WireGuard VPN Setup Guide

A step-by-step DIY tutorial for setting up your own secure VPN

Introduction

WireGuard is a modern, fast, and secure VPN protocol that's easier to configure than traditional solutions like OpenVPN. This guide will walk you through setting up a WireGuard VPN server on Ubuntu/Debian and connecting a client to it.

Prerequisites

A server running Ubuntu 20.04+ or Debian 11+ with root access
A client device (laptop, phone, etc.)
Basic familiarity with the command line

Server Setup

Step 1: Update System and Install WireGuard

First, update your package list and install WireGuard on your server.

sudo apt update
sudo apt install wireguard -y

Step 2: Generate Server Keys

Generate private and public keys for the server. These keys are used for authentication.

cd /etc/wireguard
umask 077
wg genkey | tee server_private.key | wg pubkey > server_public.key

Step 3: Create Server Configuration

Create the WireGuard configuration file for the server.

sudo nano /etc/wireguard/wg0.conf

Add the following configuration (replace SERVER_PRIVATE_KEY with the contents of server_private.key):

[Interface]
Address = 10.0.0.1/24
ListenPort = 51820
PrivateKey = SERVER_PRIVATE_KEY
PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -D FORWARD -o %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

Step 4: Enable IP Forwarding

Enable IP forwarding to allow the server to route traffic.

sudo nano /etc/sysctl.conf

Uncomment or add this line:

net.ipv4.ip_forward=1

Apply the changes:

sudo sysctl -p

Step 5: Start WireGuard Server

Enable and start the WireGuard service.

sudo systemctl enable wg-quick@wg0
sudo systemctl start wg-quick@wg0

Check the status:

sudo systemctl status wg-quick@wg0

Client Setup

Step 6: Generate Client Keys

On the server, generate keys for your client.

cd /etc/wireguard
wg genkey | tee client_private.key | wg pubkey > client_public.key

Step 7: Add Client to Server Configuration

Add the client peer to the server configuration.

sudo nano /etc/wireguard/wg0.conf

Add this at the end of the file (replace CLIENT_PUBLIC_KEY with the contents of client_public.key):

[Peer]
PublicKey = CLIENT_PUBLIC_KEY
AllowedIPs = 10.0.0.2/32

Restart WireGuard:

sudo systemctl restart wg-quick@wg0

Step 8: Create Client Configuration

Create a configuration file for your client device. Replace the placeholders with your actual values.

[Interface]
PrivateKey = CLIENT_PRIVATE_KEY
Address = 10.0.0.2/24
DNS = 1.1.1.1

[Peer]
PublicKey = SERVER_PUBLIC_KEY
Endpoint = YOUR_SERVER_IP:51820
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25

Connecting the Client

Linux Client

Install WireGuard on your Linux client:

sudo apt install wireguard -y

Create the config file and connect:

sudo nano /etc/wireguard/wg0.conf
sudo wg-quick up wg0

Windows/Mac/Mobile

Download the official WireGuard app from wireguard.com, then import the client configuration file or scan a QR code.

Generate a QR code for mobile devices:

sudo apt install qrencode -y
qrencode -t ansiutf8 < /etc/wireguard/client.conf

Verification and Troubleshooting

Check Connection Status

On the server, verify the connection:

sudo wg show

View Logs

Check WireGuard logs for any issues:

sudo journalctl -u wg-quick@wg0 -f

Firewall Configuration

If you're using UFW, allow WireGuard traffic:

sudo ufw allow 51820/udp
sudo ufw reload

Useful Commands

Stop WireGuard:

sudo wg-quick down wg0