How do I set up WireGuard on a VPS?

What goes in the server's wg0.conf?

The server file holds the server's private key, its tunnel address, the listen port, the NAT rules and one [Peer] block per device. The heredoc below fills in both keys from the files made in step 3. Replace eth0 with the interface from step 4 before you run it.

WireGuard identifies each device by its public key: a packet is accepted only if it is signed by a known key and comes from that peer's AllowedIPs.

cd /etc/wireguard
cat > wg0.conf <<EOF
[Interface]
Address = 10.8.0.1/24
ListenPort = 51820
PrivateKey = $(cat server.key)
# Forward tunnel traffic and hide it behind the VPS address (eth0 = your interface)
PostUp = iptables -I FORWARD -i %i -j ACCEPT
PostUp = iptables -I FORWARD -o %i -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
PostUp = iptables -t nat -I POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i %i -j ACCEPT
PostDown = iptables -D FORWARD -o %i -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
PostDown = iptables -t nat -D POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

[Peer]
# phone
PublicKey = $(cat phone.pub)
AllowedIPs = 10.8.0.2/32
EOF
chmod 600 wg0.conf

What goes in the client config?

The client file holds the device's private key, its tunnel address, a DNS server, and the server's public key and address. AllowedIPs = 0.0.0.0/0, ::/0 sends all traffic into the tunnel, IPv6 included, so nothing leaks outside it. With the IPv4-only server above, IPv6 traffic simply stops, and most apps fall back to IPv4.

cd /etc/wireguard
cat > phone.conf <<EOF
[Interface]
PrivateKey = $(cat phone.key)
Address = 10.8.0.2/32
DNS = 9.9.9.9

[Peer]
PublicKey = $(cat server.pub)
Endpoint = YOUR_VPS_IP:51820
AllowedIPs = 0.0.0.0/0, ::/0
EOF

# Phone: scan this QR code in the WireGuard app
apt install -y qrencode
qrencode -t ansiutf8 < phone.conf

# Linux computer: copy phone.conf to /etc/wireguard/, then
# wg-quick up phone

Do I need to open a firewall port?

Only if a firewall runs on the VPS: it must let UDP 51820 in and let tunnel traffic through. With ufw, run ufw allow 51820/udp. The FORWARD rules in wg0.conf are inserted at the top of the chain, ahead of the default DROP policy that ufw sets for routed traffic. Keep port 22 open before you enable any firewall, or you lock yourself out.

How do I add another device?

Each device gets its own key pair, its own tunnel address and its own [Peer] block. Run wg genkey | tee laptop.key | wg pubkey > laptop.pub in /etc/wireguard. Add a [Peer] with PublicKey set to the new public key and AllowedIPs = 10.8.0.3/32. Apply it without dropping other devices: systemctl reload wg-quick@wg0, which runs wg syncconf. Build laptop.conf like phone.conf, with Address = 10.8.0.3/32.

How do I route IPv6 through the tunnel?

Add a private IPv6 range on both sides, forward it, and translate it like IPv4. Pick a random unique local range, such as fd42:42:42::/64.

• Server: Address = 10.8.0.1/24, fd42:42:42::1/64, and in the peer AllowedIPs = 10.8.0.2/32, fd42:42:42::2/128.
• NAT: copy the three PostUp and PostDown lines with ip6tables and the IPv6 range.
• Client: Address = 10.8.0.2/32, fd42:42:42::2/128.
• Forwarding: add net.ipv6.conf.all.forwarding=1 to /etc/sysctl.d/99-wireguard.conf.

Check one thing first. With forwarding on, the Linux kernel ignores router advertisements unless accept_ra is 2. If your VPS learns its IPv6 route that way, set net.ipv6.conf.eth0.accept_ra=2 in the same file.

Why does the tunnel connect but no website loads?

The handshake works but traffic stops at the server, almost always for one of four reasons.

• Forwarding is off: sysctl net.ipv4.ip_forward must print 1.
• Wrong interface in the NAT rule: compare eth0 in wg0.conf with ip route show default.
• No handshake at all: the endpoint IP or port is wrong, or a firewall blocks UDP 51820.
• Names do not resolve: the client has no working DNS line, or resolvconf is missing on a Linux client.

After each fix, run systemctl restart wg-quick@wg0 and test again.

Which VPS should I use for WireGuard?

Any KVM VPS with an IPv4 address works; the plan depends on how much traffic goes through the tunnel. The page on what the best offshore VPS for WireGuard is compares plans, quotas and locations. Prices for every plan are on how much an offshore VPS costs at OffshoreKVM. Before you rely on it for privacy, read what your VPS provider can see on your server.