# How do I set up WireGuard on a VPS?

> How do I set up WireGuard on a VPS? 9 steps for Debian 12 and Ubuntu 24.04: install, keys, wg0.conf, NAT. VPS from $3.08, no KYC, crypto.

- URL: https://offshorekvm.com/how-to-set-up-wireguard-on-a-vps/
- Last updated: 2026-10-29
- Publisher: OffshoreKVM (https://offshorekvm.com)

Every command for a WireGuard VPN server on Debian 12 or Ubuntu 24.04: packages, keys, server and client files, IP forwarding, NAT and a first connection.

**Quick answer — How do I set up WireGuard on a VPS?**

To set up WireGuard on a VPS, install the `wireguard` package, generate a key pair for the server and one per device, and write `/etc/wireguard/wg0.conf`. Then turn on IP forwarding and NAT, start `wg-quick@wg0` and import the client file. On **OffshoreKVM**, a Debian 12 or Ubuntu 24.04 KVM VPS costs from $3.08 for 30 days. No KYC, pay in crypto.

## What do I need before I start?

| Attribute | Value |
| --- | --- |
| Server | A KVM VPS with its own kernel. OffshoreKVM KVM 1 (1 vCPU, 1 GB RAM, 20 GB NVMe, 2 TB traffic) is enough for a household |
| Access | Root access over SSH with your own public key; password login is off by default. Commands below run as root |
| System | Debian 12 or Ubuntu 24.04 LTS; both are among OffshoreKVM's images |
| Packages | `wireguard` and `iptables`, from the distribution's own repository |
| Port | UDP 51820, the port used in the WireGuard documentation's examples |
| Tunnel addresses | 10.8.0.0/24: server 10.8.0.1, first device 10.8.0.2 |
| Client apps | WireGuard for Windows, macOS, Android, iOS and Linux, listed on wireguard.com |
| Price | KVM 1 $3.08, KVM 2 $4.92, KVM 4 $8.25, KVM 8 $13.50, KVM 16 $20.62 per 30 days. No KYC, crypto only |

## How do I set up a WireGuard server, step by step?

Nine steps, from a fresh Debian 12 or Ubuntu 24.04 VPS to a phone that browses through it.

1. **Connect and update** — Log in with ssh root@YOUR_VPS_IP, then run apt update && apt upgrade -y.
2. **Install WireGuard and iptables** — Run apt install -y wireguard iptables. The WireGuard tools only recommend a firewall package, and the NAT rules below use iptables.
3. **Generate the keys** — Run cd /etc/wireguard && umask 077. Make the server pair with wg genkey | tee server.key | wg pubkey > server.pub. Make the device pair with wg genkey | tee phone.key | wg pubkey > phone.pub.
4. **Find the public interface** — Run ip route show default. The word after dev, such as eth0 or ens3, is the interface the NAT rule needs.
5. **Write the server file** — Create /etc/wireguard/wg0.conf with the server's private key, the listen port, the NAT rules and one [Peer] per device, as shown below.
6. **Turn on IP forwarding** — Run echo 'net.ipv4.ip_forward=1' > /etc/sysctl.d/99-wireguard.conf && sysctl --system. Without it, the VPS drops traffic from the tunnel.
7. **Start the tunnel at boot** — Run systemctl enable --now wg-quick@wg0, then wg show to see the interface, its port and the peer.
8. **Create and import the client file** — Write phone.conf as shown below. Import it in the WireGuard app, or show it as a QR code with qrencode -t ansiutf8 < /etc/wireguard/phone.conf.
9. **Test the tunnel** — Turn the tunnel on and open any website. On the server, wg show now prints a recent latest handshake, and sites see the VPS address.

## What goes in the server's wg0.conf?

The server file holds the server's private key, its tunnel address, the listen port, the NAT rules and one `[Peer]` block per device. The heredoc below fills in both keys from the files made in step 3. Replace `eth0` with the interface from step 4 before you run it.

