Your Own WireGuard VPN on a VPS: Setup Guide 2026

curl -sSL https://cp.lv/scripts/svoj-vpn-wireguard.sh | sudo bash

wget -qO- https://cp.lv/scripts/svoj-vpn-wireguard.sh | sudo bash

#!/usr/bin/env bash
# Your own WireGuard VPN: server plus the first client (Ubuntu/Debian)
set -euo pipefail

WG_DIR=/etc/wireguard
SERVER_IP=$(curl -s ifconfig.me)
WAN_IF=$(ip route list default | awk '{print $5; exit}')

# 1. Install
sudo apt update && sudo apt install -y wireguard wireguard-tools qrencode

# 2. Server and client keys
cd "$WG_DIR"
umask 077
wg genkey | sudo tee server_private.key | wg pubkey | sudo tee server_public.key
wg genkey | sudo tee client_private.key | wg pubkey | sudo tee client_public.key
SRV_PRIV=$(sudo cat server_private.key)
SRV_PUB=$(sudo cat server_public.key)
CLI_PRIV=$(sudo cat client_private.key)
CLI_PUB=$(sudo cat client_public.key)

# 3. Server config (variables are expanded)
sudo tee "$WG_DIR/wg0.conf" > /dev/null << EOF
[Interface]
Address = 10.8.0.1/24
ListenPort = 51820
PrivateKey = ${SRV_PRIV}
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o ${WAN_IF} -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o ${WAN_IF} -j MASQUERADE

[Peer]
PublicKey = ${CLI_PUB}
AllowedIPs = 10.8.0.2/32
EOF

# 4. Enable IP forwarding
echo "net.ipv4.ip_forward = 1" | sudo tee /etc/sysctl.d/99-wireguard.conf
sudo sysctl -p /etc/sysctl.d/99-wireguard.conf

# 5. Client config
sudo tee "$WG_DIR/client.conf" > /dev/null << EOF
[Interface]
PrivateKey = ${CLI_PRIV}
Address = 10.8.0.2/24
DNS = 1.1.1.1

[Peer]
PublicKey = ${SRV_PUB}
Endpoint = ${SERVER_IP}:51820
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25
EOF

# 6. Firewall and start
sudo ufw allow 51820/udp || true
sudo systemctl enable --now wg-quick@wg0
sudo qrencode -t ansiutf8 < "$WG_DIR/client.conf"
echo "Done: the VPN is up, client config is at $WG_DIR/client.conf"

Your own WireGuard VPN takes about 15 minutes to build: install the package, generate a key pair, describe the wg0 interface on the server, enable IP forwarding and add a client. Below is the full command sequence for Ubuntu/Debian on any VPS.

Why WireGuard

WireGuard is built into the Linux kernel, uses modern cryptography (Curve25519, ChaCha20) and runs faster than OpenVPN with a fraction of the code. Its configuration is two short files. For a personal VPN that is more than enough.

Minimum requirements: a VPS with 1 vCPU and 512 MB RAM, a public IPv4 address and root access. Any entry-level plan will do — encryption traffic barely loads the CPU.

Step 1. Installation

apt update && apt upgrade -y
apt install -y wireguard wireguard-tools

Step 2. Generating the server keys

cd /etc/wireguard
umask 077
wg genkey | tee server_private.key | wg pubkey > server_public.key
cat server_private.key
cat server_public.key

umask 077 keeps the private key unreadable for other users. Save both values — you will need them in the config.

Step 3. The server config

Find your external network interface:

ip route list default

It is usually eth0 or ens3. Open /etc/wireguard/wg0.conf in an editor (sudo nano /etc/wireguard/wg0.conf) and paste the contents:

[Interface]
Address = 10.8.0.1/24
ListenPort = 51820
PrivateKey = <server_private.key>
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

Or create the whole file with one command — copy it and paste it into the console (the quoted 'EOF' keeps the placeholders as they are):

sudo tee /etc/wireguard/wg0.conf > /dev/null << 'EOF'
[Interface]
Address = 10.8.0.1/24
ListenPort = 51820
PrivateKey = <server_private.key>
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
EOF

Replace eth0 with your own interface name and paste in the server private key.

