> ## Documentation Index > Fetch the complete documentation index at: https://help.freakhosting.com/llms.txt > Use this file to discover all available pages before exploring further. # How to Set Up a WireGuard VPN on Windows Server > Set up a WireGuard VPN on Windows Server: install WireGuard for Windows, create the server and client configs, open UDP 51820 and reach RDP through the tunnel. To set up a VPN on Windows Server with WireGuard, install WireGuard for Windows from wireguard.com, write a server config with `ListenPort = 51820` and one `[Peer]` per client, install it as a service with `wireguard /installtunnelservice C:\WireGuard\wg0.conf`, and allow UDP 51820 in Windows Firewall. Clients then reach the server at `10.8.0.1`, for example for Remote Desktop. Microsoft's built-in alternative is RRAS with IKEv2. | Difficulty | Time | Works on | Needs | | - | - | - | - | | Intermediate | 30 minutes | Windows Server 2019 / 2022 / 2025 (WireGuard also supports Windows 10 / 11 and Server 2016) | Administrator access, WireGuard on each client | ## Before you start * A VPN (virtual private network) creates an encrypted tunnel between your computer and the server. Services you only allow from the tunnel, such as Remote Desktop, are then invisible to the internet. * This guide builds a **private access** VPN: clients reach the server itself through the tunnel. Routing all of a client's internet traffic through Windows needs NAT and routing, which WireGuard for Windows does not document; for that, use RRAS or a [WireGuard server on Linux](https://help.freakhosting.com/portals/other/how-to-set-up-a-wireguard-vpn-server.md). * Keep your current Remote Desktop rules unchanged until the tunnel works, and keep the [VNC console](https://help.freakhosting.com/portals/vps-panel/how-to-enable-and-use-vnc-console-access.md) ready. Example values used below: | Item | Value | | - | - | | Server public IP | `203.0.113.10` | | VPN subnet | `10.8.0.0/24` | | Server tunnel address | `10.8.0.1` | | First client tunnel address | `10.8.0.2` | | WireGuard port | UDP `51820` | ## How to install WireGuard on Windows Server **1. Download WireGuard for Windows** On the server, download the installer from the official [WireGuard install page](https://www.wireguard.com/install/) (**Download Windows Installer**). It supports Windows 10, 11 and Server 2016, 2019, 2022 and 2025. **2. Run the installer** The installer picks the right version for your architecture, checks signatures and installs WireGuard into `C:\Program Files\WireGuard`. **3. Open an admin PowerShell in the WireGuard folder** ```powershell theme={null} cd "C:\Program Files\WireGuard" ``` ## How to create the keys Each side needs a private key (kept secret) and the matching public key (shared with the other side). Run this on the server, then repeat it on each client (or on the server for the client, if you hand the client its config): ```powershell theme={null} $priv = .\wg.exe genkey $pub = $priv | .\wg.exe pubkey "Private: $priv" "Public: $pub" ``` Both keys are 44-character base64 strings ending in `=`. Never send a private key over chat or email. ## How to write the server config Create `C:\WireGuard\wg0.conf` (the file name, here `wg0`, becomes the tunnel name): ```ini theme={null} [Interface] PrivateKey = Address = 10.8.0.1/24 ListenPort = 51820 [Peer] # Alex's laptop PublicKey = AllowedIPs = 10.8.0.2/32 ``` Add one `[Peer]` block per client, each with its own `/32` address (`10.8.0.3/32`, `10.8.0.4/32` …). `AllowedIPs` on the server is the tunnel address that client is allowed to use. ## How to start the tunnel as a service **1. Install the tunnel service** ```powershell theme={null} & "C:\Program Files\WireGuard\wireguard.exe" /installtunnelservice C:\WireGuard\wg0.conf ``` WireGuard creates a Windows service named `WireGuardTunnel$wg0` that starts with Windows. **2. Allow WireGuard through the firewall** ```powershell theme={null} New-NetFirewallRule -DisplayName "WireGuard UDP 51820" -Direction Inbound -Protocol UDP -LocalPort 51820 -Action Allow ``` **3. Check it is running** ```powershell theme={null} Get-Service 'WireGuardTunnel$wg0' & "C:\Program Files\WireGuard\wg.exe" show wg0 ``` The service should be `Running` and `wg show` should list `listening port: 51820` and your peer. To remove the tunnel later: `wireguard.exe /uninstalltunnelservice wg0`. ## How to set up the client Install WireGuard on your computer (Windows, macOS, Linux, iOS or Android, all from [wireguard.com/install](https://www.wireguard.com/install/)) and import this config: ```ini theme={null} [Interface] PrivateKey = Address = 10.8.0.2/32 [Peer] PublicKey = AllowedIPs = 10.8.0.1/32 Endpoint = 203.0.113.10:51820 PersistentKeepalive = 25 ``` `AllowedIPs = 10.8.0.1/32` sends only traffic for the server through the tunnel; the rest of your internet traffic is unchanged. `PersistentKeepalive = 25` keeps the tunnel open through home routers (WireGuard's docs call 25 seconds a sensible interval). Activate the tunnel in the client app. ## How to use RDP over the VPN **1. Connect through the tunnel** With the