Skip to main content
To set up wg-easy, download the official docker-compose.yml into /etc/docker/containers/wg-easy, change the web UI port to 127.0.0.1:51821, and start it with sudo docker compose up -d. Allow UDP port 51820, serve the web UI over HTTPS with Nginx, then use the setup wizard to create the admin and your first WireGuard client.

What is wg-easy?

wg-easy runs a WireGuard VPN server and a web interface in one container. WireGuard is a fast, modern VPN protocol. In the web UI you create a client per device, then scan its QR code in the WireGuard app or download its configuration file. To build WireGuard by hand instead, see set up a WireGuard VPN server.

Before you start

  • Install Docker and Nginx. The commands use sudo; leave it out if you are root.
  • Point vpn.example.com at your server. See point a domain to your server.
  • Use only an x86_64 or arm64 server. wg-easy 15 does not support armv6 or armv7.
  • Use a VPN in line with the law and your provider’s terms.

What changed in wg-easy 15?

Version 15 is a complete rewrite. If you follow an older tutorial, these differences matter: To move from 14, see How do I migrate from wg-easy 14? below.

How to install wg-easy with Docker Compose

1

Download the official compose file

2

Keep the web UI private

Open the file with sudo nano /etc/docker/containers/wg-easy/docker-compose.yml and change the web UI port line so only Nginx on this server can reach it. The ports section then reads:
Leave the rest as it is: the ghcr.io/wg-easy/wg-easy:15 image, the etc_wireguard volume, the NET_ADMIN and SYS_MODULE capabilities, the forwarding sysctls and the wg network.
3

Start wg-easy

4

Allow the VPN port

WireGuard uses UDP 51820. Docker publishes it for you, but if a firewall sits in front of the server, allow UDP 51820 there. With ufw:
Use sudo docker compose up -d and sudo docker compose down to start and stop wg-easy, not docker compose start or stop. The wg-easy docs warn that start/stop leave an inconsistent state that causes problems on the next start.

How to put the wg-easy web UI behind HTTPS

1

Create the Nginx site

Create /etc/nginx/sites-available/vpn.example.com (Ubuntu / Debian) or /etc/nginx/conf.d/vpn.example.com.conf (AlmaLinux / Rocky):
2

Enable, test and get a certificate

On AlmaLinux / Rocky, run sudo setsebool -P httpd_can_network_connect 1 before testing.
Keep INSECURE at its default (false). The session cookie is then only sent over HTTPS. wg-easy has no built-in rate limiting, so the docs suggest limiting the login paths in your proxy or with a tool such as CrowdSec.

How to complete the setup wizard

1

Create the administrator

Open https://vpn.example.com and select Continue. Enter a username (at least 2 characters) and a password (at least 12 characters), then select Create Account.
2

Choose a new configuration

When asked about an existing setup, choose No for a fresh install.
3

Set the host and port

Set Host to vpn.example.com (or your server IP, for example 203.0.113.10) and Port to 51820. Clients connect to this address. Select Continue.
4

Add a client

Select New Client, enter a name such as alex-phone, then select Create Client. Scan the QR code with the WireGuard app, or download the configuration file for a computer.

How to check it worked

The wg-easy container shows Up. Connect from a device, then check that your public IP is now the server’s IP. In the web UI, the client shows as Online after its first handshake.

How to back up wg-easy

Everything wg-easy stores, including client keys and settings, is in the etc_wireguard volume, mounted at /etc/wireguard. Stop the container briefly and archive the volume as shown in back up Docker volumes. The volume name is the project folder name plus _etc_wireguard; list it with sudo docker volume ls.

How to update wg-easy

The 15 tag gets every 15.x release without breaking changes:
A future major version needs a deliberate tag change; read its release notes first.

Frequently asked questions

How do I migrate from wg-easy 14?

In the old web UI, click Backup to download wg0.json and note your old environment variables. Stop the old container with docker compose down, install version 15 as above, and in the setup wizard choose Yes for an existing configuration and upload wg0.json. Re-enter old settings in the Admin Panel.

What does “Cannot find device wg0” mean?

The WireGuard kernel module isn’t loaded. Run sudo modprobe wireguard, and add wireguard to /etc/modules to load it at boot.

Can I change the VPN port?

Yes. Change the UDP port mapping in docker-compose.yml, the port under Admin Panel > Config, and your firewall rule so all three match. Then send updated configurations to existing clients.

Can I reach the web UI without a domain?

The wg-easy docs call plain HTTP insecure. If you must, set INSECURE=true and only expose the UI to a network you trust, never to the internet.

VPS and dedicated server guides

Every guide in this section.

Set up a WireGuard VPN server

WireGuard without a web UI.

Set up a firewall with UFW

Allow UDP 51820.

Nginx Proxy Manager

HTTPS for containers from a web UI.

Update Docker containers

Pull new images safely.

Checked against the official wg-easy README and documentation on 4 November 2026 (image ghcr.io/wg-easy/wg-easy:15); docker-compose.yml validated with docker compose config and the Nginx configuration syntax-tested on Ubuntu 24.04 LTS. Menu names can change between wg-easy releases.

Need Extra Help?

If you encounter any issues, our support team is ready to assist:

Save on Your Hosting

Ready to upgrade your hosting? Use code KB20 at checkout for 20% off your first order!

Last Updated: November 2026