Step 4. Enabling IP forwarding

Without this the server will not pass client traffic to the internet:

echo "net.ipv4.ip_forward = 1" > /etc/sysctl.d/99-wireguard.conf
sysctl -p /etc/sysctl.d/99-wireguard.conf

Step 5. Client keys and config

Generate a key pair for the client:

wg genkey | tee client_private.key | wg pubkey > client_public.key

On the client device, open client.conf in an editor (nano client.conf) and paste the contents:

[Interface]
PrivateKey = <client_private.key>
Address = 10.8.0.2/24
DNS = 1.1.1.1

[Peer]
PublicKey = <server_public.key>
Endpoint = <your_VPS_IP>:51820
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25

Or write the file in one command (the quoted 'EOF' leaves the placeholders untouched):

tee client.conf > /dev/null << 'EOF'
[Interface]
PrivateKey = <client_private.key>
Address = 10.8.0.2/24
DNS = 1.1.1.1

[Peer]
PublicKey = <server_public.key>
Endpoint = <your_VPS_IP>:51820
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25
EOF

AllowedIPs = 0.0.0.0/0 routes all traffic through the VPN. PersistentKeepalive = 25 keeps the connection alive behind NAT.

Step 6. Registering the client on the server

Append this to /etc/wireguard/wg0.conf:

[Peer]
PublicKey = <client_public.key>
AllowedIPs = 10.8.0.2/32

Step 7. Starting the tunnel

systemctl enable --now wg-quick@wg0
systemctl status wg-quick@wg0
wg show

Open the port in the firewall (if you use ufw):

ufw allow 51820/udp

Connecting a client

On a phone the easiest way is to import the config from a QR code:

apt install -y qrencode
qrencode -t ansiutf8 < client.conf

Scan the code in the WireGuard app and the tunnel comes up automatically.

Verification

Once connected, check your external IP:

curl ifconfig.me

It should return your VPS IP address. If it does not, check IP forwarding and the MASQUERADE rule.

Adding more clients

Every device needs its own key pair and its own address from the subnet. Generate keys for a second client:

cd /etc/wireguard
wg genkey | tee client2_private.key | wg pubkey > client2_public.key

Add a new block to /etc/wireguard/wg0.conf:

[Peer]
PublicKey = <client2_public.key>
AllowedIPs = 10.8.0.3/32

Apply the change without dropping existing connections:

wg syncconf wg0 <(wg-quick strip wg0)

The config is re-read on the fly and active peers stay online.

Backup and restore

All VPN settings live in /etc/wireguard. Keep a copy somewhere safe:

tar czf wireguard-backup.tar.gz /etc/wireguard

When moving to a new server, unpack the archive, install wireguard-tools and start wg-quick@wg0 — clients need no changes as long as the server IP stays the same.

Checking after a reboot

Make sure the interface comes up on its own:

reboot
# after logging back in
wg show
systemctl is-enabled wg-quick@wg0

The enabled output confirms autostart. If the interface did not come up, check journalctl -u wg-quick@wg0.

Interface security

The server private key is the most sensitive file you have. Check its permissions:

chmod 600 /etc/wireguard/*.key /etc/wireguard/wg0.conf

Never send private keys over unencrypted channels, and generate a separate pair for every device — that way one compromised client does not expose the rest.

Frequently asked questions

How many devices can I connect? As many as you need. Add a separate [Peer] block with a unique AllowedIPs for each device (10.8.0.3/32, 10.8.0.4/32 and so on).

Does WireGuard work over UDP only? Yes, WireGuard uses UDP exclusively. Make sure your ISP and firewall do not block the port you chose.

How do I improve DNS privacy? Set DNS = 1.1.1.1 on the client, or run your own resolver on the same VPS.

Can I change port 51820? Yes. Change ListenPort on the server and Endpoint on the clients, then open the new port in the firewall.

Do I need a dedicated server for the VPN? A separate VPS isolates the VPN from other workloads and makes access control simpler. For personal use the smallest plan is enough.

Ready to deploy your own VPN? Take a VPS for security and VPN or a basic VPS plan. No time for the setup — Server administration will handle it.