> ## Documentation Index
> Fetch the complete documentation index at: https://help.freakhosting.com/llms.txt
> Use this file to discover all available pages before exploring further.

# How to Set Up a WireGuard VPN Server on Linux

> WireGuard VPN server setup on Linux: install wireguard-tools, create keys with wg genkey, write /etc/wireguard/wg0.conf, open UDP 51820, start wg-quick@wg0.

To set up a WireGuard VPN server, install `wireguard-tools`, create a key pair with `wg genkey | tee server.key | wg pubkey > server.pub`, write `/etc/wireguard/wg0.conf` with the server address, `ListenPort = 51820` and one `[Peer]` per client, allow UDP port 51820 in your firewall, turn on IP forwarding, then start it with `sudo systemctl enable --now wg-quick@wg0`.

| Difficulty | Time | Works on | Needs |
| - | - | - | - |
| Intermediate | 30 minutes | Ubuntu 22.04 / 24.04, Debian 12 / 13, AlmaLinux and Rocky Linux 9 / 10 | Root or sudo access, a WireGuard app on your device |

WireGuard is a fast, modern VPN built into the Linux kernel. Each side has a private key and a public key, and each side only accepts traffic from the public keys you list. This page sets up a server that sends your devices' IPv4 internet traffic through your VPS. Use the VPN for privacy on public Wi-Fi or for private access to services on your server.

## Before you start

* You need root or a sudo user. Root users can leave out `sudo`.
* Find the name of your public network interface; it is often `eth0` or `ens3`:

```bash theme={null}
ip route show default
```

```text theme={null}
default via 203.0.113.1 dev eth0 proto static
```

The name after `dev` is your interface. Replace `eth0` below if yours differs.

* The examples use the VPN network `10.8.0.0/24`: the server is `10.8.0.1`, the first client `10.8.0.2`. Pick another private range if `10.8.0.x` is used on your home network.
* Keep the [VNC console](https://help.freakhosting.com/portals/vps-panel/how-to-enable-and-use-vnc-console-access.md) available in case a firewall change blocks SSH.

## How to set up the WireGuard server

**1. Install WireGuard**

> [tab] Ubuntu / Debian
>
> ```bash theme={null}
> sudo apt update
> sudo apt install wireguard-tools iptables
> ```

> [tab] AlmaLinux / Rocky
>
> ```bash theme={null}
> sudo dnf install epel-release
> sudo dnf install wireguard-tools
> ```

**2. Create the server keys**

```bash theme={null}
sudo -i
cd /etc/wireguard
umask 077
wg genkey | tee server.key | wg pubkey > server.pub
wg genkey | tee client1.key | wg pubkey > client1.pub
exit
```

`umask 077` makes the key files readable by root only. Never share a `.key` file; only `.pub` files are public.

**3. Write the server configuration**

```bash theme={null}
sudo nano /etc/wireguard/wg0.conf
```

> [tab] Ubuntu / Debian
>
> ```ini theme={null}
> [Interface]
> Address = 10.8.0.1/24
> ListenPort = 51820
> PrivateKey = <contents of server.key>
> PostUp = iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
> PostDown = iptables -t nat -D POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
>
> [Peer]
> # client1
> PublicKey = <contents of client1.pub>
> AllowedIPs = 10.8.0.2/32
> ```
>
> `MASQUERADE` lets VPN clients reach the internet using the server's public IP address.

> [tab] AlmaLinux / Rocky
>
> ```ini theme={null}
> [Interface]
> Address = 10.8.0.1/24
> ListenPort = 51820
> PrivateKey = <contents of server.key>
>
> [Peer]
> # client1
> PublicKey = <contents of client1.pub>
> AllowedIPs = 10.8.0.2/32
> ```
>
> firewalld handles the address translation in the firewall step.

Show a key's contents with `sudo cat /etc/wireguard/server.key`.

**4. Turn on IP forwarding**

```bash theme={null}
echo "net.ipv4.ip_forward = 1" | sudo tee /etc/sysctl.d/70-wireguard.conf
sudo sysctl -p /etc/sysctl.d/70-wireguard.conf
```

Forwarding lets the server pass packets between the VPN and the internet.

**5. Open the firewall**

> [tab] Ubuntu / Debian (UFW)
>
> ```bash theme={null}
> sudo ufw allow 51820/udp
> sudo ufw route allow in on wg0 out on eth0
> ```

> [tab] AlmaLinux / Rocky (firewalld)
>
> ```bash theme={null}
> sudo firewall-cmd --permanent --zone=public --add-port=51820/udp
> sudo firewall-cmd --permanent --zone=internal --add-interface=wg0
> sudo firewall-cmd --permanent --zone=internal --add-masquerade
> sudo firewall-cmd --reload
> ```

**6. Start WireGuard and enable it at boot**

```bash theme={null}
sudo systemctl enable --now wg-quick@wg0
```

## How to set up the client

Create a file named `client1.conf` on your computer or phone app:

```ini theme={null}
[Interface]
PrivateKey = <contents of client1.key>
Address = 10.8.0.2/24

[Peer]
PublicKey = <contents of server.pub>
Endpoint = 203.0.113.10:51820
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25
```

Replace `203.0.113.10` with your server's IP address. `AllowedIPs = 0.0.0.0/0` sends all IPv4 traffic through the VPN. To reach only the server's private services, use `AllowedIPs = 10.8.0.0/24` instead. You can add a `DNS =` line with the resolver you want the device to use while connected.

