docker-compose.yml into /etc/docker/containers/wg-easy, change the web UI port to 127.0.0.1:51821, and start it with sudo docker compose up -d. Allow UDP port 51820, serve the web UI over HTTPS with Nginx, then use the setup wizard to create the admin and your first WireGuard client.
What is wg-easy?
wg-easy runs a WireGuard VPN server and a web interface in one container. WireGuard is a fast, modern VPN protocol. In the web UI you create a client per device, then scan its QR code in the WireGuard app or download its configuration file. To build WireGuard by hand instead, see set up a WireGuard VPN server.Before you start
- Install Docker and Nginx. The commands use
sudo; leave it out if you areroot. - Point
vpn.example.comat your server. See point a domain to your server. - Use only an x86_64 or arm64 server. wg-easy 15 does not support armv6 or armv7.
- Use a VPN in line with the law and your provider’s terms.
What changed in wg-easy 15?
Version 15 is a complete rewrite. If you follow an older tutorial, these differences matter:
To move from 14, see How do I migrate from wg-easy 14? below.
How to install wg-easy with Docker Compose
1
Download the official compose file
2
Keep the web UI private
Open the file with Leave the rest as it is: the
sudo nano /etc/docker/containers/wg-easy/docker-compose.yml and change the web UI port line so only Nginx on this server can reach it. The ports section then reads:ghcr.io/wg-easy/wg-easy:15 image, the etc_wireguard volume, the NET_ADMIN and SYS_MODULE capabilities, the forwarding sysctls and the wg network.3
Start wg-easy
4
Allow the VPN port
WireGuard uses UDP 51820. Docker publishes it for you, but if a firewall sits in front of the server, allow UDP 51820 there. With
ufw:How to put the wg-easy web UI behind HTTPS
1
Create the Nginx site
Create
/etc/nginx/sites-available/vpn.example.com (Ubuntu / Debian) or /etc/nginx/conf.d/vpn.example.com.conf (AlmaLinux / Rocky):2
Enable, test and get a certificate
sudo setsebool -P httpd_can_network_connect 1 before testing.INSECURE at its default (false). The session cookie is then only sent over HTTPS. wg-easy has no built-in rate limiting, so the docs suggest limiting the login paths in your proxy or with a tool such as CrowdSec.
How to complete the setup wizard
1
Create the administrator
Open
https://vpn.example.com and select Continue. Enter a username (at least 2 characters) and a password (at least 12 characters), then select Create Account.2
Choose a new configuration
When asked about an existing setup, choose No for a fresh install.
3
Set the host and port
Set Host to
vpn.example.com (or your server IP, for example 203.0.113.10) and Port to 51820. Clients connect to this address. Select Continue.4
Add a client
Select New Client, enter a name such as
alex-phone, then select Create Client. Scan the QR code with the WireGuard app, or download the configuration file for a computer.How to check it worked
wg-easy container shows Up. Connect from a device, then check that your public IP is now the server’s IP. In the web UI, the client shows as Online after its first handshake.
How to back up wg-easy
Everything wg-easy stores, including client keys and settings, is in theetc_wireguard volume, mounted at /etc/wireguard. Stop the container briefly and archive the volume as shown in back up Docker volumes. The volume name is the project folder name plus _etc_wireguard; list it with sudo docker volume ls.
How to update wg-easy
The15 tag gets every 15.x release without breaking changes:
Frequently asked questions
How do I migrate from wg-easy 14?
In the old web UI, click Backup to downloadwg0.json and note your old environment variables. Stop the old container with docker compose down, install version 15 as above, and in the setup wizard choose Yes for an existing configuration and upload wg0.json. Re-enter old settings in the Admin Panel.
What does “Cannot find device wg0” mean?
The WireGuard kernel module isn’t loaded. Runsudo modprobe wireguard, and add wireguard to /etc/modules to load it at boot.
Can I change the VPN port?
Yes. Change the UDP port mapping indocker-compose.yml, the port under Admin Panel > Config, and your firewall rule so all three match. Then send updated configurations to existing clients.
Can I reach the web UI without a domain?
The wg-easy docs call plain HTTP insecure. If you must, setINSECURE=true and only expose the UI to a network you trust, never to the internet.
Related guides
VPS and dedicated server guides
Every guide in this section.
Set up a WireGuard VPN server
WireGuard without a web UI.
Set up a firewall with UFW
Allow UDP 51820.
Nginx Proxy Manager
HTTPS for containers from a web UI.
Update Docker containers
Pull new images safely.
Checked against the official wg-easy README and documentation on 4 November 2026 (image
ghcr.io/wg-easy/wg-easy:15); docker-compose.yml validated with docker compose config and the Nginx configuration syntax-tested on Ubuntu 24.04 LTS. Menu names can change between wg-easy releases.Need Extra Help?
If you encounter any issues, our support team is ready to assist:- Live Chat: Quick assistance via our website.
- Support Ticket: Open a Ticket
- Discord: Join our Community
- Email: support@freakhosting.com
Last Updated: November 2026