tunnel active, open Remote Desktop to `10.8.0.1` instead of the public IP. **2. Limit RDP to the VPN** When that works, allow Remote Desktop only from the VPN subnet: ```powershell theme={null} Set-NetFirewallRule -DisplayGroup "Remote Desktop" -RemoteAddress 10.8.0.0/24 ``` > [!WARNING] > > After this change, RDP to the public IP stops working. If the tunnel breaks, sign in with the [VNC console](https://help.freakhosting.com/portals/vps-panel/how-to-enable-and-use-vnc-console-access.md) and run `Set-NetFirewallRule -DisplayGroup "Remote Desktop" -RemoteAddress Any`. ## How to check it worked * On the client, the WireGuard app shows a recent **latest handshake** and growing **transfer** counters. * On the server, `wg.exe show wg0` lists the client with a `latest handshake` a few seconds or minutes ago. * From the client, `Test-NetConnection 10.8.0.1 -Port 3389` shows `TcpTestSucceeded : True`. No handshake usually means UDP 51820 is blocked (check the firewall rule and any [DDoS filter](https://help.freakhosting.com/portals/firewall/how-to-apply-ddos-filters.md)) or a public key is pasted on the wrong side. ## What about RRAS (Microsoft's built-in VPN)? Windows Server includes **Routing and Remote Access (RRAS)**, which can act as a VPN server for Windows clients without extra software. Install it with: ```powershell theme={null} Install-WindowsFeature DirectAccess-VPN -IncludeManagementTools ``` Then configure **VPN access** in the Routing and Remote Access console (**Configure and Enable Routing and Remote Access > Custom configuration > VPN access**). Microsoft's guide uses **IKEv2**, which needs UDP ports **500** and **4500** open. From Windows Server 2025, new RRAS setups don't accept PPTP or L2TP by default, and Microsoft doesn't recommend PPTP. RRAS takes more setup than WireGuard; follow [Install Remote Access as a VPN server](https://learn.microsoft.com/en-us/windows-server/remote/remote-access/get-started-install-ras-as-vpn). ## Frequently asked questions ### Is WireGuard free on Windows Server? WireGuard for Windows is free, open-source software from the WireGuard project. Check its licence terms on [wireguard.com](https://www.wireguard.com/) if you need them for your organisation. ### Can I change the WireGuard port? Yes. Set any free UDP port in `ListenPort`, use the same port in each client's `Endpoint`, and change the firewall rule to match. ### How do I add another client later? Generate keys for the new client, add a `[Peer]` block with the next free address (for example `10.8.0.3/32`) to `wg0.conf`, then reinstall the service: `/uninstalltunnelservice wg0` followed by `/installtunnelservice C:\WireGuard\wg0.conf`. ### Where does WireGuard store the config after installing the service? The WireGuard manager stores configs in `C:\Program Files\WireGuard\Data\Configurations`, encrypted as `.conf.dpapi` files. Keep your own copy of `wg0.conf` in a safe place, because it contains the server's private key. ## Related guides > [card] [VPS and dedicated server guides](https://help.freakhosting.com/portals/other/vps-and-dedicated-server-guides.md) > > Every guide in this section. > [card] [Protect RDP from brute force](https://help.freakhosting.com/portals/other/how-to-protect-rdp-from-brute-force-attacks.md) > > All the ways to lock down RDP. > [card] [WireGuard VPN on Linux](https://help.freakhosting.com/portals/other/how-to-set-up-a-wireguard-vpn-server.md) > > A full-tunnel VPN server. > [card] [Open a port in Windows Firewall](https://help.freakhosting.com/portals/other/how-to-open-a-port-in-windows-firewall.md) > > Inbound TCP and UDP rules. > [card] [Windows Server security checklist](https://help.freakhosting.com/portals/other/windows-server-security-checklist.md) > > Every hardening step. *** > [!NOTE] > > **Checked against the official [WireGuard install page](https://www.wireguard.com/install/), [WireGuard for Windows enterprise docs](https://git.zx2c4.com/wireguard-windows/about/docs/enterprise.md), the [wg(8)](https://git.zx2c4.com/wireguard-tools/about/src/man/wg.8) and [wg-quick(8)](https://git.zx2c4.com/wireguard-tools/about/src/man/wg-quick.8) manuals, and Microsoft Learn: [Install Remote Access as a VPN server](https://learn.microsoft.com/en-us/windows-server/remote/remote-access/get-started-install-ras-as-vpn)** on 4 November 2026. Key generation and config syntax were tested with wireguard-tools on Ubuntu 24.04; the Windows steps were not tested on a live Windows server. > [!NOTE] > > ### Need Extra Help? > > If you encounter any issues, our support team is ready to assist: > > * **Live Chat:** Quick assistance via our website. > * **Support Ticket:** [Open a Ticket](https://freakhosting.com/clientarea/submitticket.php) > * **Discord:** [Join our Community](https://discord.gg/freakhosting) > * **Email:** [support@freakhosting.com](mailto:support@freakhosting.com) > [!TIP] > > ### Save on Your Hosting > > Ready to upgrade your hosting? Use code **KB20** at checkout for **20% off** your first order! *** **Last Updated:** November 2026 This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.