Import the file into the official WireGuard app (Windows, macOS, Android, iOS) or, on Linux, save it as `/etc/wireguard/wg0.conf` and run `sudo wg-quick up wg0`. Copy `client1.key` off the server securely, then delete it from the server.

## How to check it worked

On the server, after the client connects:

```bash theme={null}
sudo wg show
```

```text theme={null}
interface: wg0
  public key: <server public key>
  private key: (hidden)
  listening port: 51820

peer: <client1 public key>
  endpoint: 198.51.100.25:53122
  allowed ips: 10.8.0.2/32
  latest handshake: 12 seconds ago
  transfer: 1.24 MiB received, 8.71 MiB sent
```

A `latest handshake` time means the tunnel works. On the client, check your public IP address in a browser: it now shows the server's address.

## How to add another client

Create a new key pair (`client2.key`, `client2.pub`), add a new `[Peer]` block to `wg0.conf` with the next address (`AllowedIPs = 10.8.0.3/32`), then restart:

```bash theme={null}
sudo systemctl restart wg-quick@wg0
```

Each client needs its own key pair and its own address.

## Frequently asked questions

### Why is there no handshake?

The UDP port is blocked or a key is wrong. Check `sudo ufw status` or `sudo firewall-cmd --list-all`, check that the client's `Endpoint` uses the right IP and port, and compare the public keys on both sides. See [check if a port is open from outside](https://help.freakhosting.com/portals/other/how-to-check-if-a-port-is-open-from-outside.md).

### The handshake works but I have no internet on the client. Why?

IP forwarding or masquerading is missing, or `eth0` is not your interface name. Check `sysctl net.ipv4.ip_forward` returns `1` and that the interface in `PostUp` (or the firewalld zone) is correct.

### Which port does WireGuard use?

Whatever you set in `ListenPort`. 51820/udp is the port used in the official examples. WireGuard uses UDP only.

### Can I run WireGuard alongside Docker?

Yes. Docker also enables IP forwarding and adds its own NAT rules. Test that both the VPN and your containers still work after you start WireGuard.

## Related guides

> [card] [VPS and dedicated server guides](https://help.freakhosting.com/portals/other/vps-and-dedicated-server-guides.md)
>
> Every guide in this section.

> [card] [Set up UFW](https://help.freakhosting.com/portals/other/how-to-set-up-a-firewall-with-ufw.md)
>
> Firewall for Ubuntu and Debian.

> [card] [Set up firewalld](https://help.freakhosting.com/portals/other/how-to-set-up-a-firewall-with-firewalld.md)
>
> Firewall for AlmaLinux and Rocky.

> [card] [Port forwarding and NAT](https://help.freakhosting.com/portals/other/how-to-set-up-port-forwarding-and-nat-with-iptables.md)
>
> More about NAT rules.

> [card] [sysctl hardening](https://help.freakhosting.com/portals/other/how-to-secure-shared-memory-and-kernel-settings-with-sysctl.md)
>
> Kernel settings and forwarding.

> [card] [Security checklist](https://help.freakhosting.com/portals/other/linux-server-security-checklist.md)
>
> Harden the rest of your server.

***

> [!NOTE]
>
> **Checked against the official [WireGuard quick start](https://www.wireguard.com/quickstart/), [Ubuntu Server WireGuard documentation](https://ubuntu.com/server/docs/how-to/wireguard-vpn/vpn-as-the-default-gateway/) and [Rocky Linux WireGuard guide](https://docs.rockylinux.org/guides/security/wireguard_vpn/)** on 4 November 2026; key generation, the server configuration (`wg-quick strip`) and the UFW rules (`ufw --dry-run`) were tested on Ubuntu 24.04 LTS. Commands can differ on other distributions or releases.

> [!NOTE]
>
> ### Need Extra Help?
>
> If you encounter any issues, our support team is ready to assist:
>
> * **Live Chat:** Quick assistance via our website.
> * **Support Ticket:** [Open a Ticket](https://freakhosting.com/clientarea/submitticket.php)
> * **Discord:** [Join our Community](https://discord.gg/freakhosting)
> * **Email:** [support@freakhosting.com](mailto:support@freakhosting.com)

> [!TIP]
>
> ### Save on Your Hosting
>
> Ready to upgrade your hosting? Use code **KB20** at checkout for **20% off** your first order!

***

**Last Updated:** November 2026


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.