Setting up a WireGuard VPN on a VPS

WireGuard is a modern VPN built into the Linux kernel: a few lines of configuration, modern cryptography and much better performance than OpenVPN. On a VPS, it creates a private network between your devices and the server. This guide sets up a WireGuard server and configures a first client in about fifteen minutes.

1. What it is for on a VPS

Reaching services without exposing them: database, txAdmin panel, Netdata, admin interface. They only listen on the VPN's private network and stay invisible from the Internet.
Linking several servers through an encrypted network, for example a game server and its database.
Routing your traffic through the VPS, to browse from public Wi-Fi with a connection encrypted all the way to France.

The examples use the private network 10.8.0.0/24: the server takes the address 10.8.0.1, the devices 10.8.0.2, 10.8.0.3, and so on.

2. Install WireGuard

apt update && apt install -y wireguard qrencode

qrencode will be used to set up a phone by scanning a QR code.

3. Generate the keys

Every participant, server and device alike, has a key pair: the private key stays on the machine, the public key is given to the others. Generate the server's keys and a first client's:

cd /etc/wireguard
umask 077
wg genkey | tee server.key | wg pubkey > server.pub
wg genkey | tee client1.key | wg pubkey > client1.pub

umask 077 ensures the key files are readable by root only.

4. Configure the server

First find the name of the VPS's public network interface:

ip route show default

The name appears after dev, often eth0 or ens18. Then create /etc/wireguard/wg0.conf, replacing the values in angle brackets with the contents of the key files:

[Interface]
Address = 10.8.0.1/24
ListenPort = 51820
PrivateKey = <contents of server.key>
# clients' Internet traffic out through the VPS (replace eth0 if needed)
PostUp   = iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
PostDown = iptables -t nat -D POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
[Peer]
# client1: laptop
PublicKey = <contents of client1.pub>
AllowedIPs = 10.8.0.2/32

The PostUp and PostDown lines are only needed if you want clients' Internet traffic to go out through the VPS. In that case, also enable routing:

echo 'net.ipv4.ip_forward=1' > /etc/sysctl.d/99-wireguard.conf
sysctl --system

Finally, open the port in the firewall, and allow routing if UFW is active:

ufw allow 51820/udp comment 'WireGuard'
ufw route allow in on wg0 out on eth0

5. Configure a client

Install the official WireGuard app on your device (Windows, macOS, Linux, Android or iOS). The client configuration looks like this:

[Interface]
PrivateKey = <contents of client1.key>
Address = 10.8.0.2/32
DNS = 1.1.1.1
[Peer]
PublicKey = <contents of server.pub>
Endpoint = VPS_IP:51820
AllowedIPs = 10.8.0.0/24
PersistentKeepalive = 25

The AllowedIPs line decides what goes through the VPN:

10.8.0.0/24: only traffic to the private network goes through the VPN. Your browsing stays on your usual connection. This is the right choice for managing your servers.
0.0.0.0/0, ::/0: all traffic goes through the VPS. Requires the PostUp lines and routing from the previous step.

PersistentKeepalive keeps the connection open behind a home router or a mobile network. For a phone, save the configuration in client1.conf on the server and display it as a QR code to scan in the app:

qrencode -t ansiutf8 < client1.conf

Then delete the client1.key and client1.conf files from the server: a device's private key has no business being on the VPS.

6. Start and check

systemctl enable --now wg-quick@wg0
wg show

Activate the tunnel in the client app, then run wg show again: a recent latest handshake line confirms the connection is established. From the client, ping 10.8.0.1 should reply.

No handshake? Check, in order: UDP port 51820 in the firewall, the VPS address in Endpoint, and that each side has the other's public key.

7. Restrict a service to the VPN

This is the most useful use on a VPS. To make a service reachable only through the VPN, open its port only from the private network:

ufw allow from 10.8.0.0/24 to any port 3306 proto tcp comment 'MariaDB via VPN'
ufw allow from 10.8.0.0/24 to any port 40120 proto tcp comment 'txAdmin via VPN'

For a database, make it listen on 10.8.0.1 in addition to the local address. You can even restrict SSH to the VPN, but then keep a fallback access, such as the rescue console (VNC) in the client area. See also securing MariaDB and configuring UFW.

8. Add devices

For each new device: generate a key pair, add a [Peer] block to wg0.conf with the next address (10.8.0.3/32, and so on), then apply without dropping existing connections:

wg syncconf wg0 <(wg-quick strip wg0)

To revoke a lost device, delete its [Peer] block and run the same command again.

Frequently asked questions

WireGuard or OpenVPN?

WireGuard for a new project: its configuration fits in a few lines, it is built into the Linux kernel and noticeably faster. OpenVPN remains useful if you have to go through a network that only lets TCP port 443 out, since WireGuard only works over UDP.

Does a WireGuard VPN on a VPS reduce gaming latency?

Rarely. The VPN adds a detour through the VPS, and therefore latency, unless your ISP's route to the game server is particularly bad. Its main benefit is security and access to your private services.

How many devices can I connect?

As many as you like: one Peer block per device, each with its own address on the private network. WireGuard's resource usage is very low, even with dozens of clients.

My client connects but has no Internet access. Why?

If AllowedIPs is 0.0.0.0/0 on the client, the server must route the traffic: check that net.ipv4.ip_forward is 1, that the PostUp lines use the right interface name, and that UFW allows routing from wg0 to the public interface.

Setting up your own WireGuard VPN on a VPS