**WireGuard identifies each device by its public key: a packet is accepted only if it is signed by a known key and comes from that peer's `AllowedIPs`.**

*Server: /etc/wireguard/wg0.conf (run as root)*

```bash
cd /etc/wireguard
cat > wg0.conf <<EOF
[Interface]
Address = 10.8.0.1/24
ListenPort = 51820
PrivateKey = $(cat server.key)
# Forward tunnel traffic and hide it behind the VPS address (eth0 = your interface)
PostUp = iptables -I FORWARD -i %i -j ACCEPT
PostUp = iptables -I FORWARD -o %i -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
PostUp = iptables -t nat -I POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i %i -j ACCEPT
PostDown = iptables -D FORWARD -o %i -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
PostDown = iptables -t nat -D POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

[Peer]
# phone
PublicKey = $(cat phone.pub)
AllowedIPs = 10.8.0.2/32
EOF
chmod 600 wg0.conf
```

`%i` is replaced by the interface name, `wg0`, when `wg-quick` runs the `PostUp` and `PostDown` lines. `MASQUERADE` rewrites each packet to the address of the outgoing interface. The iptables manual prefers `SNAT --to-source YOUR_VPS_IP` for a static address; both work here.

## What goes in the client config?

The client file holds the device's private key, its tunnel address, a DNS server, and the server's public key and address. `AllowedIPs = 0.0.0.0/0, ::/0` sends all traffic into the tunnel, IPv6 included, so nothing leaks outside it. With the IPv4-only server above, IPv6 traffic simply stops, and most apps fall back to IPv4.

*Client: /etc/wireguard/phone.conf (made on the server)*

```bash
cd /etc/wireguard
cat > phone.conf <<EOF
[Interface]
PrivateKey = $(cat phone.key)
Address = 10.8.0.2/32
DNS = 9.9.9.9

[Peer]
PublicKey = $(cat server.pub)
Endpoint = YOUR_VPS_IP:51820
AllowedIPs = 0.0.0.0/0, ::/0
EOF

# Phone: scan this QR code in the WireGuard app
apt install -y qrencode
qrencode -t ansiutf8 < phone.conf

# Linux computer: copy phone.conf to /etc/wireguard/, then
# wg-quick up phone
```

Use any DNS resolver you trust in place of `9.9.9.9`. On a Linux client, the `DNS` line needs `resolvconf` or `openresolv`, which Debian lists as suggested packages. Delete `phone.key` and `phone.conf` from the server once the device has its copy.

## Do I need to open a firewall port?

Only if a firewall runs on the VPS: it must let UDP 51820 in and let tunnel traffic through. With `ufw`, run `ufw allow 51820/udp`. The `FORWARD` rules in `wg0.conf` are inserted at the top of the chain, ahead of the default `DROP` policy that `ufw` sets for routed traffic. Keep port 22 open before you enable any firewall, or you lock yourself out.

## How do I add another device?

Each device gets its own key pair, its own tunnel address and its own `[Peer]` block. Run `wg genkey | tee laptop.key | wg pubkey > laptop.pub` in `/etc/wireguard`. Add a `[Peer]` with `PublicKey` set to the new public key and `AllowedIPs = 10.8.0.3/32`. Apply it without dropping other devices: `systemctl reload wg-quick@wg0`, which runs `wg syncconf`. Build `laptop.conf` like `phone.conf`, with `Address = 10.8.0.3/32`.

## How do I route IPv6 through the tunnel?

Add a private IPv6 range on both sides, forward it, and translate it like IPv4. Pick a random unique local range, such as `fd42:42:42::/64`.

- **Server:** `Address = 10.8.0.1/24, fd42:42:42::1/64`, and in the peer `AllowedIPs = 10.8.0.2/32, fd42:42:42::2/128`.
- **NAT:** copy the three `PostUp` and `PostDown` lines with `ip6tables` and the IPv6 range.
- **Client:** `Address = 10.8.0.2/32, fd42:42:42::2/128`.
- **Forwarding:** add `net.ipv6.conf.all.forwarding=1` to `/etc/sysctl.d/99-wireguard.conf`.

Check one thing first. With forwarding on, the Linux kernel ignores router advertisements unless `accept_ra` is 2. If your VPS learns its IPv6 route that way, set `net.ipv6.conf.eth0.accept_ra=2` in the same file.

## Why does the tunnel connect but no website loads?

The handshake works but traffic stops at the server, almost always for one of four reasons.

- **Forwarding is off:** `sysctl net.ipv4.ip_forward` must print `1`.
- **Wrong interface in the NAT rule:** compare `eth0` in `wg0.conf` with `ip route show default`.
- **No handshake at all:** the endpoint IP or port is wrong, or a firewall blocks UDP 51820.
- **Names do not resolve:** the client has no working `DNS` line, or `resolvconf` is missing on a Linux client.

After each fix, run `systemctl restart wg-quick@wg0` and test again.

