How to Set Up WireGuard: Run Your Own VPN Server

Installation

After connecting to your server with SSH, install WireGuard and the helper tools:

sudo apt update
sudo apt install wireguard qrencode iptables

Generating the keys

Run the commands in this section as root, in the /etc/wireguard folder. Create a key pair each for the server and the first client (your phone, for example):

sudo -i
cd /etc/wireguard
umask 077
wg genkey | tee server.key | wg pubkey > server.pub
wg genkey | tee phone.key | wg pubkey > phone.pub

You can view the keys with commands like cat server.key and copy them into the files below.

The .key files are private keys and should never leave the server (the client's private key is only written into the client's configuration). The .pub files are public keys and are given to the other side.

Server configuration

First, find the name of the network interface the server uses to reach the internet:

ip route | grep default

The name that comes after the word dev in the output (for example eth0 or ens3) is the interface name. Create the /etc/wireguard/wg0.conf file:

[Interface]
Address = 10.8.0.1/24
ListenPort = 51820
PrivateKey = SERVER_PRIVATE_KEY
PostUp = iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
PostDown = iptables -t nat -D POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

[Peer]
# Phone
PublicKey = PHONE_PUBLIC_KEY
AllowedIPs = 10.8.0.2/32

• Address: The server's address on the VPN network. The 10.8.0.0/24 network has room for more than 250 devices.
• PrivateKey: The contents of the server.key file.
• PostUp and PostDown: Add the NAT rule that lets clients reach the internet with the server's IP address when the VPN comes up, and remove it when it goes down. Replace eth0 with your own interface name.
• [Peer]: One section for each client. AllowedIPs is the VPN address assigned to that client.

Turning on IP forwarding

So the server can forward traffic from clients to the internet, turn on IP forwarding:

echo "net.ipv4.ip_forward=1" | sudo tee /etc/sysctl.d/99-wireguard.conf
sudo sysctl --system

Firewall

If you use ufw, open the WireGuard port and allow traffic coming from the VPN to be forwarded:

sudo ufw allow 51820/udp
sudo ufw route allow in on wg0 out on eth0

By default ufw blocks forwarded traffic; without the second rule, clients connect but can't reach the internet. We explain how ports and firewalls work in our What is a port? article.

Starting WireGuard

sudo systemctl enable --now wg-quick@wg0
sudo wg show

enable makes the VPN start automatically every time the server boots. The wg show output shows connected clients, the time of the latest handshake and the amount of data transferred.

Client configuration

Create a configuration file for the client in the /etc/wireguard folder, for example phone.conf:

[Interface]
PrivateKey = PHONE_PRIVATE_KEY
Address = 10.8.0.2/32
DNS = 1.1.1.1

[Peer]
PublicKey = SERVER_PUBLIC_KEY
Endpoint = 203.0.113.10:51820
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25

• Endpoint: Your server's IP address and WireGuard port.
• AllowedIPs = 0.0.0.0/0: All IPv4 traffic goes through the tunnel. If you only want to reach services on the VPN network, write 10.8.0.0/24; the rest of your traffic continues over your normal connection.
• PersistentKeepalive: Keeps the connection open on mobile networks and behind home routers.

QR code for phones: The WireGuard mobile app can read the configuration from a QR code. On the server, this command shows the QR code right in the terminal:

qrencode -t ansiutf8 < phone.conf

In the app, scan the code with the Create from QR code option and turn on the tunnel. For computers, just import the .conf file into the WireGuard app for Windows, macOS or Linux.

Adding a new device

For each new device:

1. Generate a new key pair.
2. Add a new [Peer] section to the wg0.conf file and give it a free address (10.8.0.3/32, 10.8.0.4/32 ...).
3. Prepare a separate client file for the device.
4. Reload the configuration with sudo systemctl restart wg-quick@wg0.

Don't use the same key on more than one device; when two devices try to connect at the same time, they knock each other's connection off.

Security tips

• Protect the private keys. Make sure the /etc/wireguard folder is readable only by root, and delete the client files from the server after transferring them to the devices.
• Remove lost devices right away. If a phone is lost, delete its [Peer] section and restart WireGuard.
• Move admin services behind the VPN. Make databases and admin panels reachable only from the 10.8.0.0/24 network so these services are never exposed to the internet. For SSH security, take a look at our How to install Fail2ban guide too.
• Follow the usage rules. All traffic leaving your own VPN server appears with your server's IP address and is your responsibility. The Nodesty Fair Use Policy does not allow high-traffic VPN or reverse proxy services on plans covered by fair use; use WireGuard for secure access for your own devices and your team.

Nodesty servers for WireGuard

Nodesty AMD Ryzen 9 9950X VPS and AMD EPYC 7763 VPS plans run WireGuard at the kernel level with KVM virtualization and full root access. The Frankfurt and New York locations of the 9950X plans offer a low-latency tunnel for your devices in Europe and North America, and L3–L7 nShield DDoS protection keeps your VPN server safe from network-level attacks.