VPS guide

How to Set Up Your Own WireGuard VPN on a VPS

By Gander Web · Published 16 October 2026 · 4 min read

WireGuard is a VPN built into the Linux kernel. Running it on a UK VPS gives you an encrypted tunnel on public Wi-Fi and a fixed UK IP address to browse from. This guide uses Ubuntu 24.04 or Debian 12 on the server, and you'll need sudo access and the server's public IP address.

Install WireGuard

sudo apt update
sudo apt install wireguard qrencode

qrencode is optional; it shows phone configs as a QR code. On Debian, also run sudo apt install iptables, which the config below uses.

Create the server's keys

wg genkey | sudo tee /etc/wireguard/server.key | wg pubkey | sudo tee /etc/wireguard/server.pub
sudo chmod 600 /etc/wireguard/server.key

The command prints the server's public key, which every device needs. Show the private key with sudo cat /etc/wireguard/server.key.

Find the network interface

ip route list default

The word after dev is your interface, for example eth0 or ens18. Use it in place of eth0 in the next two steps.

Write the server config

sudo nano /etc/wireguard/wg0.conf

[Interface]
Address = 10.8.0.1/24
ListenPort = 51820
PrivateKey = SERVER_PRIVATE_KEY
PostUp = iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
PostDown = iptables -t nat -D POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

Replace SERVER_PRIVATE_KEY with the contents of server.key, then lock the file down with sudo chmod 600 /etc/wireguard/wg0.conf. The PostUp and PostDown lines send VPN traffic out to the internet from the server's IP address. 10.8.0.0/24 is a private range for the tunnel; any private range that doesn't clash with your home network works.

Turn on IP forwarding

echo 'net.ipv4.ip_forward = 1' | sudo tee /etc/sysctl.d/99-wireguard.conf
sudo sysctl --system

Open the firewall

sudo ufw allow 51820/udp
sudo ufw route allow in on wg0 out on eth0

UFW blocks forwarded traffic by default. Without the second rule, devices connect to the VPN but can't reach the internet.

Start the VPN

sudo systemctl enable --now wg-quick@wg0
sudo wg show

wg show lists the interface and, once devices are added, each one and when it last connected.

Add a computer

Install the official WireGuard app (Windows, macOS, iOS and Android all have one). In the desktop app, choose Add Tunnel > Add empty tunnel. It generates the device's keys and shows its public key. Fill in the rest:

[Interface]
PrivateKey = (generated by the app)
Address = 10.8.0.2/32
DNS = 1.1.1.1

[Peer]
PublicKey = SERVER_PUBLIC_KEY
Endpoint = your-vps-ip:51820
AllowedIPs = 0.0.0.0/0, ::/0
PersistentKeepalive = 25

Then add the device to the end of /etc/wireguard/wg0.conf on the server, using its public key:

[Peer]
PublicKey = DEVICE_PUBLIC_KEY
AllowedIPs = 10.8.0.2/32

Restart with sudo systemctl restart wg-quick@wg0 and connect from the app. Give each device the next address: 10.8.0.3, 10.8.0.4 and so on.

AllowedIPs = 0.0.0.0/0, ::/0 sends all of the device's traffic through the tunnel. This server config only handles IPv4, so the device's IPv6 traffic is blocked rather than leaking outside the VPN. If you run Pi-hole on the same VPS, set DNS = 10.8.0.1 and allow DNS from the tunnel with sudo ufw allow in on wg0 to any port 53 for ad blocking on every device.

Add a phone with a QR code

Create the phone's keys and config on the server, then show the config as a QR code and scan it in the WireGuard app:

wg genkey | tee phone.key | wg pubkey > phone.pub
nano phone.conf
qrencode -t ansiutf8 < phone.conf

Write phone.conf like the computer config above, with the contents of phone.key as the PrivateKey and the next free address. Add phone.pub to wg0.conf as a peer, restart WireGuard, then delete the three files once the phone has the tunnel.

Questions

Related guides

Sources

1. WireGuard quick start

Commands are for Ubuntu 24.04, Debian 12 and AlmaLinux 9, as of 16 October 2026. If something here no longer matches what you see, tell us and we'll update it.