## Which VPS should I use for WireGuard?

Any KVM VPS with an IPv4 address works; the plan depends on how much traffic goes through the tunnel. The page on [what the best offshore VPS for WireGuard is](https://offshorekvm.com/best-offshore-vps-for-wireguard/ "Plans, locations and traffic for a WireGuard VPS") compares plans, quotas and locations. Prices for every plan are on [how much an offshore VPS costs at OffshoreKVM](https://offshorekvm.com/pricing/ "OffshoreKVM plans and prices"). Before you rely on it for privacy, read [what your VPS provider can see on your server](https://offshorekvm.com/what-can-my-vps-provider-see/ "What a VPS host can and cannot see").

## WireGuard on a VPS: FAQ

### Which port does WireGuard use?

WireGuard has no fixed port. `ListenPort` is optional, and without it the server picks a random port. UDP 51820 is the port in the official examples, so most guides use it.

### Do I need PersistentKeepalive?

Usually not. The `wg` manual says most users will not need it. Add `PersistentKeepalive = 25` to the client's `[Peer]` only if the server must reach a device that sits behind NAT and stays idle.

### Does this guide work on Debian 13 or Ubuntu 22.04?

Yes. Both ship WireGuard in their standard repositories, so the same commands work. Only Debian releases older than Bullseye need backports, per the WireGuard install page.

### Can my VPS host see what I do through the tunnel?

The tunnel ends on the VPS, so traffic leaves it as normal internet traffic; HTTPS keeps page content encrypted. No logs: we keep no connection logs, no traffic logs and no IP addresses of visitors or customers, on the website, the dashboard or the VPS. The guide to [whether you need an offshore VPS or a VPN](https://offshorekvm.com/offshore-vps-vs-vpn/ "Offshore VPS or commercial VPN compared") weighs the trade-offs.

### How long until my VPS is ready?

A person creates your VPS once your payment is confirmed, and it is ready minutes later, never more than one hour after that confirmation; your dashboard shows the status, then the IP address once the VPS is running. The WireGuard setup itself takes a few minutes once you can log in.

**Get a VPS for your WireGuard server** Debian 12 or Ubuntu 24.04 on KVM, from $3.08 for 30 days. No KYC, crypto only. [Deploy KVM 1 with Debian 12](https://offshorekvm.com/app/checkout/?plan=kvm-1&location=nl-ams&image=debian-12&lang=en) · [Compare plans](https://offshorekvm.com/pricing/ "How much does an offshore VPS cost at OffshoreKVM?")

## Sources

1. [Installation](https://www.wireguard.com/install/) — WireGuard (read 2026-10-29)
2. [Quick Start](https://www.wireguard.com/quickstart/) — WireGuard (read 2026-10-29)
3. [wg(8) manual](https://git.zx2c4.com/wireguard-tools/about/src/man/wg.8) — wireguard-tools (read 2026-10-29)
4. [wg-quick(8) manual](https://git.zx2c4.com/wireguard-tools/about/src/man/wg-quick.8) — wireguard-tools (read 2026-10-29)
5. [wg-quick@.service](https://git.zx2c4.com/wireguard-tools/tree/src/systemd/wg-quick@.service) — wireguard-tools (read 2026-10-29)
6. [Package wireguard-tools (bookworm)](https://packages.debian.org/bookworm/wireguard-tools) — Debian (read 2026-10-29)
7. [IP Sysctl (ip_forward, forwarding, accept_ra)](https://docs.kernel.org/networking/ip-sysctl.html) — The Linux Kernel documentation (read 2026-10-29)
8. [iptables-extensions(8): MASQUERADE, SNAT, conntrack](https://manpages.debian.org/bookworm/iptables/iptables-extensions.8.en.html) — Debian manpages (read 2026-10-29)
9. [sysctl(8)](https://manpages.debian.org/bookworm/procps/sysctl.8.en.html) — Debian manpages (read 2026-10-29)
10. [qrencode(1)](https://manpages.debian.org/bookworm/qrencode/qrencode.1.en.html) — Debian manpages (read 2026-10-29)

---

OffshoreKVM: OffshoreKVM sells offshore Linux KVM VPS in the Netherlands, Iceland, Switzerland and Romania, paid in crypto with no KYC: no ID, no selfie, no documents. It is run by DomaineGoat LLC, a company registered in Panama that ignores DMCA notices, answers only to Panamanian law and keeps no logs. Every plan costs at least 25% less than the cheapest comparable plan of 24 no-KYC crypto VPS hosts checked on 29 October 2026.