Configure a WireGuard VPN

October 20, 2026 · admin

WireGuard is a modern VPN built into the Linux kernel. It is fast, simple to configure and uses strong cryptography by default.

Before you start

• A Linux VPS with a public IPv4 address (Ubuntu 22.04/24.04 or Debian 12)
• UDP port 51820 open
• Remember to follow our Acceptable Use Policy when routing traffic through your server

1. Install WireGuard

sudo apt update && sudo apt install -y wireguard qrencode

2. Generate server keys

wg genkey | sudo tee /etc/wireguard/server.key | wg pubkey | sudo tee /etc/wireguard/server.pub
sudo chmod 600 /etc/wireguard/server.key

3. Create the server configuration

Find your public network interface with ip route | grep default (often eth0 or ens3), then create /etc/wireguard/wg0.conf:

[Interface]
Address = 10.8.0.1/24
ListenPort = 51820
PrivateKey = <contents of server.key>
PostUp = iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

[Peer]
PublicKey = <client public key>
AllowedIPs = 10.8.0.2/32

4. Enable forwarding and start the tunnel

echo "net.ipv4.ip_forward=1" | sudo tee /etc/sysctl.d/99-wireguard.conf
sudo sysctl --system
sudo ufw allow 51820/udp
sudo systemctl enable --now wg-quick@wg0
sudo wg show

5. Configure a client

Generate a key pair for the client (wg genkey | tee client.key | wg pubkey > client.pub) and create client.conf:

[Interface]
PrivateKey = <client private key>
Address = 10.8.0.2/24
DNS = 1.1.1.1

[Peer]
PublicKey = <server public key>
Endpoint = YOUR_SERVER_IP:51820
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25

Import the file into the WireGuard app, or show a QR code for phones: qrencode -t ansiutf8 < client.conf.

Troubleshooting

• Handshake never completes – check UDP 51820 is allowed and the keys are not swapped.
• Connected but no internet – confirm IP forwarding is on and the interface name in PostUp is correct.

Back to the blog