How to set up a WireGuard VPN on a VPS

WireGuard is a modern VPN that's fast, lean and remarkably simple to configure. Running it on your own VPS gives you a private, encrypted tunnel you fully control — for securing public Wi-Fi, reaching your servers privately, or just having a VPN that isn't a subscription service logging your traffic. Here's the complete setup.

Step 1: Install WireGuard

On a fresh Ubuntu or Debian VPS:

sudo apt update
sudo apt install wireguard -y

Step 2: Generate server keys

WireGuard uses public/private key pairs. Create the server's keys:

cd /etc/wireguard
umask 077
wg genkey | sudo tee server_private.key | wg pubkey | sudo tee server_public.key

The umask 077 ensures the private key isn't world-readable.

Step 3: Configure the server

Create /etc/wireguard/wg0.conf:

[Interface]
Address = 10.8.0.1/24
ListenPort = 51820
PrivateKey = SERVER_PRIVATE_KEY
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

Replace SERVER_PRIVATE_KEY with the contents of server_private.key. The PostUp/PostDown rules NAT client traffic out through the server's main interface (confirm yours is eth0 with ip route).

Step 4: Enable IP forwarding

The server must forward packets between the tunnel and the internet:

echo 'net.ipv4.ip_forward=1' | sudo tee /etc/sysctl.d/99-wireguard.conf
sudo sysctl -p /etc/sysctl.d/99-wireguard.conf

Step 5: Open the firewall

WireGuard listens on UDP 51820:

sudo ufw allow 51820/udp
sudo ufw allow OpenSSH
sudo ufw enable

Step 6: Start WireGuard

sudo systemctl enable --now wg-quick@wg0
sudo wg show

wg show displays the interface and (once clients connect) their status.

Step 7: Generate client keys

On the server, create a key pair for your first client:

wg genkey | tee client_private.key | wg pubkey | tee client_public.key

Step 8: Add the client to the server

Append a peer block to /etc/wireguard/wg0.conf:

[Peer]
PublicKey = CLIENT_PUBLIC_KEY
AllowedIPs = 10.8.0.2/32

Reload the config:

sudo wg syncconf wg0 <(wg-quick strip wg0)

Step 9: Configure the client device

On your laptop or phone (with WireGuard installed), create a client config:

[Interface]
PrivateKey = CLIENT_PRIVATE_KEY
Address = 10.8.0.2/24
DNS = 1.1.1.1

[Peer]
PublicKey = SERVER_PUBLIC_KEY
Endpoint = YOUR_SERVER_IP:51820
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25

AllowedIPs = 0.0.0.0/0 routes *all* your traffic through the VPN — the full-tunnel setup that protects you on untrusted networks. For a split tunnel that only reaches your private network, list just those subnets instead.

Step 10: Connect

On the client, bring the tunnel up (or toggle it on in the mobile app). Confirm your traffic now exits from the VPS:

curl ifconfig.me

It should show your server's IP. You're on your own VPN.

Adding more devices

Repeat steps 7–9 for each device, giving every one a unique address (10.8.0.3, 10.8.0.4, ...) and its own key pair. On mobile, WireGuard can display the client config as a QR code for instant setup.

Why self-host your VPN

Commercial VPNs ask you to trust their no-logs promises. With WireGuard on a Nxeon VPS — full root, low latency, a dedicated IP option — the server is yours, the logs are yours, and the performance is excellent because WireGuard is so lightweight. One small VPS comfortably handles a personal VPN for all your devices.