Set up a WireGuard VPN server

Set up a WireGuard VPN server on Ubuntu and connect a client to it.

Prerequisites

• A Linux server (Ubuntu 22.04+ recommended).
• Root or sudo access.
• A public IP address: the server's primary IPv4.

Step 1: update the system

sudo apt update && sudo apt upgrade -y

Step 2: install WireGuard

sudo apt install wireguard -y
wg --version

Step 3: generate the server keypair

umask 077
wg genkey | tee server_private.key | wg pubkey > server_public.key

File	Use
server_private.key	Stays on the server. Never share.
server_public.key	Goes into each client's config.

Step 4: write the server config

sudo nano /etc/wireguard/wg0.conf

[Interface]
Address = 10.0.0.1/24
ListenPort = 51820
PrivateKey = <SERVER_PRIVATE_KEY>

PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; \
         iptables -A FORWARD -o wg0 -j ACCEPT; \
         iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; \
           iptables -D FORWARD -o wg0 -j ACCEPT; \
           iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

Replace <SERVER_PRIVATE_KEY> with the contents of server_private.key. If your primary interface is not eth0 (run ip a to confirm), update the MASQUERADE lines accordingly.

Step 5: enable IP forwarding

sudo nano /etc/sysctl.conf

Uncomment or add:

net.ipv4.ip_forward=1

Apply immediately:

sudo sysctl -p

Step 6: start WireGuard

sudo systemctl enable wg-quick@wg0
sudo systemctl start wg-quick@wg0
sudo wg show

wg show lists wg0 with no peers yet.

Step 7: add a client

Generate the client keypair (on the client machine)

wg genkey | tee client_private.key | wg pubkey > client_public.key

Register the client on the server

Edit /etc/wireguard/wg0.conf and add:

[Peer]
PublicKey = <CLIENT_PUBLIC_KEY>
AllowedIPs = 10.0.0.2/32

Reload:

sudo systemctl restart wg-quick@wg0

Client config file

On the client machine, create wg0.conf:

[Interface]
PrivateKey = <CLIENT_PRIVATE_KEY>
Address    = 10.0.0.2/24
DNS        = 1.1.1.1

[Peer]
PublicKey           = <SERVER_PUBLIC_KEY>
Endpoint            = YOUR_SERVER_PUBLIC_IP:51820
AllowedIPs          = 0.0.0.0/0
PersistentKeepalive = 25

Substitute the actual values:

Placeholder	Value
<CLIENT_PRIVATE_KEY>	Contents of client_private.key (client side).
<SERVER_PUBLIC_KEY>	Contents of server_public.key (server side).
YOUR_SERVER_PUBLIC_IP	The Gigahost server's primary public IPv4.

AllowedIPs = 0.0.0.0/0 makes the VPN a full-tunnel (all traffic). Set it to a specific subnet (e.g. 10.0.0.0/24) for a split-tunnel where only LAN traffic is routed.

Step 8: open the firewall

If UFW is enabled on the server:

sudo ufw allow 51820/udp

For firewalld:

sudo firewall-cmd --permanent --add-port=51820/udp
sudo firewall-cmd --reload

Test the tunnel

Activate the connection on the client (wg-quick up wg0, the official WireGuard desktop apps, or one of the mobile apps), then check what address the internet sees you as:

curl ifconfig.me

It should report your server's public IP, not your local one.

TIP

For multiple clients, repeat Step 7 with a fresh keypair per client and assign each its own 10.0.0.X/32 inside the same /24.

Where this fits

Lock SSH and other services down to the 10.0.0.0/24 VPN range so they are not exposed publicly. See Secure your Linux server.