WireGuard is a modern VPN protocol known for its simplicity, security, and high performance. Compared to traditional VPN solutions like OpenVPN or IPSec, WireGuard is easier to configure and offers better speed while maintaining robust encryption.

In this guide, we’ll walk you through setting up a WireGuard VPN server on a Linux-based system, configuring firewall rules, and adding peers (clients) securely. By the end, you’ll have a fully functional WireGuard VPN server ready for secure remote access.

Why Use WireGuard?

WireGuard is a great choice for VPNs because:

• Simple Configuration: Unlike OpenVPN and IPSec, WireGuard uses minimal configuration.
• High Performance: Faster than traditional VPNs due to efficient cryptographic protocols.
• Strong Security: Uses modern cryptography with Curve25519, ChaCha20, and Poly1305.
• Cross-Platform: Works on Linux, Windows, macOS, Android, and iOS.
• Lightweight: A small codebase (less than 4000 lines) makes it easy to audit and secure.

Prerequisites

Before proceeding, ensure you have:

• A Linux-based server (Ubuntu 20.04/22.04 recommended, but Debian or CentOS works too)
• Root or sudo access
• A public IP address

Step 1: Install WireGuard on the Server

First, update your package list and install WireGuard:

sudo apt update && sudo apt install wireguard -y

Once installed, confirm WireGuard is available:

wg --version

This should display the WireGuard version installed on your system.

Step 2: Generate WireGuard Server Keys

WireGuard uses public-key cryptography. We need to generate private and public keys for the server:

umask 077
wg genkey | tee /etc/wireguard/privatekey | wg pubkey > /etc/wireguard/publickey

Store the keys safely:

• Private Key (never share this!):

  cat /etc/wireguard/privatekey

• Public Key (for sharing with clients):

  cat /etc/wireguard/publickey

Step 3: Configure the WireGuard Server

Create a new WireGuard configuration file:

sudo nano /etc/wireguard/wg0.conf

Paste the following configuration (modify as needed):

[Interface]
Address = 10.8.0.1/24
SaveConfig = false
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -A FORWARD -o wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -D FORWARD -o wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
ListenPort = 51820
PrivateKey = <your-server-private-key>

Replace <your-server-private-key> with the output of:

cat /etc/wireguard/privatekey

Save and exit the file (CTRL+X, then Y, then Enter).

Step 4: Configure Firewall Rules

To ensure proper routing, update the firewall settings:

sudo ufw allow 51820/udp
sudo ufw enable

Enable IP forwarding:

echo "net.ipv4.ip_forward = 1" | sudo tee -a /etc/sysctl.conf
sudo sysctl -p

Reload firewall:

sudo systemctl restart ufw

Step 5: Start and Enable WireGuard

To start WireGuard and enable it on boot:

sudo systemctl enable wg-quick@wg0
sudo systemctl start wg-quick@wg0

Check if WireGuard is running:

sudo wg show

Step 6: Adding Peers (Clients)

Each client (peer) connecting to the VPN needs a public/private key pair.

Generate Keys for a New Peer

On the server, generate keys for a new client:

wg genkey | tee client_privatekey | wg pubkey > client_publickey

Retrieve the keys:

• Private Key: cat client_privatekey
• Public Key: cat client_publickey

Add a New Peer to the Server

Edit the WireGuard configuration file:

sudo nano /etc/wireguard/wg0.conf

Append the following at the end:

[Peer]
PublicKey = <client-public-key>
AllowedIPs = 10.8.0.2/32

Replace <client-public-key> with the contents of client_publickey.

Restart WireGuard:

sudo systemctl restart wg-quick@wg0

To verify the new peer is added:

sudo wg show

Conclusion

You now have a fully configured WireGuard VPN server! 🎉

Next Steps:

• Set up clients (Android, Windows, macOS) – see our separate guide.
• Monitor connections using wg show.
• Automate peer addition with scripts if needed.

With WireGuard, you can now securely connect to your home or business network from anywhere in the world! 🚀