Skip to main content
To set up a VPN on Windows Server with WireGuard, install WireGuard for Windows from wireguard.com, write a server config with ListenPort = 51820 and one [Peer] per client, install it as a service with wireguard /installtunnelservice C:\WireGuard\wg0.conf, and allow UDP 51820 in Windows Firewall. Clients then reach the server at 10.8.0.1, for example for Remote Desktop. Microsoft’s built-in alternative is RRAS with IKEv2.

​
Before you start

  • A VPN (virtual private network) creates an encrypted tunnel between your computer and the server. Services you only allow from the tunnel, such as Remote Desktop, are then invisible to the internet.
  • This guide builds a private access VPN: clients reach the server itself through the tunnel. Routing all of a client’s internet traffic through Windows needs NAT and routing, which WireGuard for Windows does not document; for that, use RRAS or a WireGuard server on Linux.
  • Keep your current Remote Desktop rules unchanged until the tunnel works, and keep the VNC console ready.
Example values used below:

​
How to install WireGuard on Windows Server

1

Download WireGuard for Windows

On the server, download the installer from the official WireGuard install page (Download Windows Installer). It supports Windows 10, 11 and Server 2016, 2019, 2022 and 2025.
2

Run the installer

The installer picks the right version for your architecture, checks signatures and installs WireGuard into C:\Program Files\WireGuard.
3

Open an admin PowerShell in the WireGuard folder

​
How to create the keys

Each side needs a private key (kept secret) and the matching public key (shared with the other side). Run this on the server, then repeat it on each client (or on the server for the client, if you hand the client its config):
Both keys are 44-character base64 strings ending in =. Never send a private key over chat or email.

​
How to write the server config

Create C:\WireGuard\wg0.conf (the file name, here wg0, becomes the tunnel name):
Add one [Peer] block per client, each with its own /32 address (10.8.0.3/32, 10.8.0.4/32 …). AllowedIPs on the server is the tunnel address that client is allowed to use.

​
How to start the tunnel as a service

1

Install the tunnel service

WireGuard creates a Windows service named WireGuardTunnel$wg0 that starts with Windows.
2

Allow WireGuard through the firewall

3

Check it is running

The service should be Running and wg show should list listening port: 51820 and your peer.
To remove the tunnel later: wireguard.exe /uninstalltunnelservice wg0.

​
How to set up the client

Install WireGuard on your computer (Windows, macOS, Linux, iOS or Android, all from wireguard.com/install) and import this config:
AllowedIPs = 10.8.0.1/32 sends only traffic for the server through the tunnel; the rest of your internet traffic is unchanged. PersistentKeepalive = 25 keeps the tunnel open through home routers (WireGuard’s docs call 25 seconds a sensible interval). Activate the tunnel in the client app.

​
How to use RDP over the VPN

1

Connect through the tunnel

With the tunnel active, open Remote Desktop to 10.8.0.1 instead of the public IP.
2

Limit RDP to the VPN

When that works, allow Remote Desktop only from the VPN subnet:
After this change, RDP to the public IP stops working. If the tunnel breaks, sign in with the VNC console and run Set-NetFirewallRule -DisplayGroup "Remote Desktop" -RemoteAddress Any.

​
How to check it worked

  • On the client, the WireGuard app shows a recent latest handshake and growing transfer counters.
  • On the server, wg.exe show wg0 lists the client with a latest handshake a few seconds or minutes ago.
  • From the client, Test-NetConnection 10.8.0.1 -Port 3389 shows TcpTestSucceeded : True.
No handshake usually means UDP 51820 is blocked (check the firewall rule and any DDoS filter) or a public key is pasted on the wrong side.

​
What about RRAS (Microsoft’s built-in VPN)?

Windows Server includes Routing and Remote Access (RRAS), which can act as a VPN server for Windows clients without extra software. Install it with:
Then configure VPN access in the Routing and Remote Access console (Configure and Enable Routing and Remote Access > Custom configuration > VPN access). Microsoft’s guide uses IKEv2, which needs UDP ports 500 and 4500 open. From Windows Server 2025, new RRAS setups don’t accept PPTP or L2TP by default, and Microsoft doesn’t recommend PPTP. RRAS takes more setup than WireGuard; follow Install Remote Access as a VPN server.

​
Frequently asked questions

​
Is WireGuard free on Windows Server?

WireGuard for Windows is free, open-source software from the WireGuard project. Check its licence terms on wireguard.com if you need them for your organisation.

​
Can I change the WireGuard port?

Yes. Set any free UDP port in ListenPort, use the same port in each client’s Endpoint, and change the firewall rule to match.

​
How do I add another client later?

Generate keys for the new client, add a [Peer] block with the next free address (for example 10.8.0.3/32) to wg0.conf, then reinstall the service: /uninstalltunnelservice wg0 followed by /installtunnelservice C:\WireGuard\wg0.conf.

​
Where does WireGuard store the config after installing the service?

The WireGuard manager stores configs in C:\Program Files\WireGuard\Data\Configurations, encrypted as .conf.dpapi files. Keep your own copy of wg0.conf in a safe place, because it contains the server’s private key.

VPS and dedicated server guides

Every guide in this section.

Protect RDP from brute force

All the ways to lock down RDP.

WireGuard VPN on Linux

A full-tunnel VPN server.

Open a port in Windows Firewall

Inbound TCP and UDP rules.

Windows Server security checklist

Every hardening step.
Checked against the official WireGuard install page, WireGuard for Windows enterprise docs, the wg(8) and wg-quick(8) manuals, and Microsoft Learn: Install Remote Access as a VPN server on 4 November 2026. Key generation and config syntax were tested with wireguard-tools on Ubuntu 24.04; the Windows steps were not tested on a live Windows server.

​
Need Extra Help?

If you encounter any issues, our support team is ready to assist:

​
Save on Your Hosting

Ready to upgrade your hosting? Use code KB20 at checkout for 20% off your first order!
Last Updated: November 2026