protocol that outperforms older protocols like OpenVPN and IPsec. This comprehensive guide will show you how to deploy your own WireGuard server on Ubuntu/Debian and connect your clients.
Prerequisites
Step 1: Update the System and Install WireGuard
First, connect to your VPS via SSH and ensure all packages are up to date before installing WireGuard:
Step 2: Enable IP Forwarding
For the VPN to route your internet traffic, you must enable packet forwarding in the Linux kernel:
Step 3: Generate Server and Client Keys
WireGuard relies on public/private key cryptography. Let's generate the key pairs for both the server and your first client device.
Generate Server Keys:
Generate Client Keys:
Tip: Read the keys using cat /etc/wireguard/server_private.key (etc.) when pasting them into the configuration files below.
Step 4: Configure the WireGuard Server
Find your primary network interface name using ip route show | grep default (usually eth0 or ens3).
Create the server configuration file:
Paste the following configuration (replace eth0, , and with your actual data):
Step 5: Start and Enable the WireGuard Service
Set correct file permissions, start the server interface, and enable it to launch automatically on system boot:
Step 6: Create the Client Configuration Profile
On your local machine or server, create a configuration file named client.conf for your mobile device or laptop.
Paste the following structure (replace placeholders with your generated keys and server IP):
Step 7: Generate a QR Code for Easy Mobile Setup (Optional)
If you are using the WireGuard app on an iPhone or Android device, you can instantly import the profile by scanning a QR code on your terminal screen.
Install the QR tool and scan the client configuration file:
Your ultra-fast WireGuard server is now up and running! Reply to this thread if you encounter any routing or port-forwarding issues.
WireGuard is a modern, extremely fast, and secure VPN protocol that outperforms older protocols like OpenVPN and IPsec. This comprehensive guide will show you how to deploy your own WireGuard server on Ubuntu/Debian and connect your clients.
Prerequisites
- A Linux VPS (Ubuntu 22.04 LTS or 24.04 LTS preferred)
- Root or sudo access
- A public static IP address
Step 1: Update the System and Install WireGuard
First, connect to your VPS via SSH and ensure all packages are up to date before installing WireGuard:
Code:
sudo apt update && sudo apt upgrade -y sudo apt install wireguard -y
Step 2: Enable IP Forwarding
For the VPN to route your internet traffic, you must enable packet forwarding in the Linux kernel:
Code:
echo "net.ipv4.ip_forward=1" | sudo tee -a /etc/sysctl.conf sudo sysctl -p
Step 3: Generate Server and Client Keys
WireGuard relies on public/private key cryptography. Let's generate the key pairs for both the server and your first client device.
Generate Server Keys:
Code:
wg genkey | sudo tee /etc/wireguard/server_private.key | wg pubkey | sudo tee /etc/wireguard/server_public.key
Code:
wg genkey | wg pubkey > client_public.key wg genkey > client_private.key
Step 4: Configure the WireGuard Server
Find your primary network interface name using ip route show | grep default (usually eth0 or ens3).
Create the server configuration file:
Code:
sudo nano /etc/wireguard/wg0.conf
Code:
[Interface] Address = 10.0.0.1/24 SaveConfig = true ListenPort = 51820 PrivateKey = ### Firewall rules to route traffic PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j ACCEPT PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j ACCEPT [Peer] ### Client 1 Info PublicKey = AllowedIPs = 10.0.0.2/32
Step 5: Start and Enable the WireGuard Service
Set correct file permissions, start the server interface, and enable it to launch automatically on system boot:
Code:
sudo chmod 600 /etc/wireguard/wg0.conf sudo systemctl start wg-quick@wg0 sudo systemctl enable wg-quick@wg0
Step 6: Create the Client Configuration Profile
On your local machine or server, create a configuration file named client.conf for your mobile device or laptop.
Paste the following structure (replace placeholders with your generated keys and server IP):
Code:
[Interface] Address = 10.0.0.2/24 PrivateKey = DNS = 1.1.1.1, 8.8.8.8 [Peer] PublicKey = Endpoint = :51820 AllowedIPs = 0.0.0.0/0 PersistentKeepalive = 25
Step 7: Generate a QR Code for Easy Mobile Setup (Optional)
If you are using the WireGuard app on an iPhone or Android device, you can instantly import the profile by scanning a QR code on your terminal screen.
Install the QR tool and scan the client configuration file:
Code:
sudo apt install qrencode -y qrencode -t ansiutf8 < client.conf
Your ultra-fast WireGuard server is now up and running! Reply to this thread if you encounter any routing or port-forwarding issues.