Skip to main content
To set up a WireGuard VPN server, install wireguard-tools, create a key pair with wg genkey | tee server.key | wg pubkey > server.pub, write /etc/wireguard/wg0.conf with the server address, ListenPort = 51820 and one [Peer] per client, allow UDP port 51820 in your firewall, turn on IP forwarding, then start it with sudo systemctl enable --now wg-quick@wg0. WireGuard is a fast, modern VPN built into the Linux kernel. Each side has a private key and a public key, and each side only accepts traffic from the public keys you list. This page sets up a server that sends your devices’ IPv4 internet traffic through your VPS. Use the VPN for privacy on public Wi-Fi or for private access to services on your server.

​
Before you start

  • You need root or a sudo user. Root users can leave out sudo.
  • Find the name of your public network interface; it is often eth0 or ens3:
The name after dev is your interface. Replace eth0 below if yours differs.
  • The examples use the VPN network 10.8.0.0/24: the server is 10.8.0.1, the first client 10.8.0.2. Pick another private range if 10.8.0.x is used on your home network.
  • Keep the VNC console available in case a firewall change blocks SSH.

​
How to set up the WireGuard server

1

Install WireGuard

2

Create the server keys

umask 077 makes the key files readable by root only. Never share a .key file; only .pub files are public.
3

Write the server configuration

MASQUERADE lets VPN clients reach the internet using the server’s public IP address.
Show a key’s contents with sudo cat /etc/wireguard/server.key.
4

Turn on IP forwarding

Forwarding lets the server pass packets between the VPN and the internet.
5

Open the firewall

6

Start WireGuard and enable it at boot

​
How to set up the client

Create a file named client1.conf on your computer or phone app:
Replace 203.0.113.10 with your server’s IP address. AllowedIPs = 0.0.0.0/0 sends all IPv4 traffic through the VPN. To reach only the server’s private services, use AllowedIPs = 10.8.0.0/24 instead. You can add a DNS = line with the resolver you want the device to use while connected. Import the file into the official WireGuard app (Windows, macOS, Android, iOS) or, on Linux, save it as /etc/wireguard/wg0.conf and run sudo wg-quick up wg0. Copy client1.key off the server securely, then delete it from the server.

​
How to check it worked

On the server, after the client connects:
A latest handshake time means the tunnel works. On the client, check your public IP address in a browser: it now shows the server’s address.

​
How to add another client

Create a new key pair (client2.key, client2.pub), add a new [Peer] block to wg0.conf with the next address (AllowedIPs = 10.8.0.3/32), then restart:
Each client needs its own key pair and its own address.

​
Frequently asked questions

​
Why is there no handshake?

The UDP port is blocked or a key is wrong. Check sudo ufw status or sudo firewall-cmd --list-all, check that the client’s Endpoint uses the right IP and port, and compare the public keys on both sides. See check if a port is open from outside.

​
The handshake works but I have no internet on the client. Why?

IP forwarding or masquerading is missing, or eth0 is not your interface name. Check sysctl net.ipv4.ip_forward returns 1 and that the interface in PostUp (or the firewalld zone) is correct.

​
Which port does WireGuard use?

Whatever you set in ListenPort. 51820/udp is the port used in the official examples. WireGuard uses UDP only.

​
Can I run WireGuard alongside Docker?

Yes. Docker also enables IP forwarding and adds its own NAT rules. Test that both the VPN and your containers still work after you start WireGuard.

VPS and dedicated server guides

Every guide in this section.

Set up UFW

Firewall for Ubuntu and Debian.

Set up firewalld

Firewall for AlmaLinux and Rocky.

Port forwarding and NAT

More about NAT rules.

sysctl hardening

Kernel settings and forwarding.

Security checklist

Harden the rest of your server.
Checked against the official WireGuard quick start, Ubuntu Server WireGuard documentation and Rocky Linux WireGuard guide on 4 November 2026; key generation, the server configuration (wg-quick strip) and the UFW rules (ufw --dry-run) were tested on Ubuntu 24.04 LTS. Commands can differ on other distributions or releases.

​
Need Extra Help?

If you encounter any issues, our support team is ready to assist:

​
Save on Your Hosting

Ready to upgrade your hosting? Use code KB20 at checkout for 20% off your first order!
Last Updated: November 2026